Dark patterns in cookie banners - what you must not do
A dark pattern is an interface built to steer the user toward the decision that suits the site owner rather than the user. Cookie banners make this tempting: paint "Accept" green and tuck "Reject" away behind settings. The catch is that consent obtained this way is not freely given, so in legal terms it does not exist.
Where the rules come from
Not from a single provision, but from regulatory practice:
- CJEU, case C-673/17 (Planet49) - consent from a pre-ticked box is invalid. Hence the rule: every category other than strictly necessary starts switched off.
- EDPB Cookie Banner Taskforce report (January 2023) - the collective position of supervisory authorities after a wave of complaints, naming specific patterns as infringements.
- CNIL - the French regulator runs the most consistent line, issuing formal notices in December 2024 to sites relying on dark patterns.
The patterns to stay away from
- Unequal buttons - "Accept all" highlighted, "Reject" reduced to grey text or a link. Refusal belongs on the first layer, styled the same way.
- Refusal one click further away - accept in one click, reject only after opening "Settings" and clearing six toggles.
- Toggles on by default - squarely against Planet49.
- Cookie walls - no content without consent. Treat as high risk.
- Consent fatigue - a banner that reappears on every visit after a refusal. A "no" deserves the same respect as a "yes".
- Misleading wording - "I agree to a better experience" instead of saying that this is advertising profiling.
One simple test
Ask yourself a single question: does refusing take the same number of clicks as accepting, and do both buttons look like equally real options? If not, you have a dark pattern, whatever the labels say.
Compliance built in, not configured in
In CookieFox button symmetry is not a setting you can switch off: "Reject" sits on the first layer in the same CSS class as "Accept", and non-essential categories are hard-wired off by default. There is no way to accidentally configure the banner into invalidating the consents it collects.
See how it looks. For picking a tool, read how to choose a CMP.