The Cookie Consent Trap: Why Rejecting Tracking Is Still Deliberately Hard
Anyone who has browsed the web in Europe over the past several years has encountered a familiar frustration: cookie consent banners where the "Accept All" button is large, colourful, and front-and-centre, while the option to reject tracking or customise preferences is buried, greyed out, or hidden behind multiple menus. This is not a coincidence or a design oversight — it is an intentional strategy. And despite years of GDPR cookie consent compliance requirements explicitly prohibiting these so-called "dark patterns," they remain widespread across the European web.
This is the core tension examined by ICT lawyer Arnoud Engelfriet in a recurring legal column for security.nl: why, if GDPR has been clear since its inception that giving consent must be as easy as withdrawing or refusing it, do so many websites continue to make rejection as difficult as possible? The answer, as Engelfriet explains, is uncomfortable but simple — enforcement has been too slow, too rare, and too lenient to change business behaviour at scale.
What GDPR Cookie Consent Rules Actually Say — and What Sites Ignore
Under the General Data Protection Regulation (GDPR), consent for data processing must be freely given, specific, informed, and unambiguous. Critically, it must be as easy to withdraw consent as it is to give it. This is not a grey area — it is a foundational principle that European data protection authorities, including the Dutch Autoriteit Persoonsgegevens (AP), have consistently reiterated in their guidance on cookie banners.
In practice, this means that a website cannot legally present a bright green "Accept All" button alongside a barely visible or deliberately obscured "Manage Preferences" option that requires navigating multiple screens and deselecting dozens of pre-ticked boxes. Yet this is precisely what many high-traffic European websites do. According to research published by the Norwegian Consumer Council and cited by the European Data Protection Board (EDPB), a significant majority of websites studied used at least one dark pattern to manipulate user consent — including pre-selected options, misleading button labels, and visual design that nudged users toward accepting tracking.
The EDPB itself issued guidelines on dark patterns in online interfaces, explicitly classifying asymmetric accept/reject button designs as non-compliant. A large, colourful "Accept" button paired with a small, low-contrast "Reject" link is, in the EDPB's view, a manipulative design that undermines the legal validity of any consent obtained through it. In other words: if your banner looks like this, the consent you collect may be legally worthless.
From Vienna to Amsterdam: Recent Enforcement Cases That Reveal the Pattern
Enforcement actions are gradually accumulating, even if they remain too infrequent to change industry behaviour at scale. A notable recent case involved Austrian public broadcaster ORF, which was found to have designed its cookie consent interface in a way that made accepting cookies significantly more visually prominent than rejecting them. The "Accept" button was presented in a striking colour, while the rejection option was deliberately understated. A court ruled that ORF must redesign its cookie banner to bring it into alignment with GDPR requirements — a ruling that, while significant, represents only one organisation in one country.
In the Netherlands, Engelfriet highlights just two formal fine decisions involving cookie banners: one against pharmacy and drugstore chain Kruidvat, and one against consumer electronics retailer Coolblue, both in 2024. In both cases, cookies were enabled by default — meaning users who did nothing would have their data collected — and the process for opting out was deliberately cumbersome. The AP issued Kruidvat an initial fine of €600,000. However, after the company appealed the decision, the fine was reduced to €50,000 — a 92% reduction that privacy professionals and digital rights advocates have noted sets a troubling precedent for deterrence. Coolblue received a €40,000 fine.
"The problem is structural: if complying with GDPR means fewer people click 'accept,' and the fine for non-compliance is smaller than the revenue lost from compliant design, rational actors will continue to choose non-compliance."
— Arnoud Engelfriet, ICT lawyer and Chief Knowledge Officer at ICTRechtFollowing the Coolblue and Kruidvat decisions, the Dutch data protection authority declared cookie banners an enforcement priority. But as Engelfriet pointedly notes, subsequent follow-through has been limited. Cookie banner dark patterns remain widespread on Dutch and broader European websites, suggesting that the announcement of a priority has not translated into sustained investigative or sanctioning activity.
Why Cookie Dark Patterns Persist Despite Clear Legal Prohibitions
Understanding why dark patterns continue to proliferate despite clear legal prohibitions requires looking at the underlying economics. Websites — particularly those reliant on advertising revenue — derive significant commercial value from obtaining broad tracking consent. A compliant, symmetric cookie banner that makes rejection equally easy will, in practice, result in fewer users consenting to tracking. Industry estimates suggest that opt-in rates on compliant banners can be substantially lower than on those using manipulative design. For ad-supported businesses, this directly translates into lower advertising yield.
The calculation that many organisations appear to be making, consciously or not, is a straightforward risk-reward one: the probability of being investigated and fined is low, and even when fines are issued, they tend to be modest relative to the commercial gain from non-compliant consent collection. This is not unique to cookie banners — it is a pattern observed across GDPR enforcement more broadly, where the gap between the regulation's theoretical maximum penalties and the fines actually imposed remains enormous.
There is also a technical complexity argument. Many websites — particularly larger ones — rely on third-party consent management platforms (CMPs) to handle their cookie banners. The configuration of these platforms involves dozens of vendor categories, hundreds of individual third-party trackers, and complex IAB TCF (Transparency and Consent Framework) consent strings. Even organisations that intend to be compliant sometimes produce non-compliant outputs because the tooling itself is complex, inconsistently interpreted, or configured by teams who lack privacy expertise. A 2023 analysis by privacy research organisation noyb (None of Your Business) found that many major CMPs were used in configurations that did not meet GDPR requirements even after regulatory guidance had been published.
How Cookie Consent Compliance Breaks Down Across Common Design Choices
| Banner Design Element | Common Practice | GDPR Compliant? | Risk Level |
|---|---|---|---|
| Cookies enabled by default | Very common, especially for analytics and advertising cookies | ❌ No | High |
| Asymmetric button design (large Accept, small Reject) | Widespread across publisher and e-commerce sites | ❌ No | High |
| Reject hidden behind "Manage Preferences" | Common pattern; requires multiple clicks to reject | ⚠️ Disputed | Medium-High |
| Symmetric Accept / Reject buttons, same prominence | Less common; used by privacy-conscious organisations | ✅ Yes | Low |
| No consent banner for non-essential cookies | Rare but observed on some sites claiming legitimate interest | ❌ No | Very High |
| Single-click "Reject All" at first layer | Best practice; increasingly required by DPAs | ✅ Yes | Low |
For developers and privacy professionals implementing or auditing cookie consent mechanisms, the table above highlights where the most common compliance failures occur. The presence of a "Manage Preferences" option does not make a banner compliant if that path requires significantly more effort than accepting. National data protection authorities, including France's CNIL — which has issued some of the most prescriptive guidance on cookie banner design in Europe — have made clear that a "Reject All" option must be available at the first layer of the consent interface, not buried several clicks deep.
What Needs to Change: Stronger Enforcement and Smarter Technical Standards
The path to genuine GDPR cookie consent compliance is not technically complex — the law is clear, the design requirements are well-documented, and the tooling exists to implement compliant banners. The real barrier is economic and regulatory: without consistent, proportionate enforcement, organisations that choose non-compliance face minimal consequences while enjoying meaningful commercial gains.
Privacy advocates and legal experts have proposed several mechanisms to close this gap. First, data protection authorities need to invest in systematic, automated monitoring of cookie banners at scale — rather than relying on individual complaints to trigger investigations. Organisations like noyb have pioneered automated scanning of cookie consent interfaces across thousands of sites, and their complaint-driven approach has generated dozens of enforcement actions across Europe. But regulators
Originally reported by Security.NL. Summarised and curated by European Purpose.
