Cookie Consent Banners That Make Refusing as Easy as Accepting

On many websites, the first interface a visitor meets isn’t the headline or the navigation. It’s a cookie consent banner, and it is often built to produce one answer: a large, brightly colored Accept button beside a faint link to “settings,” where refusing takes several more steps.

That design may lift consent rates, but it sits awkwardly with what European and UK regulators now say a valid request looks like, and with what research shows about how people respond to these banners. This article covers both and turns them into design decisions for a business or service site.

---

Why the banner is a design decision

A cookie consent banner, usually supplied by a consent management platform (CMP), is a small interface that asks visitors to allow or refuse cookies and similar technologies that store or read information on their device. Under the EU’s ePrivacy rules and the UK’s Privacy and Electronic Communications Regulations (PECR), non-essential uses such as advertising and most tracking require the visitor’s prior consent.

The law sets the conditions for valid consent. Design decides whether a particular banner meets them. Button order, color, contrast, wording, and the number of clicks to each option are all layout choices, and regulators now assess them as such.

Where design goes wrong, it tends to fall into a few recognizable patterns:

1. A missing first-layer Reject option. Accepting takes one click and refusing takes a trip into settings.
2. Pre-ticked boxes. Optional categories arrive switched on, so “Save” quietly means “accept.”
3. An unequal presentation. Refusal appears as a text link inside a paragraph, or as a button whose text barely contrasts with its background.

---

What regulators say a valid banner needs

The EDPB taskforce’s minimum positions

In January 2023, the European Data Protection Board (EDPB) adopted the report of its Cookie Banner Taskforce, which coordinated national regulators’ responses to complaints filed by the privacy group NOYB. The report presents the common denominator agreed by those authorities, a minimum threshold rather than a full compliance checklist. Several of its positions translate directly into layout rules:

• Reject on the same layer as Accept. A vast majority of authorities considered that a banner offering a consent button without a refuse or reject option on the same layer is not in line with valid consent requirements and constitutes an infringement. A few authorities disagreed, noting that the ePrivacy Directive doesn’t explicitly mention a reject option.
• No pre-ticked boxes. The taskforce confirmed that pre-ticked opt-in boxes don’t produce valid consent, citing the GDPR’s recital that silence, pre-ticked boxes, or inactivity “should not therefore constitute consent.”
• No buried link as the only alternative. A refusal offered only as a link embedded in a paragraph, without sufficient visual support to draw an average user’s attention, was listed as not leading to valid consent.
• No unreadable buttons. The authorities agreed that no single color or contrast standard can be imposed, and that each banner needs case-by-case review. They did single out one practice as potentially manifestly misleading: a refusal button whose text contrast is so low that it is unreadable to virtually any user.
• Easy withdrawal. Visitors must be able to withdraw consent at any time, as easily as they gave it. The report mentions a small, permanently visible icon or a link in a standard location as examples, without mandating either.

The ICO’s 2026 guidance for UK sites

The UK Information Commissioner’s Office (ICO) finalized its guidance on storage and access technologies on 29 April 2026, after consultations that included changes to PECR under the Data (Use and Access) Act. Its checklist for consent mechanisms opens with the same principle: the mechanism must make it “as easy to refuse consent as it is to accept.” Its bad-practice examples include banners that offer only Accept all and More options, and notices that treat “continuing to use our website” as consent.

The guidance adds several points that matter for design. Technologies that need consent must not run until the visitor actively agrees, because “silence or inactivity doesn’t qualify.” It also warns that a banner designed for a desktop browser can be hard to read or use on a phone, which may leave consent given there invalid. And after a visitor declines, the ICO says sites should not keep asking; it suggests six months as a suitable interval before requesting fresh consent.

“A banner that makes one answer effortless and the other tedious isn’t asking a question. It’s making the decision for the visitor.”
— Windware Studio Practice Note

---

What the research shows about banner design

Regulators’ concern about layout rests partly on evidence that layout changes the answer. In a paper presented at CHI 2020, the ACM Conference on Human Factors in Computing Systems, Midas Nouwens and colleagues from Aarhus University, MIT, and University College London studied consent pop-ups in two ways.

How common steering designs were

First, the team scraped the banners of the five most popular CMPs on the top 10,000 UK websites in September 2019, finding 680 sites. The researchers defined three minimum conditions drawn from European law: consent must be explicit, rejecting all must be as easy as accepting all, and optional boxes must not be pre-ticked. Only 11.8% of those sites met all three.

The details explain why. Half the sites (50.1%) had no Reject all button at all, and only 12.6% offered one that took no more clicks than Accept all. Pre-ticked optional vendors or purposes appeared on 56.2% of sites, and 32.5% treated actions such as simply visiting or scrolling as consent.

How design changed visitors’ choices

Second, the researchers ran a field experiment with 40 participants, injecting eight banner designs into the websites they visited during normal browsing. Removing the Reject all button from the first layer increased the probability of consent by 22 to 23 percentage points. Showing more granular choices on the first layer, such as lists of purposes or vendors, lowered consent by 8 to 20 percentage points.

Two behavioral findings are especially useful for designers. Almost all interactions (93.1%) happened on the banner’s first page; the “more options” link was clicked only 6.9% of the time. Only 17 of 1,280 answers, or 1.3%, reflected a visitor choosing a specific selection of purposes or vendors. In practice, whatever isn’t on the first layer is rarely seen.

The limits of the evidence

The study has clear boundaries, which its authors state. The 40 participants were mostly young, university-educated, recruited largely through a computer science department mailing list, and living in the United States, so the authors describe the results as a likely “best case scenario” rather than a representative sample. The scrape reflects banners from 2019, and CMP products and their defaults may have changed since. The direction of the findings is consistent with the regulators’ positions, but the exact percentages shouldn’t be read as predictions for any particular site.

---

Designing a banner that holds up

Element-by-element choices

Banner element	Design that steers	Design that holds up
First-layer buttons	Accept all, plus Settings	Accept all and Reject all on the same layer, with a Manage choices option
Visual weight	Bright Accept button, faint or low-contrast Reject	Both buttons the same size, style, and readability
Optional categories	Toggles on by default	Toggles off until the visitor switches them on
Wording	“By continuing, you agree”	A short plain-language purpose statement and a clear question
Mobile layout	A desktop dialog squeezed onto a phone	A layout tested at phone widths, with full-size buttons
After the choice	No way back except clearing cookies	A persistent link or icon to reopen preferences
Re-prompting	Asking again on every visit after a refusal	Respecting the answer for a reasonable period

Reduce what needs consent

The strongest design improvement is often a smaller banner, and that starts with an audit of what the site actually loads. For each script or embed, record what it stores, who receives the data, and why.

Consider a small architecture practice whose site loads an analytics tool, an advertising pixel left over from one campaign, a chat widget, and embedded project videos. Removing the unused pixel and loading videos only when a visitor presses play may reduce the banner to one or two genuine choices.

The ICO’s guidance also describes exceptions that some UK sites can use. Its statistical purposes exception covers analytics used solely to produce aggregate statistics for improving the site, provided visitors get clear information and a simple, free way to object; it doesn’t cover advertising or tracking individuals. For embedded videos, it suggests not setting technologies until the visitor presses play, using a privacy mode where available, and for external font libraries it notes that self-hosting fonts is an option. These exceptions are UK-specific and narrow, so they are a question for the business’s privacy adviser, not a design shortcut.

Checklist: before the banner goes live

• Every script, pixel, and embed on the site is listed with its purpose and provider.
• Nothing that requires consent runs before the visitor chooses.
• Accept all and Reject all appear on the first layer with equal size, color treatment, and contrast.
• Optional categories are off by default on the settings layer.
• The banner text names the purposes in plain language and links to fuller details, including third parties.
• The banner is usable at phone widths and with a keyboard.
• A persistent link or icon lets visitors reopen their preferences.
• Choosing Reject all actually prevents the relevant scripts from loading, confirmed in the browser’s developer tools.

---

What this guidance doesn’t settle

The EDPB report itself says its positions are a minimum threshold, must be combined with each country’s national ePrivacy laws and guidance, and don’t amount to a regulator’s approval of any specific design. The ICO’s guidance applies to the UK, and its new exceptions don’t automatically carry over to the EU. Businesses serving visitors in other regions, including the United States or Mexico, face different rules again. None of this article is legal advice; the jurisdiction question belongs with a qualified adviser.

There is also a real tradeoff. On the research above, an equal-weight Reject button is likely to lower consent rates, which means less analytics and advertising data. For many service businesses, that cost is easier to absorb than it sounds: the measure that matters most, inquiries received, can be counted without tracking individual visitors.

---

Practical takeaways for your next website

1. Design refusal as a first-class option. Put Reject all beside Accept all, at the same size and visual weight.
2. Default to off. Optional categories should start switched off, and nothing that needs consent should load before a choice.
3. Put what matters on the first layer. Research suggests visitors rarely go deeper, so the first screen has to be complete and readable.
4. Shrink the banner by shrinking the scripts. Audit trackers and embeds, remove the unused ones, and load media on request.
5. Make changing your mind easy. A persistent preferences link, and a refusal respected rather than re-asked on every visit.

---

Ready to Discuss Your Website?

If you are planning a new website, a service redesign, or custom development for your business, we’re here to help you build a site that respects visitors’ choices from the first screen.

• Explore Our Services: Web Design · Web Development · Website Redesign
• Start a Conversation: Tell us about your project via our Contact Form or email us directly at [email protected].