# Cookie Banner Dark Patterns: The Reject Button Regulators Keep Fining

Source: https://bannerwarden.com/blog/2026-11-12-cookie-banner-dark-patterns-cnil-fines.html

November 12, 2026

*The dark patterns are asymmetry, pre-selection, concealment, and hierarchy manipulation: a reject button that is harder to find than accept, boxes pre-ticked, purposes buried, and wording that steers. The EDPB named them in 2023, and the CNIL is now fining for them. Build the banner symmetric and the problem goes away.*

## The fines stopped being warnings

In September 2025, France's CNIL fined Google 325 million euros and Shein 150 million euros specifically for cookie-banner dark patterns. That was not the first enforcement, but it was the largest, and it ended the argument about whether dark patterns are a real compliance risk or a design opinion. They are a compliance risk, measured in nine figures, and the patterns the CNIL fined for are the same ones on most storefronts: a reject option that is harder to reach than accept, pre-selected purposes, and wording that steers the shopper toward the choice the site wants.

The research behind the enforcement is older than the fines. NOYB's 2021 survey found 81 percent of EU cookie banners had no reject button on the first layer, 73 percent used deceptive colors and contrasts, and only 18 percent offered an easy withdrawal mechanism. Mathur and colleagues' 2019 study of 11,000 shopping sites found dark patterns on 11.1 percent of them, with prevalence rising with the site's popularity. Bigger sites do this more, not less. And the effect is measured: simply removing the reject option from the first screen, so refusing took a second click, raised the consent rate by 22 to 23 percentage points in the Nouwens study. The banner is not measuring preference. It is manufacturing it.

## The four patterns, and the symmetric banner

The EDPB's Guidelines 03/2022, adopted in version 2.0 in February 2023, is the canonical European definition, and it sorts the patterns into categories practitioners now use as a checklist. Asymmetry: accept is a button and reject is a link, or accept is bright and reject is gray, or accept takes one click and reject takes three. Pre-selection: optional purposes arrive pre-ticked, so consent is the default and refusal is the work. Concealment: the reject option is buried in a paragraph or a second layer, or the purposes are hidden behind a link that does not say what it leads to. Hierarchy manipulation: the wording steers, "accept all for the best experience" against a reject labeled "continue with limited features". Each one renders the consent invalid, because GDPR requires consent to be freely given, specific, informed, and unambiguous, and a steered choice is none of those.

The symmetric banner is the fix, and it is not a design philosophy. Accept and reject are buttons of the same size, shape, and prominence, on the same layer, in the same language. No purpose is pre-ticked. The text says what the site does with data, in the shopper's words. Withdrawal is as easy as acceptance. That banner will report a lower opt-in rate than the one it replaces, and the rate it reports will be real. The CNIL's December 2024 formal-notice wave ordered publishers to give reject buttons equal prominence within 30 days, and the September 2025 fines showed what happens after the notice. Build it symmetric now, and the notice never arrives. The same banner fails the readability test in [nobody reads your banner because it reads like a contract](https://bannerwarden.com/blog/2026-11-10-consent-banner-geolocation-eu-vs-us-rules.md), and [one banner, two rulebooks](https://bannerwarden.com/blog/2026-11-10-cookie-consent-renewal-six-months-cnil.md) is the geolocation version of the same problem.

## Frequently asked questions

### What did the CNIL fine Google and Shein for?

Cookie-banner dark patterns. In September 2025 the CNIL fined Google 325 million euros and Shein 150 million euros, specifically for banner designs that steered users toward acceptance and made refusal harder.

### What are the four dark pattern categories?

Asymmetry, pre-selection, concealment, and hierarchy manipulation: reject harder to reach than accept, optional purposes pre-ticked, reject buried or hidden, and wording that steers the user toward acceptance.

### How much do dark patterns change consent rates?

A lot. Removing the reject option from the first screen raised consent by 22 to 23 percentage points in the Nouwens study, and equal-prominence reject buttons swing rates by 25 to 35 points in CMP A/B data.

### Is a high opt-in rate evidence of compliance?

No. A high rate from an asymmetric banner measures friction, not consent. The EDPB has been explicit since 2023 that consent obtained through deceptive design is not valid consent.