# Dark Patterns in Cookie Banners: The Designs Regulators Actually Fine

Source: https://cookierampart.com/blog/2026-11-09-dark-patterns-cookie-banners-fines.html

[Home](../index.md) / [Blog](index.md) / Dark Patterns in Cookie Banners: The Designs Regulators Actually Fine


Published 2026-11-09

A banner offered two buttons. Accept was large, bright, and on the right. Reject was small, grey, and behind a second click labeled Manage preferences. The site's accept rate was 94 percent. The owner called it a good banner. A regulator called it a dark pattern, and the distinction is not a matter of taste. The EDPB Guidelines 03/2022 on deceptive design patterns name exactly this design, and the fines that followed it are public.

A dark pattern is a design that steers the visitor toward a choice they would not otherwise make. In consent banners the steering is almost always in one direction: toward yes. The patterns have names, and the names are useful, because they turn a vague feeling that a banner is pushy into a specific defect that can be checked.

## The pattern regulators named

The EDPB guidelines describe several patterns, and three of them show up in banners constantly. The first is the unequal path: accept in one click, reject in two or three, with the reject buried in a settings panel. The second is the pre-ticked box, where a purpose is already checked and the visitor has to uncheck it. The Planet49 case settled that one: consent has to be an active act, and a box that is already ticked is not one. The third is the false hierarchy, where the accept button is large and bright and the reject is small and grey, so the eye goes to yes before the mind has read the words.

The common thread is effort. Every pattern makes yes easy and no hard, and the difference is measured in clicks, in size, and in reading order. A banner that takes one click to accept and three to reject is not giving a choice. It is giving a maze with one exit marked.

## Two designs that drew fines

The French regulator fined a major platform for a banner where rejecting took several clicks and accepting took one. The decision turned on the number of steps, not on the wording. The banner's text was accurate. The path was not equal, and the fine followed the path. The German cases went the same way, with the courts holding that a reject option hidden behind a settings layer was not a real choice.

The smaller cases are more instructive than the big ones, because the sites were ordinary. A regional news site was ordered to redesign a banner where the reject button was smaller and lower than the accept button. A retailer was told to fix a banner where the settings panel reset the visitor's choices when it was closed. None of these sites set out to deceive anyone. They used a default design, and the default design was a dark pattern.

## The one-line test

Count the clicks. Accept takes one. Reject should take one. If it takes more, the banner is a dark pattern by the EDPB definition, whatever the wording says. Then check the size and the color. The two buttons should be the same size, the same weight, and the same prominence. Then check the pre-ticked boxes. Every box should start empty. If any box starts checked, the consent it produces is not valid, and the Planet49 ruling says so in plain terms.

Run the test on the banner as it ships, not as it was designed. A banner that passes in the design tool and fails on the live site, because a script reordered the buttons or a theme restyled them, is still a failure. The regulator tests the live site. So should you.

Keep reading: [why pre-ticked boxes failed the Planet49 test](https://cookierampart.com/blog/2026-11-07-preticked-boxes-planet49-rule.md), [how reject button placement is audited](https://cookierampart.com/blog/2026-11-04-reject-button-placement-audit.md), and [Cookiebot vs CookieYes for small sites](https://cookierampart.com/blog/2026-11-07-cookiebot-vs-cookieyes-small-sites.md) cover the nearby cases in this series.

## Frequently asked questions

### What is a dark pattern in a cookie banner?

A design that steers the visitor toward a choice they would not otherwise make, usually toward yes. The EDPB Guidelines 03/2022 name the patterns: unequal paths, pre-ticked boxes, and false hierarchies where accept is large and bright and reject is small and grey.

### Is a pre-ticked consent box illegal?

Yes, in the EU. The Planet49 ruling held that consent has to be an active act, and a box that is already ticked is not one. Every box should start empty, and the visitor has to check it themselves.

### How many clicks should rejecting take?

One, the same as accepting. If accept takes one click and reject takes two or three, the banner is a dark pattern by the EDPB definition, whatever the wording says. Count the clicks on the live site, not in the design tool.

### Have small sites actually been fined for dark patterns?

Yes. Regional news sites and retailers have been ordered to redesign banners where the reject button was smaller and lower than accept, or where a settings panel reset the visitor's choices when closed. The fines follow the design, not the size of the company.