The Banner After a Redesign: Why a New Layout Means a New Consent Decision
The site got a new banner design on Monday. Same purposes, same vendors, new layout. The reject button moved from the bottom right to a link in the footer. The accept button got bigger. The visitors who consented to the old banner never saw the new one, and the site is running on consents given to a different screen. Nobody re-asked, because the purposes did not change. The screen did.
Consent is informed, and informed means the visitor knew what they were agreeing to. When the banner changes, what the visitor saw changes, and the record of what they saw is the banner version. The SecurePrivacy audit guide lists the banner version as one of the six fields a valid consent log must carry, precisely because a consent given to version 3 is not a consent given to version 4. A redesign is a new version, and a new version is a new consent event.
What a redesign actually changes
Layout changes the choice. A reject button that was a button and is now a link is a different choice, even if the text is the same, because fewer visitors will find it. A banner that was a full-screen modal and is now a small bar at the bottom is a different choice, because fewer visitors will read it. The dark pattern fines of the last two years are full of exactly this: the California Privacy Protection Agency fined Honda 632,500 dollars for a cookie tool configured with an asymmetric opt-out, two steps to disallow advertising cookies against one click to allow all. The layout was the violation. The purposes were fine.
The second change is subtler. A redesign usually comes with new copy, and new copy means new purposes described in new words. A purpose that used to say analytics now says site improvement, and a visitor who accepted analytics may not have accepted site improvement, because they are not the same words and they do not mean the same thing. The Cookie-Script proof of consent guide makes the point the same way: the record has to show the exact text the visitor agreed to, not a summary of it.
The re-ask rule for redesigns
Not every redesign needs a re-ask. A color change does not. A font change does not. A change to the placement, size, or wording of the accept and reject controls does, because those are the controls the visitor used to make the choice. The rule is simple: if the redesign changes how easy it is to say no, the old consents do not cover the new banner, and the affected visitors need to be asked again.
The practical version is to version the banner and treat a redesign as a version bump. Every consent event records the banner version the visitor saw. When the version changes in a way that affects the choice, the platform re-asks the visitors whose stored version is older. Visitors who consented to the old layout get the new banner once, make their choice, and the log records the new version. Nobody is asked twice for the same screen, and nobody is held to a choice they made on a screen that no longer exists.
How to ship a redesign without breaking consent
Start by writing down what changed, in the language of the choice, not the language of the design. Which controls moved, which words changed, and whether saying no got easier or harder. If the answer is harder, stop and fix the layout before it ships, because a banner that makes no harder to say is a dark pattern, and the fines for dark patterns are now measured in hundreds of thousands of dollars.
Then bump the version and let the platform re-ask. Show the new banner to returning visitors once, with clear copy about what changed. Most will make the same choice they made before, because the purposes did not change. The ones who choose differently are telling you something true about the new layout, and that is information, not a loss. The record will show the new version, the new timestamp, and the new choice, and the audit will be able to follow the whole story.
Keep reading: dark patterns and the fines that followed, the reject button placement audit, and no cookies, still need a banner cover the nearby cases in this series.
Frequently asked questions
Does a banner redesign mean I have to ask visitors again?
It depends on what changed. A color or font change does not. A change to the placement, size, or wording of the accept and reject controls does, because those are the controls the visitor used to make the choice.
Why does the banner version matter for consent records?
Because consent is informed, and informed means the visitor knew what they were agreeing to. A consent given to banner version 3 is not a consent given to version 4. The log has to show which version each visitor saw.
Can a layout change be a violation even if the purposes are fine?
Yes. The California Privacy Protection Agency fined Honda 632,500 dollars for a cookie tool with an asymmetric opt-out, two steps to disallow against one click to allow. The layout was the violation. The purposes were fine.
How do I roll out a redesign without breaking consent?
Version the banner and treat a redesign as a version bump. Let the platform re-ask visitors whose stored version is older, once, with clear copy about what changed. The log records the new version, timestamp, and choice.