# Does the reject button have to be as easy to find as accept? - CookieRampart

Source: https://cookierampart.com/blog/cookie-banner-reject-button-requirements.html

[Home](../index.md) / [Blog](index.md) / Does the reject button have to be as easy to find as accept?


September 22, 2026 - CookieRampart

Yes, in practice. European data protection authorities have converged on one rule: refusing consent must be as easy as giving it. A banner with a bright "Accept all" button and a grey "settings" link buried two clicks deep does not meet that bar, and regulators have fined companies for exactly that design.

## What "as easy as" actually means

The test regulators apply is simple: count the clicks and compare the prominence. If accepting takes one click on a prominent button, rejecting should take one click on an equally prominent button. The French CNIL, the Spanish AEPD, and several other authorities have all issued decisions where the violation was not the absence of a reject option but its demotion. A reject path hidden inside a second-layer preferences panel, styled to look inactive, or labeled with confusing wording like "configure" instead of "reject" keeps failing this test.

## The designs that keep getting flagged

There is a small hall of fame of non-compliant patterns. The pre-ticked boxes, which the Court of Justice ruled out years ago. The "legitimate interest" toggle wall that makes analytics look mandatory. The banner with no reject option at all on the first layer, just "accept" and "customize." And the close-X that silently counts as consent, which it does not. If your banner matches any of these descriptions, the fix is not a legal memo. It is a redesign.

## A compliant first layer is boring on purpose

The banners that pass review are visually unremarkable: two buttons of equal weight, "Accept" and "Reject" (or "Refuse"), side by side, plus a link to granular settings for visitors who want them. Equal size, equal contrast, equal clicks. Behind it, the technical requirement is that rejecting actually blocks the non-essential scripts. A pretty reject button that fires the analytics tag anyway is worse than no banner, because it manufactures evidence of non-compliance.

## What to check on your own site

Open your site in a fresh browser session and try to refuse everything. Count your clicks. Then open developer tools, clear cookies, refuse again, and watch the network tab for analytics and ad requests. If anything non-essential fires before or despite your refusal, the banner is decoration. Fix the blocking first, then the button layout. Regulators check both.

## Related reading

[Do small websites need a cookie banner?](do-small-websites-need-a-cookie-banner.md)[What cookies does Google Analytics set, and do they need consent?](what-cookies-does-google-analytics-set.md)[What are strictly necessary cookies?](https://cookierampart.com/glossary/strictly-necessary.md)

## Get a free consent audit of your website

[Free consent audit](mailto:hello@cookierampart.com?subject=Free%20consent%20audit%20-%20cookierampart.com)