Dark patterns in cookie banners: what the EDPB calls deceptive design

A dark pattern in a cookie banner is any design choice that pushes visitors toward accepting more than they would if the options were presented fairly: a bright Accept next to a grey link, a refusal hidden two screens deep, a banner that returns on every page, categories pre-ticked, "essential" stuck on advertising cookies. The European Data Protection Board gave these practices a taxonomy in its Guidelines 03/2022 on deceptive design patterns, adopted in final form on 14 February 2023, and its cookie banner taskforce said in January 2023 which of them make consent invalid. Regulators have since fined companies for most of them.

The EDPB taxonomy

The guidelines were written for social media interfaces, but the categories describe interface design in general and the EDPB uses the term "deceptive design patterns" for what others call dark patterns. They rely on the GDPR's principles of fairness and transparency (article 5(1)(a)), the duty to inform clearly (article 12) and data protection by design and by default (article 25). The six families, with the EDPB's definitions and their cookie banner forms:

Overloading: users face "an avalanche of requests, information, options or possibilities" that prompts them to share more. Continuous prompting is the banner that reappears on every page or every visit until you accept. Privacy maze is the preferences centre buried under layers of links. Too many options is a first screen with forty vendors and twelve purposes to toggle, where Accept all is the only reasonable exit.

Skipping: the interface makes users "forget or do not think about" the data protection aspects. Deceptive snugness is the pre-ticked category: the most data-invasive setting is on by default. Look over there is a banner that talks about your great experience and the free content while the choice sits in the corner.

Stirring: the design "affects the choice users would make by appealing to their emotions or using visual nudges". Emotional steering is "we need cookies to keep this site free" or a sad face next to Reject. Hidden in plain sight is a reject option styled to be overlooked: small, grey, a text link among text.

Obstructing: users are blocked or slowed "in their process of getting informed or managing their data". Dead end is a privacy link that goes nowhere. Longer than necessary is five actions to refuse against one to accept, the design that cost Google €150 million and Facebook €60 million in the CNIL's decisions of 31 December 2021. Misleading action is a button labelled in a way that does the opposite of what the visitor expects.

Fickle: the interface is "inconsistent and not clear". Lacking hierarchy is information repeated in several forms with different wording. Decontextualising is a cookie setting placed where nobody looks for it. Language discontinuity is a banner in English for a French audience, or a policy that switches language halfway.

Left in the dark: the interface hides information or controls. Conflicting information is a banner that says "we respect your choice" while the policy says tracking is on regardless. Ambiguous wording is "essential" or "strictly necessary" applied to advertising cookies, the practice the taskforce calls inaccurately classified essential cookies.

What the cookie banner taskforce added

The taskforce report of 17 January 2023 turns part of the taxonomy into enforcement positions. A vast majority of authorities treat a banner with an accept button and no reject option on the same layer as an infringement. Pre-ticked boxes never produce valid consent. A reject option that is a link embedded in a paragraph, or placed outside the banner, without sufficient visual support to draw attention, does not produce valid consent. On colours and contrast the authorities refused to impose a standard but agreed that a button whose text is unreadable against its background is manifestly misleading, with everything else judged case by case. Presenting "legitimate interest" toggles in a second layer, so that visitors think they must refuse twice, was called confusing. Our summary of the report covers the rest.

Enforcement, with dates

• 31 December 2021, CNIL: Google (€150 million) and Facebook (€60 million). One click to accept; refusing required opening "Personalise" and performing at least five actions. Obstructing, longer than necessary.
• 29 December 2022, CNIL: TikTok (€5 million). Several clicks to refuse against one to accept until a Reject all button was added in February 2022; a first layer giving "only a general and approximate description of the purposes". Obstructing and left in the dark.
• 12 December 2024, CNIL: formal notices to several website publishers whose reject option was a link whose colour, font size and style favoured accepting, buried in surrounding text without spacing, while the accept option appeared several times. Stirring, hidden in plain sight. The notices cite the taskforce report.
• 12 March 2025, California Privacy Protection Agency: American Honda ($632,500), in part for a privacy tool that "failed to offer Californians their privacy choices in a symmetrical or equal way". Same principle, opt-out model.
• 1 September 2025, CNIL: Google (€325 million), in part because users creating an account "were encouraged to choose cookies linked to the display of personalised advertisements" and were not clearly told that accepting them was a condition of the service. Stirring and left in the dark.
• January to July 2026, CNIL: part of the 23 simplified-procedure sanctions concerned banners where Accept all was immediate and refusing required a "personnaliser" screen. Obstructing, again.

Why the patterns persist

Because they work. Nouwens and colleagues measured in 2020 that removing the reject button from the first page raises consent by 22 to 23 percentage points; Utz and colleagues found that highlighted buttons and pre-checked boxes have a large effect, and that in a clean opt-in setting fewer than 0.1% of visitors allowed cookies for all purposes. A 20-point gap in consent is a lot of ad revenue, which is why regulators treat the gap itself as evidence that the consent was not free. What a compliant banner yields is lower, and real.

A banner without dark patterns

• Accept all and Reject all on the first screen, same size, same weight, same number of clicks.
• Customize on the same screen; categories off by default behind it, except necessary.
• One plain sentence on purposes; the full list one click away.
• No "essential" label on anything the site can work without.
• The choice remembered for about six months, no re-prompting before that.
• A visible way to withdraw later, with the same ease.
• Same language as the page; same wording in the policy.

This is how Cookiequiet's banner is built by default: equal buttons, no pre-ticked optional category, four categories behind Customize, a stored choice, 24 languages, and the wording editable if you want to say "Decline" instead of "Reject all". Fairness of the design is then down to the colours and words you choose, which the checklist above covers.