The Reject all button: why your banner needs one

Your cookie banner needs a Reject all button on the first screen, next to Accept all, with the same size, weight and visibility. That is the single rule behind most of the cookie fines of the last five years: the French CNIL wrote it into its guidelines in September 2020, fined Google €150 million and Facebook €60 million at the end of 2021 for a banner that took one click to accept and five actions to refuse, and the EDPB's cookie banner taskforce confirmed in January 2023 that a vast majority of European authorities see a banner with an accept button but no reject option as an infringement.

What the authorities say

CNIL (France). The guidelines and recommendation adopted on 17 September 2020 state that refusing trackers must be as easy as accepting them ("Refuser les traceurs doit être aussi aisé que de les accepter"), and the recommendation describes the simple way to do it: two buttons on the first layer, presented at the same level and in the same format, labelled for example "tout accepter" and "tout refuser". Sites had until the end of March 2021 to comply. After that, the CNIL sent formal notices to about twenty organisations in May 2021, a second series in July 2021 and about thirty more in December 2021, nearly 90 in total, then moved to fines. In 2026 the pattern continues at smaller scale: of the 23 sanctions the CNIL issued under its simplified procedure between January and July 2026, several concerned banners where accepting took one click but refusing required opening a "personnaliser" screen.

EDPB taskforce (all EU authorities). The report adopted on 17 January 2023 records that a vast majority of authorities consider the absence of a refuse or reject option on any layer that has a consent button to be an infringement of the ePrivacy Directive. It also lists designs that do not lead to valid consent: a "refuse" or "continue without accepting" link embedded in a paragraph of text without visual support, or placed outside the banner where the accept buttons are. On colours and contrast the taskforce declined to impose a standard, but called a reject button whose text is unreadable against its background manifestly misleading. Details are in our article on the taskforce report.

ICO (UK). The ICO's guidance on storage and access technologies says users must be able to reject non-exempt technologies "as easily as they can accept them", that you must not pre-enable them, and that "by continuing to use our website you consent" is not valid consent even with an OK button.

California. The opt-out model is different, but the symmetry rule is the same. In March 2025 the California Privacy Protection Agency fined American Honda $632,500 in part because its privacy tool "failed to offer Californians their privacy choices in a symmetrical or equal way".

What "as easy" means in practice

Equal ease is measured in clicks, in visibility and in wording.

• Same screen. Reject all sits on the first layer. A reject option that only appears after "Settings" or "Customize" is one layer deeper than Accept all, which is the Google and TikTok case.
• Same number of actions. One click to accept, one click to refuse.
• Same prominence. Same size, same font weight, same button shape. A contrasting colour on Accept is not forbidden by any text, but the more the design pushes one option, the more it looks like the "deceptive button contrast" practice the taskforce examined. The safe choice is two buttons that look like siblings.
• Clear words. "Reject all", "Refuse", "Decline" are fine. "Continue without accepting" in grey text above the banner is the pattern the CNIL named in its December 2024 formal notices, where the reject option was a link whose colour, font size and style favoured accepting.
• It must work. A Reject all that still lets cookies through is worse than none. The CNIL fined Yahoo €10 million in December 2023 after finding at least twenty advertising cookies placed without prior consent, and American Express €1.5 million in November 2025 for advertising cookies set after the visitor refused.

Will it lower my consent rate?

Yes, compared with a banner that hides the refusal. A study of consent pop-ups on the top 10,000 UK websites (Nouwens and colleagues, 2020) found that removing the reject button from the first page increased the probability of consent by 22 to 23 percentage points, which is exactly why the practice spread, and why regulators treat consent collected that way as invalid. With equal buttons, surveys run for the CNIL in June 2022 found 59% of French internet users accepting cookies and 39% refusing. The honest numbers and what moves them are in our consent rate article.

Remember the refusal

A banner that reappears on every page because the refusal was not stored is a pressure tactic, and the EDPB's deceptive design guidelines call it "continuous prompting". The CNIL recommendation says that keeping the choice, consent or refusal, for six months is good practice; the ICO suggests the same six months before asking someone who declined again. Store the refusal in the same first-party cookie as the acceptance and do not ask again before it expires, unless your purposes change.

The Cookiequiet default

Cookiequiet shows Accept all and Reject all with the same size and weight on the first screen of every layout, with no pre-ticked optional category, a Customize button that opens the four categories, and a stored choice that lasts 182 days by default. The wording of each button is editable per language if your brand prefers "Decline" to "Reject all".