# The Reject all button: why your banner needs one

> Refusing cookies must be as easy as accepting them: a Reject all button on the first screen, as large as Accept all, is what the CNIL, EDPB and ICO expect.

Source: https://cookiequiet.com/guides/reject-all-button
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Put both buttons on the first layer** Accept all and Reject all must be visible together before any settings screen. A Customize or Settings button can sit beside them.
2. **Style them as siblings** Same size, same font weight, same shape. If you give Accept a filled colour, make sure Reject is a real button with readable contrast, not a grey text link.
3. **Use plain labels** Reject all, Refuse or Decline. Avoid phrases that describe refusing as a loss or hide it in a sentence.
4. **Make refusal stop the trackers** Clicking Reject all must leave only necessary categories active: no analytics cookie, no advertising pixel, no embed that contacts a third party.
5. **Store the refusal** Save the refusal in a first-party cookie for about six months and do not show the banner again before it expires.
6. **Test in a fresh profile** Open the site in a private window, click Reject all, and check the Application and Network tabs of the developer tools for anything that should not be there.

Your cookie banner needs a Reject all button on the first screen, next to Accept all, with the same size, weight and visibility. That is the single rule behind most of the cookie fines of the last five years: the French CNIL wrote it into its guidelines in September 2020, fined Google €150 million and Facebook €60 million at the end of 2021 for a banner that took one click to accept and five actions to refuse, and the EDPB's cookie banner taskforce confirmed in January 2023 that a vast majority of European authorities see a banner with an accept button but no reject option as an infringement.

## What the authorities say

**CNIL (France).** The guidelines and recommendation adopted on 17 September 2020 state that refusing trackers must be as easy as accepting them ("Refuser les traceurs doit être aussi aisé que de les accepter"), and the recommendation describes the simple way to do it: two buttons on the first layer, presented at the same level and in the same format, labelled for example "tout accepter" and "tout refuser". Sites had until the end of March 2021 to comply. After that, the CNIL sent formal notices to about twenty organisations in May 2021, a second series in July 2021 and about thirty more in December 2021, nearly 90 in total, then moved to fines. In 2026 the pattern continues at smaller scale: of the 23 sanctions the CNIL issued under its simplified procedure between January and July 2026, several concerned banners where accepting took one click but refusing required opening a "personnaliser" screen.

**EDPB taskforce (all EU authorities).** The report adopted on 17 January 2023 records that a vast majority of authorities consider the absence of a refuse or reject option on any layer that has a consent button to be an infringement of the ePrivacy Directive. It also lists designs that do not lead to valid consent: a "refuse" or "continue without accepting" link embedded in a paragraph of text without visual support, or placed outside the banner where the accept buttons are. On colours and contrast the taskforce declined to impose a standard, but called a reject button whose text is unreadable against its background manifestly misleading. Details are in [our article on the taskforce report](/blog/edpb-cookie-banner-taskforce-report).

**ICO (UK).** The ICO's guidance on storage and access technologies says users must be able to reject non-exempt technologies "as easily as they can accept them", that you must not pre-enable them, and that "by continuing to use our website you consent" is not valid consent even with an OK button.

**California.** The opt-out model is different, but the symmetry rule is the same. In March 2025 the California Privacy Protection Agency fined American Honda $632,500 in part because its privacy tool "failed to offer Californians their privacy choices in a symmetrical or equal way".

## What "as easy" means in practice

Equal ease is measured in clicks, in visibility and in wording.

- **Same screen.** Reject all sits on the first layer. A reject option that only appears after "Settings" or "Customize" is one layer deeper than Accept all, which is the Google and TikTok case.
- **Same number of actions.** One click to accept, one click to refuse.
- **Same prominence.** Same size, same font weight, same button shape. A contrasting colour on Accept is not forbidden by any text, but the more the design pushes one option, the more it looks like the "deceptive button contrast" practice the taskforce examined. The safe choice is two buttons that look like siblings.
- **Clear words.** "Reject all", "Refuse", "Decline" are fine. "Continue without accepting" in grey text above the banner is the pattern the CNIL named in its December 2024 formal notices, where the reject option was a link whose colour, font size and style favoured accepting.
- **It must work.** A Reject all that still lets cookies through is worse than none. The CNIL fined Yahoo €10 million in December 2023 after finding at least twenty advertising cookies placed without prior consent, and American Express €1.5 million in November 2025 for advertising cookies set after the visitor refused.

## Will it lower my consent rate?

Yes, compared with a banner that hides the refusal. A study of consent pop-ups on the top 10,000 UK websites (Nouwens and colleagues, 2020) found that removing the reject button from the first page increased the probability of consent by 22 to 23 percentage points, which is exactly why the practice spread, and why regulators treat consent collected that way as invalid. With equal buttons, surveys run for the CNIL in June 2022 found 59% of French internet users accepting cookies and 39% refusing. The honest numbers and what moves them are in [our consent rate article](/blog/cookie-consent-rates-what-to-expect).

## Remember the refusal

A banner that reappears on every page because the refusal was not stored is a pressure tactic, and the EDPB's deceptive design guidelines call it "continuous prompting". The CNIL recommendation says that keeping the choice, consent or refusal, for six months is good practice; the ICO suggests the same six months before asking someone who declined again. Store the refusal in the same first-party cookie as the acceptance and do not ask again before it expires, unless your purposes change.

## The Cookiequiet default

Cookiequiet shows Accept all and Reject all with the same size and weight on the first screen of every layout, with no pre-ticked optional category, a Customize button that opens the four categories, and a stored choice that lasts 182 days by default. The wording of each button is editable per language if your brand prefers "Decline" to "Reject all".

## Questions

### Can the reject option be a text link instead of a button?

The EDPB taskforce says a reject link embedded in a paragraph, or placed outside the banner, without enough visual support to draw attention does not lead to valid consent. A link styled as prominently as the accept button is harder to challenge, but a real button of the same size removes the question.

### Is a 'Continue without accepting' link acceptable?

Only when it is as visible and as easy as the accept button. The CNIL's formal notices of December 2024 targeted banners where it was a small link in a different colour and font. If you use it, style it exactly like Accept all.

### Do Accept all and Reject all have to be the same colour?

No authority imposes a colour standard; the taskforce explicitly refused to. What they assess case by case is whether the design misleads. Two buttons of the same size with readable text are the safe choice; a bright Accept next to a barely visible Reject is not.

### Does the law literally say 'Reject all'?

No. Article 5(3) of the ePrivacy Directive requires consent, and the GDPR requires it to be freely given. Regulators derive the button from that: if refusing is harder than accepting, the consent is not free. The CNIL's recommendation and the EDPB taskforce report are where the button became the concrete expectation.

## Sources

- [CNIL, Cookies et autres traceurs : la CNIL publie des lignes directrices modificatives et sa recommandation (29 September 2020)](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices-modificatives-et-recommandation)
- [EDPB, Report of the work undertaken by the Cookie Banner Taskforce (adopted 17 January 2023)](https://www.edpb.europa.eu/our-work-tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en)
- [CNIL, Refusing cookies should be as easy as accepting them: the CNIL continues its action and issues new orders (14 December 2021)](https://www.cnil.fr/en/refusing-cookies-should-be-easy-accepting-them-cnil-continues-its-action-and-issues-new-orders)
- [CNIL, Les sanctions prononcées par la CNIL (list of sanctions)](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil)
- [ICO, Guidance on the use of storage and access technologies: how do we comply with the PECR rules?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-comply-with-the-pecr-rules/)