Dark patterns are the manipulative designs in a cookie banner that push the visitor toward "Accept" and make rejecting harder: no reject button on the first layer, color-imbalanced buttons, guilt-tripping copy, pre-ticked boxes and maze-like settings menus. The problem is that consent obtained this way is not valid — so you are non-compliant even though you have a banner. Valid consent must be free, informed, and as easy to refuse as it is to accept.
What are dark patterns in cookie banners?
"Dark patterns" are design choices made deliberately to push you toward the decision that suits the site — usually "Accept all" — and to make refusing harder, slower or less visible. In a cookie banner, they turn a moment that should be a free choice into an obstacle course toward the accept button.
Valid consent under GDPR must be free, specific, informed and unambiguous. Dark patterns attack the first condition directly: if the choice is not genuinely free, the consent is not valid — and invalid consent means you are processing data with no legal basis, even with a banner on screen.
Which patterns do regulators call out?
Not every imperfect banner is a problem, but a few patterns show up consistently in regulators' guidance and decisions. Here are the most common ones and why they break the rule:
| Dark pattern | Why it invalidates consent |
|---|---|
| No "Reject" button on the first layer | EDPB guidance requires rejecting to be as easy as accepting. If "Accept" is one click but rejecting is buried in settings, the choice is not balanced. |
| Color-imbalanced buttons | A large, colorful "Accept" next to a gray, faded "Reject" visually steers the choice — a nudge toward accept. |
| Guilt-tripping copy | Wording like "No, I prefer a worse experience" turns refusing into an embarrassing choice. Consent is no longer free. |
| Pre-ticked boxes | The CJEU held in the Planet49 case (2019) that a pre-ticked box is not valid consent — the visitor must take an active step. |
| Maze-like settings | Dozens of toggles across several screens just to refuse discourage rejection through fatigue. A simple "reject all" is deliberately missing. |
Each row on its own can be enough to turn the consent on your site into a contestable one.
Why are you non-compliant even WITH a banner?
It is a dangerous misconception that "I put up a banner, so I'm covered". The banner is just the interface; what matters legally is whether the choice you obtain is valid. A banner with dark patterns gets clicks on "Accept", but those clicks do not represent free consent — so in the eyes of the law it is as if you obtained no consent at all.
The result is the worst of both worlds: you have the effort and friction of a banner but none of the legal protection. Worse, if the banner also lets trackers fire before the click (a second common defect), you are collecting data on the basis of consent that would not have been valid anyway. Any visitor can file a free complaint with ANSPDCP, and GDPR penalties can reach €20 million or 4% of global turnover — see more in the article on GDPR cookie fines.
What does a correct banner look like, and how do you check it?
The good news is that a compliant banner is actually simpler to build than a manipulative one — you have nothing to hide. A correct first layer has:
- "Accept" and "Reject" with equal visual weight, on the same layer, one click away — see why the reject button matters.
- No pre-ticked boxes and no non-essential categories on by default — everything "off" until the visitor chooses.
- Neutral copy that informs without guilt-tripping, with a link to the cookie policy.
- Real blocking of trackers until consent, not just a message shown over them.
How do you check you don't have a dark pattern without realizing it? Run a free scan — FewCookies scans inspect the banner and automatically flag manipulative patterns, alongside the trackers that fire before consent. It is the fastest way to see whether your banner actually protects you or just looks like it does.
Frequently asked questions
Do the "Accept" and "Reject" buttons have to look the same?
Not identical, but they must have the same visual weight and be equally easy to press. EDPB guidance says refusing must be as simple as accepting. A large, colorful "Accept" next to a gray, small "Reject" or one hidden in settings is a dark pattern that can make consent invalid.
Is a pre-ticked marketing box illegal?
Yes, it is not valid consent. The CJEU held in the Planet49 case (2019) that a pre-ticked box does not amount to active consent — the visitor must take a clear affirmative action to accept. All non-essential categories must start switched off.
How do I know if my banner has dark patterns?
Check three things: there is a "Reject" as visible as "Accept" on the first layer, non-essential categories start switched off, and the copy informs without guilt-tripping. The fastest option is an automatic scan — FewCookies scans inspect the banner and flag manipulative patterns, so you don't rely on a visual check alone.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →