Cookie Banner Dark Patterns: The Fines That Say What Not to Build
Open your site with the network panel running and watch what loads before the cookie banner appears. On a surprising number of sites, the answer is: the analytics tag, the ad tag, and two or three marketing pixels, all firing while the banner is still rendering. The consent script is sitting at the bottom of the page, loading last, and by the time it sets the defaults the tags have already taken what they wanted.
This is not a banner design problem. It is a load order problem, and it is the single most common consent failure on small sites. The fix costs nothing and takes ten minutes, but only if you understand what the order is supposed to be.
A dark pattern in a consent banner is any design that makes refusing harder than accepting: a hidden reject option, pre-ticked boxes, unequal button weight, or guilt-tripping copy. The CNIL fined Google 150 million euros in 2022 because rejecting took several clicks while accepting took one, then fined Google 325 million euros and Shein 150 million euros in September 2025 for further cookie failures.
The rule is one sentence long
Refusing has to be as easy as accepting. That is the whole rule, and every fine in this area is a different way of breaking it. The EDPB Guidelines 03/2022 on deceptive design patterns catalogue the failures: unequal prominence, where accept is a big coloured button and reject is a small grey link; hidden reject, where refusal lives on a second layer behind settings; pre-selection, where boxes arrive ticked; and hierarchy manipulation, where the design steers the eye toward accept and away from everything else.
The legal hook is GDPR Article 4(11): consent has to be freely given, specific, informed and unambiguous. A choice made under a design that steers the visitor is not freely given, so the consent is invalid and everything collected under it is unlawful. Article 7(3) adds that withdrawing consent has to be as easy as giving it. A banner that is easy to accept and hard to undo fails twice.
The fines, in order
The CNIL set the pattern in December 2021, fining Google 150 million euros and Facebook 60 million euros because accepting took one click and rejecting took several. Google got another 150 million euro fine in 2022 for the same asymmetry on google.fr and YouTube, with three months to comply and a penalty of 100,000 euros per day of delay. Microsoft took a 60 million euro fine in 2023 for advertising cookies placed without consent and no straightforward refusal.
September 2025 raised the stakes. The CNIL fined Google 325 million euros, citing ads shown between emails in Gmail without consent and invalid consent to advertising cookies when people created a Google account. Shein was fined 150 million euros the same month because advertising cookies were placed the moment visitors arrived, before any interaction with the banner at all. A NOYB survey from 2021 found 81 percent of banners had no reject button on the first layer and 73 percent used deceptive colours. The fines are the enforcement catching up with what the surveys already showed.
Auditing your own banner in ten minutes
Open your site in a private window and count the clicks. Accept all should take one. Reject all should take one, on the same layer, with the same size, padding and font weight. If reject is a text link under a coloured button, that is unequal prominence and it is the single most fined design in this whole area. If the settings panel opens with boxes already ticked, that is pre-selection, and the Court of Justice settled it in the Planet49 case in October 2019: pre-ticked consent is not consent.
Then check what happens after reject. Click it, then watch the network panel. If tracking requests still fire or cookies are still set, the reject path is decorative, and half the sites in one 2026 scan failed exactly this check. A reject that does not stop the tracking is worse than no reject at all, because the record says the visitor refused while the data kept flowing.
Keep reading: The Consent Banner After the EAA: What June 28 Changed for CMPs, Your CMP Script Belongs in the Head, Not at the Bottom of the Page, and White Label Cookie Consent: What It Is and How to Choose a Platform cover the nearby cases in this series.
Frequently asked questions
What is a cookie banner dark pattern?
A design that steers visitors toward accepting: a reject option that is smaller, hidden, or takes more clicks than accept, pre-ticked boxes, or wording that guilts the visitor. Regulators treat the resulting consent as invalid.
Does the reject button have to be on the first layer?
Yes, in practice. The CNIL fines all turn on the same point: refusing has to take no more effort than accepting. A reject option buried in settings takes more effort by definition.
Are pre-ticked consent boxes illegal?
Yes. The Court of Justice ruled in Planet49 in October 2019 that consent requires an active act, and a pre-ticked box is not one. Every box in a consent panel has to start unticked.
Do these fines only hit big companies?
No. The same standard applies to a small business site as to Google. The big fines make the news, but the rule is the same, and smaller companies are easier targets because their banners are rarely audited.