Reject All Must Be as Easy as Accept: The Equal-Prominence Rule
In January 2022 the French data protection authority fined Google 150 million euro and Facebook 60 million euro. Users could refuse cookies on both sites. Refusing just took more clicks than accepting.
That's worth pausing on. Both companies had refusal mechanisms. Both provided the information. The violation was one of relative effort, and it cost them 210 million euro between them.
Where the rule comes from
There's no standalone provision spelling it out. It falls out of the GDPR's requirement that consent be freely given.
If accepting takes one click and refusing takes four, the design is applying pressure toward one outcome. Regulators treat that pressure as undermining the freedom of the choice, which makes the consent invalid, not just poor practice. And invalid consent means the processing that relied on it had no legal basis at all.
Article 7(3) reinforces the same principle for withdrawal: taking consent back has to be as easy as giving it.
The EDPB's cookie banner taskforce made the practical implication explicit. A refusal option has to be available on the first layer of the banner. If yes is available immediately but no requires opening a settings panel, the banner fails.
What counts as a violation
No reject option on the first layer. "Accept all" plus "Manage preferences" is the classic failing pattern. Preferences is a detour that ends in refusal, not refusal itself.
Unequal click counts. Accept in one action, reject in two or more. This is the Google and Facebook finding.
Visual asymmetry. A saturated, high-contrast accept button beside a low-contrast grey reject link is still a dark pattern when both are present and both are one click, because the design steers. Regulators have been clear that prominence covers colour, size and contrast, not just presence.
Reject styled as secondary text. Accept as a button, reject as a plain text link. Same asymmetry, subtler form.
Confusing or double-negative labels. If a user has to work out what a control does, the choice isn't unambiguous.
Continued processing after refusal. Offering reject for consent purposes while advertising carries on under legitimate interests. Regulators have shut this down for tracking-based advertising.
Nagging. Re-prompting on every page after someone has declined. They can technically refuse each time. In practice it's attrition, and it undermines the freely-given standard.
Enforcement hasn't slowed
The 2022 decisions weren't a one-off. In 2025 the CNIL fined Google 325 million euro over cookie practices alongside advertising inserted between emails.
For a smaller company the headline numbers aren't the point, they just scale with the revenue of the companies involved. The point is that "refusal is harder than acceptance" is trivially observable from outside. A regulator doesn't need to subpoena your systems to establish it. They load your homepage.
The accessibility dimension nobody checks
There's a failure mode here that falls outside most compliance reviews.
A consent banner has to be operable to be a valid consent mechanism. If the reject button can't be reached by keyboard, isn't announced by a screen reader, or fails contrast requirements, then for those users refusal isn't harder. It's impossible.
That's an accessibility failure and a consent-validity failure at the same time. Consent tools are rarely audited for accessibility, and accessibility audits rarely cover the consent widget, because it gets injected at runtime.
Test it directly: tab to the banner without a mouse, confirm you can reach and activate reject, and check the reject control's contrast ratio against its background.
How to test your own banner
- Count the clicks. Accept from a cold load, then reject from a cold load. The numbers should match.
- Screenshot the first layer. Is refusal available without opening anything? If not, that's your finding.
- Compare the two controls for size, contrast and styling. Whichever one your eye lands on first is the one being pushed.
- Tab through with the keyboard only. Can you reach and activate reject?
- Check contrast on the reject control against its background.
- Refuse, then browse. Does the banner come straight back? Does anything still fire?
- Find the withdrawal path. Is taking consent back as easy as giving it was?
Fail steps 1 to 3 and that's the highest-value fix on your site this quarter. It's usually a configuration change, not an engineering project.
Why this one is worth doing first
Cheap to satisfy, expensive to ignore. Rare combination in compliance. Adding a real reject button, styled identically to accept, on the first layer, is typically an afternoon of work in a consent tool you already have.
It's also the first thing a regulator sees, because unlike most of the GDPR it can be assessed from the outside, in seconds, without your cooperation.
For the full set of requirements around valid consent, see our GDPR cookie consent guide, and while you're in there, check whether anything is firing before consent.
This article is general information, not legal advice.
Sources: CNIL: Google and Facebook cookie sanctions · EDPB: Report of the cookie banner taskforce · EDPB: CNIL fines Google 325 million euro (2025)