Get exclusive insights on privacy laws, compliance strategies, and product updates delivered to your inbox
Cookie Banner Dark Patterns: The New Manipulation Tactics Regulators Are Targeting | Secure Privacy Blog
Cookie Banner Dark Patterns: The New Manipulation Tactics Regulators Are Targeting
France's CNIL fined Google €200 million in September 2025 for a consent design that made cookie rejection harder than acceptance. The same month, SHEIN received €150 million — not for failing to show a banner, but for a banner that accepted a user's "Reject all" click while continuing to place cookies anyway. Sweden's Data Protection Authority fined ATG and Warner Music Sweden for manipulative banner designs. American Express received enforcement action in the UK after cookies continued firing after user withdrawal. These are not edge cases or giant-tech-only problems. Enforcement has shifted from warnings to immediate fines without prior notice. Dark pattern enforcement has become a distinct and growing enforcement category.
Secure Privacy Team
·15 min read
The first generation of dark pattern enforcement was relatively simple: obvious visual asymmetry, pre-ticked boxes, no reject button on the initial screen. Most compliance teams know these failures and have addressed them. The enforcement landscape has moved on.
Regulators are now targeting second-generation dark patterns — manipulation that is subtler, behavioral rather than structural, and designed to survive a superficial compliance review while still systematically steering users away from informed choice. Understanding what these patterns look like, and what regulators are now testing for, is the prerequisite for any organization that wants to get ahead of enforcement rather than respond to it.
TL;DR
First-generation dark patterns — obvious button asymmetry, no reject button — are still common but widely recognized. Regulators are increasingly targeting second-generation patterns: friction engineering, revocation barriers, fake neutrality, and consent confirmation theater.
The Google (€200M) and SHEIN (€150M) fines of September 2025 both target specific second-generation failures: designed rejection difficulty and technical non-enforcement of withdrawal.
GDPR's freely given standard and equal-ease-of-withdrawal requirement are the legal tests against which all dark patterns are measured. CPRA adds explicit dark pattern definitions covering confusing language, manipulative interface design, and obstacles to opt-out.
The emerging enforcement focus for 2026 is technical verification: regulators are no longer accepting visual symmetry as evidence of compliance. They are testing whether rejection and withdrawal actually suppress tracking at the network level.
The Legal Standard That Dark Patterns Violate
Before cataloging the patterns, it is worth being precise about what legal standard they violate — because dark pattern compliance is not a design preference, it is a consent validity question.
GDPR Article 4(11) defines consent as a "freely given, specific, informed and unambiguous indication of the data subject's wishes." GDPR Recital 42 specifies that consent is not freely given when the data subject has no genuine and free choice. Article 7(3) requires that withdrawal of consent be as easy as giving it. The EDPB's Guidelines 05/2020 on consent and the EDPB's Guidelines 3/2022 on deceptive design patterns both translate these requirements into specific design standards: accept and reject options must be presented at the same level of hierarchy with equivalent visual prominence; users must be able to withdraw consent with the same number of steps as required to give it; language must be plain and not designed to confuse or mislead.
CPRA adds explicit dark pattern definitions under Section 1798.140(l): a "dark pattern" is a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice. California's regulations issued under CPRA specifically prohibit using dark patterns to obtain consent or to process requests, and require that consent be obtained through methods that are plain, straightforward, and not confusing.
First-Generation vs Second-Generation Dark Patterns
The Enforcement Methodology Regulators Now Apply
Regulators are no longer satisfied with surface-level compliance. They are increasingly evaluating how consent mechanisms function in practice. The audit methodology used by the CNIL, the ICO, noyb-driven complaint investigations, and multi-DPA coordinated sweeps has a consistent technical component that design-level compliance does not satisfy.
Network traffic analysis at page load before any banner interaction reveals whether tracking scripts are initializing before consent is obtained. A regulator or automated scanning tool visiting a site without interacting with the banner and capturing all network requests in the first 3-5 seconds of page load will identify any tracking calls that occur in that window. If advertising endpoints, analytics collection URLs, or third-party cookie-setting requests appear before the user has made a consent choice, the site has failed the prior consent requirement regardless of what the banner looks like.
Click path analysis measures the number of user interactions required to reject versus to accept. The EDPB's stated standard is that rejection must be achievable through the same number of steps as acceptance. A regulator documenting that acceptance requires 1 click and rejection requires 4 clicks has a quantified dark pattern finding that does not depend on subjective visual assessment.
Withdrawal verification tests whether executing the withdrawal flow — navigating to the preference center, withdrawing consent, and saving — results in tracking suppression at the network level. A site where the same advertising endpoint receives requests both before withdrawal and immediately after withdrawal has a technical enforcement failure that is directly documentable.
Language analysis examines whether the framing of accept and reject options creates systematically unequal psychological salience — particularly whether reject options are described in terms of restriction or loss of functionality rather than as a neutral privacy choice with equivalent dignity to acceptance.
First-generation dark patterns are those that fail obviously against the equal prominence standard. A large green "Accept All" button paired with a small gray text link reading "Manage Preferences." A banner with an "Accept" option on the initial screen and no "Reject All" option at the same level. Pre-ticked checkboxes for non-essential categories. Countdown timers creating urgency pressure. These patterns remain common — if your banner has a bold green "Accept" button and a gray text link for "Reject," you're using the same design pattern regulators are now targeting with nine-figure fines — but compliance teams that have reviewed their banners recently are usually aware of them.
Second-generation dark patterns pass the visual symmetry test while still systematically manipulating the consent decision. They are harder to identify in a surface review because they look balanced. The manipulation is in the interaction design, the language, the information architecture, and the technical behavior rather than in obvious button hierarchy. Regulators have specifically shifted enforcement focus to this category because it represents the adaptation of the industry to first-generation enforcement, and because it is where the majority of real consent manipulation now occurs.
The Seven Second-Generation Dark Patterns Regulators Are Targeting
Revocation barriers are the enforcement category with the most recent and most significant fine exposure. SHEIN's consent banner included a reject option, but new cookies were still placed after the user clicked it. The American Express case revealed that cookies continued to be read after users withdrew their consent. Both cases were treated as substantive consent violations because valid consent under GDPR Article 7 requires that withdrawing consent be as easy as giving it — and that withdrawal actually takes effect. This is the most consequential second-generation pattern because it represents the gap between a technically compliant-looking interface and a non-compliant tracking implementation.
The revocation barrier problem appears in three variants. The first is the withdrawal-doesn't-suppress variant: the user clicks "withdraw consent" or "reject all," the interface confirms the action, and tracking tags continue firing because no technical connection exists between the CMP's consent record and the tag manager's firing rules. The CMP has recorded the withdrawal; the advertising stack has not received the signal. The second variant is excessive click depth: accepting all requires one click from the initial banner; withdrawing requires navigating to a preference center, finding the toggle controls, changing each toggle individually, and clicking save — four or more steps where acceptance required one. The third is the buried preference center: the link to withdraw consent exists somewhere in the privacy policy or the site footer, but there is no easily accessible persistent mechanism on the site itself.
Fake neutrality through language asymmetry presents buttons of identical visual weight but with language that creates unequal psychological salience. "Accept all" paired with "Use necessary only" rather than "Reject all." "Continue with tracking" paired with "Manage settings." The accept option is described as an action that enables positive features; the reject option is described as an action that restricts functionality or requires additional steps. Regulators examining language asymmetry look at whether the framing systematically biases toward acceptance through positive versus restrictive language, regardless of button size.
Consent confirmation theater is the emerging pattern where the banner's visual design and interaction flow appear compliant, but the technical implementation does not enforce the user's choice. Cookies load before the banner resolves. Scripts fire in parallel with banner initialization regardless of consent state. The "prior consent" blocking requirement — the requirement that non-essential cookies not fire before consent is obtained — is violated at the network level even when the banner UI is correctly designed. The most important compliance requirement — and the one 90% get wrong — is that scripts must be blocked before consent, not loaded and then conditionally activated.
Vendor list fatigue exploits the legitimate granularity requirement to produce the opposite of its intent. A banner offering granular control over hundreds of advertising partners — each requiring individual review and individual deselection to reject — makes comprehensive rejection practically impossible for most users. The technical compliance argument is that every vendor's consent state is controllable. The practical effect is that users accept all rather than review 287 individual vendor entries. Regulators assessing this pattern look at the realistic time and effort required to exercise rejection through the provided mechanism.
Progressive disclosure manipulation presents a minimal initial screen with only an "Accept" option visible, then reveals the reject option only after additional interaction. The EDPB and CNIL are both explicit that the reject option must be accessible at the same level as the accept option — meaning on the initial banner screen, without requiring additional navigation. Banners that require clicking "Learn more" or "Manage settings" before the rejection option is visible are placing the reject option at a lower level of access than acceptance.
Misleading toggle states present toggles that appear active when they are actually in an intermediate or undefined state, toggles where the visual "on" position corresponds to consent declined rather than consent given in ways that are counterintuitive to users, or toggles where the relationship between position and consequence is unclear without careful reading of fine print. This pattern is particularly common in custom-built preference centers that did not follow standard toggle UX conventions.
Disappearing rejection confirmation presents the rejection path but immediately re-presents the consent banner on the next page load, or re-presents it after a short time interval, creating the impression that the user's previous rejection was not honored. GDPR's storage limitation principle requires that a user's rejection choice be stored and honored for the same period as an acceptance — creating an asymmetry where acceptance is remembered and rejection is not is itself a dark pattern.
Designing a Compliant Banner: The Equal Choice Architecture
A compliant consent banner satisfies three independent tests simultaneously: visual equality, interaction equality, and technical enforcement equality.
Visual equality means that Accept All and Reject All buttons are presented at the same level of the user interface, with equivalent size, visual weight, color contrast, and prominence. Neither option should be styled to draw more attention than the other. This is the first-generation standard that is now well-established but still widely violated in practice.
Interaction equality means that rejection is achievable in the same number of steps as acceptance from the initial banner screen. If acceptance requires clicking one button, rejection must also require clicking one button — at the same level of the interface, without navigation to a settings panel or preference center. The preference center can provide additional granularity for users who want it, but Reject All must be accessible without requiring that navigation.
The preference center must be accessible at all times — not only during the initial banner interaction. A persistent "Manage Cookie Preferences" link in the site footer, or a floating consent preferences icon, satisfies the accessibility requirement for ongoing withdrawal. The withdrawal interaction within the preference center must execute in the same number of steps as acceptance through the banner.
Language must describe accept and reject options with equivalent neutrality. Both options should describe what will happen, not imply that one is the normal or expected choice and the other is a restriction. "Allow all cookies" and "Decline all cookies" are neutral. "Continue with full features" and "Proceed with limited experience" are not — the latter implies loss of functionality that the rejection option does not actually cause for the core service.
Auditing Your Banner for Dark Patterns
A banner audit that tests only visual appearance will miss the second-generation patterns that are now the primary enforcement target. A complete audit covers four dimensions.
Visual hierarchy audit reviews button size, color, placement, and visual weight for accept and reject options on the initial banner screen. Both options should be visible on the initial screen. Neither should dominate the other through size, color, or contrast differential.
Interaction path audit documents the number of clicks required from initial banner presentation to accept versus reject, including any navigation required and any additional confirmation steps. The paths should be equal length. If rejection requires a separate navigation to a settings panel, the banner design does not satisfy the equal prominence standard for the rejection path.
Network behavior audit uses browser developer tools to capture all HTTP requests from page load through banner interaction. Check requests generated before any banner interaction — these should not include advertising or analytics tracking endpoints. Check requests generated immediately after rejection — these should show cessation of advertising calls. Check requests generated after withdrawal through the preference center — same standard applies. This is the test that determines actual technical compliance.
Re-presentation audit tests whether rejection is remembered across page loads and subsequent visits. Navigate to the site, reject all, navigate to a second page, close the browser, return the next day. The banner should not re-appear with the same choices if a rejection was previously recorded within the applicable storage period. If the banner re-presents on every page or every visit, the rejection is not being honored as a persistent choice.
Common Mistakes That Create Enforcement Exposure
Assuming that visual symmetry equals compliance is the most common and most consequential error. Equal button sizes with unequal technical enforcement produces a visually compliant and technically non-compliant implementation. The SHEIN fine demonstrates that this combination is a priority enforcement target, not a safe position.
Burying the preference center link in the privacy policy rather than maintaining it as a persistent accessible mechanism creates a withdrawal barrier even when the banner itself is correctly designed. The ongoing accessibility of the withdrawal mechanism is a separate requirement from the initial banner design.
Implementing consent as a UI function rather than as a technical gating control produces the "decorative banner" failure pattern. A banner that records user choices without those choices controlling whether tracking scripts load is not a consent management implementation — it is a user interface above an unconditional tracking implementation.
Using language that frames the reject option as a restriction rather than as a neutral privacy choice imports a psychological asymmetry that visual equality does not resolve. Equal buttons with unequal framing still fail the freely given standard if one option is systematically presented as the "normal" path and the other as a deviation from normal.
FAQ
What are cookie banner dark patterns?
Interface design choices that manipulate users toward accepting tracking while making rejection harder, slower, less visible, or less effective. They include obvious visual asymmetry and second-generation patterns like revocation barriers, fake neutrality, and technical non-enforcement of withdrawal.
Is hiding the reject button illegal under GDPR?
Yes. The reject option must be presented at the same level and with equivalent prominence to the accept option. Requiring users to navigate to a settings screen to find the reject option while accept is available on the initial screen violates the freely given standard.
What are fake opt-outs?
Banner interactions that appear to record a user's rejection or withdrawal choice but do not technically suppress tracking. The SHEIN and American Express enforcement cases both involve this pattern — the banner accepted the user's choice while the tracking stack continued operating.
How easy must consent withdrawal be?
GDPR Article 7(3) requires that withdrawal be as easy as giving consent. The EDPB's guidelines specify equal number of steps. If acceptance requires one click, withdrawal must be achievable with one click from an equally accessible location.
What dark patterns are regulators targeting now?
The 2025-2026 enforcement focus has shifted to: technical non-enforcement of withdrawal, click-depth asymmetry between accept and reject paths, consent confirmation theater where the banner appears compliant while tracking loads unconditionally, vendor list fatigue, and language framing that presents rejection as restriction rather than neutral choice.
The enforcement message from 2025 and into 2026 is consistent: compliance is measured by technical behavior, not banner appearance. A €200 million fine against Google and a €150 million fine against SHEIN were not issued because regulators found design flaws in privacy policy documents. They were issued because network traffic analysis and interaction testing revealed gaps between what the consent interface promised and what the tracking stack actually did. The organizations that will avoid enforcement are those that test their banners the way regulators do — starting with a network analyzer, not a screenshot.
Prioritizing user privacy is essential. Secure Privacy's free Privacy by Design Checklist helps you integrate privacy considerations into your development and data management processes.
Prioritizing user privacy is essential. Secure Privacy's free Privacy by Design Checklist helps you integrate privacy considerations into your development and data management processes.
