Cookie Dark Patterns: When Consent Is Not Valid

Dark patterns, or deceptive design patterns, are interfaces that push users towards decisions that harm their privacy. In cookie banners, the classic example is a large visible accept button while rejection or configuration is hidden, greyed out or placed behind several steps.

What the AEPD and EDPB say

The AEPD Cookie Guide requires consent to be informed, free and easy to withdraw. The EDPB has also published Guidelines 03/2022 on deceptive design patterns, which are useful for identifying designs that manipulate privacy choices.

Examples of cookie dark patterns

• Overloading: too much information or too many steps to reject.
• Hiding: concealing rejection or configuration options.
• Misleading visual hierarchy: accept is highlighted while reject is barely visible.
• Confusing language: wording designed to obscure consequences.
• Forced consent: blocking access without a valid alternative.

Why consent may be invalid

Consent is not valid if it is obtained through pressure, confusion or an unbalanced interface. Refusing should be as easy as accepting, and users should be able to change their decision later.

Cookie banner checklist

• Are accept and reject options similarly visible?
• Can users reject without going through several screens?
• Is the information specific and understandable?
• Are non-essential cookies blocked before consent?
• Can users withdraw or change consent easily?

Conclusion

Dark patterns are not just a design issue: they can make consent invalid. Websites should review banners, policies and consent tools to ensure a real and balanced choice.

Frequently asked questions

What is a cookie dark pattern?

A design that pushes users to accept, such as a hidden reject button or pre-ticked boxes.

Must rejecting be as easy as accepting?

Yes. The AEPD cookie guide requires rejecting to be as easy as accepting, at the same level.

Can users withdraw consent later?

Yes, at any time and as easily as they gave it.