Next time a cookie banner pops up, look closely at the two buttons. Accept All is usually a solid color, sized like a real button, sitting right where your eye lands first. Reject, if it's there at all, is often a thin gray link, smaller text, tucked into a corner, sometimes worded as "Manage preferences" instead of anything resembling "no."
This is a dark pattern: an interface deliberately built to nudge you toward the choice the site wants, rather than the one you'd actually pick if both options got equal treatment.
The trick with the extra step
The most common version: Accept All is one click. Reject requires a second click through to a "settings" or "preferences" screen, then scrolling through a list of forty vendors, then finding the one toggle or button that actually says no to everything. A privacy research group called NOYB reported in 2024 that only about 2% of people ever click through to that second screen. The other 98% just hit Accept, most of them didn't want to, the site just made "no" cost three clicks and "yes" cost zero.
Why regulators actually care about this
This isn't just an annoyance, it's specifically illegal in a lot of places. GDPR requires that consent be freely given, and European regulators have started treating "reject is harder than accept" as a violation of that requirement, not a gray area. France's CNIL fined Google and Facebook back in 2022 over exactly this, and it hasn't gotten better since: CNIL hit Google with a 325 million euro fine in September 2025 for the same asymmetric-consent problem, and across 2025 alone it issued dozens of sanctions totaling close to half a billion euros for cookie and tracker violations. Three years and one court order later, the fines are bigger, not smaller. The legal standard regulators are pushing for has a name: symmetry of choice, meaning reject has to be just as easy, in the same number of clicks, as accept.
Other versions of the same trick
The hidden button behind an extra click is the most common pattern, but it's not the only one. Once you know to look, you'll start noticing:
- Pre-ticked boxes. Some banners "let" you customize preferences, but every optional tracking category is already switched on before you've touched anything, so scrolling past without checking counts as consent.
- Color and contrast tricks. Accept All in a bold brand color, Reject in the same gray as the background text, so your eye genuinely has to work to find it, not because it's hidden, just because it's designed to blend in.
- The banner comes back anyway. You reject, close the tab, come back tomorrow, and there it is again, sometimes because the site didn't actually save your choice, sometimes because it's hoping you'll pick differently the second time.
None of these are accidents either. They're the same underlying tactic, make the choice you don't want the path of least resistance, applied to a different part of the interface.
How to actually find it, when it's buried
- Look for wording other than "Reject." Sites that want to bury it use softer, vaguer labels: "Manage options," "Customize," "More choices." That's usually where reject is hiding.
- If there's a settings screen, look for a single toggle at the top that turns everything off at once, most consent platforms include one, they just don't make it look like a button.
- If you genuinely can't find it within a reasonable amount of clicking, that's the dark pattern working as intended, and it's a reasonable moment to just close the tab.
- Or skip the hunt entirely. This is exactly the repetitive, multi-click problem that extensions like Consent-O-Matic, Ghostery, or GetPawsOff exist to automate, they're built to dig through the buried settings screen and click the real reject option, every time, so you don't have to go looking for it.
Placing the reject button next to Accept is trivial, any site could do it in five minutes. They don't, because hiding it works on most people, most of the time. Knowing that is most of the fix. Automating around it is the rest.