You open a news site. Before you can read the headline, a banner occupies half your screen. There’s a large green “Accept All” button. There’s a grey “Manage Preferences” link in smaller text. You click “Manage Preferences.” You’re now looking at 12 categories, each with 847 individual toggles across multiple nested panels, all pre-enabled. The “Save preferences” button is hidden at the bottom. You give up and hit “Accept All.”
That experience was not accidental. It was designed. And in the EU, most of it is illegal.
The short answer: Under GDPR, valid cookie consent must be freely given, specific, informed, and unambiguous, and rejecting must be as easy as accepting. So the common tricks break the law: no “Reject All” button on the first layer, a prominent “Accept” beside a buried “Reject,” cookie walls, and pre-ticked boxes. France’s CNIL fined Google €150m and Meta €60m over exactly this. You do not have to fight each banner by hand: browser tools like uBlock Origin, Consent-o-Matic, and Brave block most tracking regardless of what you click.
Why do cookie banners make you angry?
The banner you just navigated was engineered to produce one outcome: your consent to maximum tracking. Every design choice — button color, button size, text size, menu depth, toggle defaults — was selected to reduce the number of people who successfully reject cookies.
This is called a dark pattern: a user interface designed to manipulate rather than inform. In the context of cookie consent, dark patterns have been ruled illegal by European data protection authorities repeatedly since 2022. The rulings are specific. The fines are real. And yet the banners persist — because even with enforcement, the financial upside of tracking consent outweighs the risk for most large platforms.
The gap between what GDPR requires and what most banners deliver is not ambiguous. It’s documented, ruled on, and still ignored at scale.
What GDPR actually requires for cookie consent
The specific obligation to obtain consent for non-essential cookies comes from the ePrivacy Directive (2002/58/EC), which each EU member state has implemented into national law. GDPR then governs what “valid consent” looks like — it must be freely given, specific, informed, and unambiguous.
Under GDPR Article 7 and Recital 32, consent must meet four requirements to be valid:
Freely given — you cannot be coerced into consenting. Denying access to a service unless you accept cookies is coercion, not consent. Specific — blanket “accept all” consent covering every tracker from every third party does not meet this standard. Informed — you must actually know what you’re agreeing to. A list of 847 toggles you can’t read in a banner context does not constitute informed consent. Unambiguous — consent must be indicated by a clear affirmative act. Pre-ticked boxes are explicitly illegal; they’ve been banned since GDPR came into force in 2018.
There’s also a fifth requirement that often gets missed: withdrawal must be as easy as giving consent. If “Accept All” is one click, “Reject All” must also be one click. If there’s a large green button to accept, there must be an equivalent button to reject — at the same layer, with comparable prominence.
The specific dark patterns that violate GDPR
Regulators have moved beyond general principles to specific rulings on specific practices.
No “Reject All” button at the first layer. In January 2022, France’s CNIL ruled that Google’s and Facebook’s cookie consent interfaces violated GDPR. The reason: they made rejecting cookies significantly harder than accepting them. Google received a €150 million fine. Facebook (Meta) received €60 million. The ruling specified that a “Reject All” button must be present at the first layer — the banner itself — not buried inside settings menus.
Making “Accept” visually prominent and “Reject” visually subordinate. The CNIL fines were partly based on the color and prominence disparity: a colored button for acceptance, grey text for rejection. This asymmetry — even if a rejection path technically exists — violates the “freely given” requirement because it steers users toward one outcome.
Cookie walls. A cookie wall blocks access to content unless you accept tracking cookies. In 2022, CNIL ruled these illegal. The logic: if your only options are “accept all cookies” or “leave the site,” consent is not freely given. It’s a toll. You’re not choosing between options; you’re choosing between your data and the content. That’s coercion under GDPR.
Pre-ticked boxes. This one has been illegal since day one. A checkbox pre-selected to indicate consent — where you must actively untick it to withhold consent — does not constitute a “clear affirmative act.” It never did. It still happens constantly.
Legitimate interest for advertising. Many banners include a “legitimate interest” toggle — categories of tracking that are presented as not requiring your consent. The UK ICO and multiple EU DPAs have repeatedly ruled that advertising and behavioral tracking cannot be justified as a legitimate interest that overrides your right to privacy. If you see “legitimate interest” applied to ad tracking, that claim is generally not compliant.
The IAB Framework and why it’s broken
Most of the cookie consent infrastructure on the western internet runs on a system called the Transparency & Consent Framework (TCF), developed by IAB Europe. This is the technical backbone behind the vast majority of cookie banners — the system that records your consent choices and transmits them to advertisers.
In February 2022, the Belgian Data Protection Authority (APD) ruled that the TCF itself violates GDPR. Not a specific implementation — the framework. The APD found that IAB Europe’s role in the TCF made it a data controller under GDPR. It also found that the consent signals the TCF generates do not meet GDPR’s standards for valid consent.
IAB Europe appealed, modified the framework, and has continued operating. The case went to the Belgian Market Court, which confirmed the APD’s findings in 2023 while giving IAB Europe time to remediate. The remediation process is ongoing. What this means in practice: the banner you saw today was almost certainly built on a contested system that a national regulator ruled illegal, and it’s still running.
This is not a technicality. If the framework generating consent signals is itself non-compliant, then the “consent” it records is questionable. That means every ad served on the basis of that consent is operating on shaky legal ground.
What to do when you see a non-compliant banner
You have practical options that don’t require filing a legal complaint.
If a banner has no “Reject All” button at the first layer, look for an “X” to close it. Closing the banner without accepting is not consent — it’s the absence of consent, which is the legally correct outcome. If there’s no X, navigate away. You don’t owe a website your tracking consent in exchange for reading it.
If you want to stay on the site but reject tracking: open “Manage Preferences,” disable everything you can, and save. It takes longer, but it’s your legal right to do it.
Report non-compliant banners to your national DPA. CNIL’s complaint form (cnil.fr/plainte) accepts reports on cookie banner violations. The ICO has a “Report a concern” tool at ico.org.uk. The German BfDI and state-level DPAs accept complaints at their respective portals. These reports do lead to investigations — the Google and Meta fines came from exactly this kind of complaint process.
The right browsers and extensions
You don’t have to fight each banner manually. Browser-level tools block most tracking regardless of what you click.
Firefox with uBlock Origin is the most effective general setup. uBlock Origin blocks known tracker URLs before they load — meaning even if you accidentally click “Accept All,” many of the trackers being accepted are blocked at the network level. The extension is free, open source, and actively maintained.
Consent-o-Matic is a browser extension that recognizes common consent management platforms (CMPs) and automatically selects the most privacy-protective option. It’s built by researchers at Aarhus University and identifies dark patterns automatically. Install it, and many of those 847-toggle banners resolve in your favor without you touching them.
Brave Browser blocks most trackers and ads by default — no extensions required. Its “Shields” system operates at the browser level and applies to all sites. It’s built on Chromium, so most Chrome extensions work.
The uncomfortable reality is that even with all of these tools running, some tracking slips through. GDPR and the enforcement actions are necessary — but they’re slow. Browser-level blocking is fast, reliable, and applies now.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.