The Reject Button Test: Is Your Decline Option as Easy as Accept?

The reject button test is simple: rejecting cookies must take the same number of clicks, the same visibility, and the same effort as accepting them. Most banners fail it, usually by hiding the decline option behind a settings link. Here is how to test yours and fix what you find.

How to run the test

Open your site in a clean browser session and look at the banner the way a first-time visitor does. Count the clicks to accept: usually one. Now count the clicks to reject everything. If the answer is more than one, or if rejecting requires opening a preferences panel, reading toggles, and saving, you have failed the test. Regulators apply exactly this comparison, and they have fined companies for exactly this asymmetry.

Check visibility next. Are accept and reject presented with equal prominence: same size, same color weight, same position in the reading order? A bright accept button next to a gray text link that says 'manage preferences' is not a choice. It is a nudge wearing a choice's clothes. Screenshot both states, because you will want the before-and-after record when you fix it.

The common failures

The most common failure is the missing reject: no decline option on the first layer at all, only an accept button and a settings link. The second is the maze: reject exists but requires navigating a preferences panel with individual toggles, which most visitors will not do and regulators know they will not do. The third is the styling gap: reject exists on the first layer but is visually demoted until it reads as a footnote.

Then there are the subtle ones. Pre-ticked boxes in the preferences panel. A reject button that only rejects marketing cookies while analytics stay on. A banner that reappears after rejection, asking again next visit. Each of these has been the basis of enforcement action somewhere. The test is not just about the button. It is about whether the decline path is genuine end to end.

The fixes

The fix is structural, not cosmetic: put accept and reject side by side on the first layer, styled with equal weight, each completing in one click. No settings panel required for either choice. The preferences panel can still exist for granular control, but it must be optional, not the only path to declining.

Then verify the plumbing. Clicking reject must actually block the non-essential cookies and scripts, not just record a preference nobody reads. Test this with a clean session and a network inspector: reject, then confirm nothing fired. A beautiful reject button connected to nothing is worse than no button, because it creates a false record of compliance.

Documenting the result

Keep a dated record: screenshots of the banner, the click counts for each path, and the network verification showing what loads after reject. Store it with your other compliance documentation, not in a marketing folder. When a regulator asks about a banner that ran in March, the log is your answer, and memory is not evidence.

Re-test on a schedule, because banners regress. Plugin updates restyle buttons, new templates get deployed without the symmetry, and marketing asks for the accept button to be 'more prominent.' Every change to the banner should re-trigger the test. Symmetry is a property you maintain, not a box you check once.