Accept All and Reject All: Parity Is Not Optional Anymore

In January 2022 the CNIL fined Google 150 million euros and Facebook 60 million euros over cookie banners that made refusing harder than accepting. On google.fr, youtube.com, and facebook.com, one click accepted cookies and several clicks refused them. The CNIL ordered both companies to give French users a means of refusing as simple as the means of accepting, within three months, or face 100,000 euros per day of delay.

The fines turned parity from best practice into the test. Before them, a banner with a hidden refuse path was a design choice a lawyer could argue about. After them, it is a documented violation with a number attached, and the number is large enough that no compliance team can call it a detail. The legal basis, Article 82 of the French Data Protection Act, has been there since the ePrivacy Directive. The fines are what made people read it.

The fines that set the test

Parity means the same path, not a path that exists somewhere. The refuse button sits next to the accept button, on the first layer, in the same size, with the same colour weight, reachable in the same number of clicks. A refuse option buried in a settings menu is not parity, even if a determined user can find it. The test is what an ordinary visitor can do in the same effort, not what a determined one can do with patience.

The EDPB's Guidelines 03/2022 on dark patterns say the same thing in regulatory language: design that steers the user toward one choice undermines the freedom of consent. A banner that passes the parity test does not need the guidelines quoted at it. A banner that fails the test cannot be saved by quoting them either.

Parity means the same path

Two equal buttons on the first layer: Accept all, Reject all. Same size, same weight, same screen. Granular controls sit behind a settings link, for the visitor who wants them, and they do not stand between the visitor and the refusal. No colour tricks: a bright green accept button next to a grey ghost of a reject button is a nudge, and the regulator will read it as one.

Check the wording too. A reject button labelled Accept cookies, which is what Google's second window did, is not a reject button. The label has to say what it does, in the language the visitor reads. A visitor who has to guess whether a button accepts or refuses has already been nudged.

The design that passes

Count the clicks on both paths, screenshot both paths, and check the mobile banner separately. Mobile is where parity fails most often, because the refuse path gets buried behind a scroll or a collapsed section that the desktop banner never had. A banner that passes on desktop and fails on a phone is a banner that fails, because the regulator will test the phone first.

Keep reading: After Withdrawal, When May the Banner Ask Again?, Consent Opt-In Rates: What a Good Number Looks Like, and What It Hides.

Audit it like a regulator

Run the audit quarterly, not once, because banners change. A redesign, a new consent platform, a vendor update: any of them can break parity without anyone noticing. The audit takes ten minutes, and the fine for skipping it is 150 million euros. That is the whole argument.

Frequently asked questions

Do I need a Reject all button on my cookie banner?

Yes, in the EU. Refusing must be as easy as accepting, and the CNIL has fined sites that hid the refusal behind extra clicks.

How much did the CNIL fine Google over cookie banners?

Google was fined 150 million euros in January 2022, and Facebook 60 million euros, for making refusal harder than acceptance.

Can the reject button be smaller than the accept button?

No, not if the difference steers the choice. Regulators read prominence as nudging, and the EDPB's dark-patterns guidelines say so.

Does parity apply to mobile banners too?

Yes, and mobile is where parity fails most often, because the refuse path gets buried behind a scroll or a collapsed section.