Cookie banners and how to actually say no
Half of consent pop-ups never offer a reject button at all. Here's what the law asks for, what sites do instead, and why hiding a banner isn't the same as rejecting it.
· 7 min read
Everyone hates cookie banners. Almost nobody reads them. Most people click whatever makes the box go away fastest — which is exactly the behaviour the boxes are designed around.
Here is what they are for, what has gone wrong with them, and what saying no properly actually involves.
Why the banners exist
Under EU law — the GDPR together with the ePrivacy Directive — a site needs your permission before storing or reading non-essential information on your device. That covers advertising cookies, analytics cookies, and most of the tracking technology that follows you between sites. It does not cover the strictly necessary things, like remembering you are logged in or what is in your basket. Those need no banner.
The law asks for consent that is freely given, specific, informed, and unambiguous. In interface terms that means roughly three things: nothing is pre-ticked, saying no is as easy as saying yes, and you know what you are agreeing to before you agree to it.
That is the standard. Now the reality.
What the banners actually do
In 2020 researchers scraped the consent pop-ups of the five most popular consent management platforms across the UK's top 10,000 websites — 680 sites in all — and checked them against the minimum requirements of European law.
11.8% met them.
The specifics are worse than the headline:
- 50.1% of the notices had no "reject all" button anywhere in the interface. Not buried, not hidden — simply absent.
- Where a reject option existed, it was one layer deeper than accept in 74.3% of cases.
- An "accept all" button was never buried in a second layer. Not once.
That last detail is the one to hold onto. The asymmetry is not an accident of different teams making different choices. In a large sample, the convenient option was never the one that took an extra click. Somebody decided, consistently, which answer should be easy.
The study also ran a field experiment with real participants and found that these design choices measurably change what people consent to. Removing the opt-out from the first page increased consent. Nudging with pre-selection increased consent. The designs work, which is why they persist.
The tricks, by name
No reject button on the first screen. You get "Accept all" and "Manage preferences". One is a click; the other is a chore. This is obstruction, applied to a legal right.
Pre-ticked boxes. You open the preferences panel and the toggles are already on. Consent that you have to withdraw was never consent you gave.
"Legitimate interest" toggles. A separate set of switches, often on by default, on a separate tab, which some vendors argue don't require consent at all. The practical effect is that turning everything off requires finding a second list of things to turn off.
Sheer volume. "We and our 1,438 partners." Nobody is reviewing 1,438 partners. The number is itself the deterrent.
The visual thumb on the scale. Accept is a solid, coloured, high-contrast button. Reject is grey text that doesn't look clickable. Both technically present. Only one designed to be pressed.
Hiding a banner is not rejecting it
This is the part that surprises people, and it matters more than any of the tricks above.
A lot of popular tools — the cosmetic filter lists in ad blockers, "I don't care about cookies" style extensions — work by hiding the banner element. The box disappears and the page looks clean.
But the banner was only ever the interface. Underneath it sits a consent management platform that records a decision and passes it to advertisers. Hide the box without answering it and, depending on the site, one of two things happens: no consent is recorded and some sites treat continued browsing as implied consent, or the default state — frequently "accept" — stands.
You have removed the question from your screen, not the tracking from your browser. The relief is genuine and the protection is imaginary.
Rejecting properly means interacting with the consent platform the way the law intends: finding the reject control, including the legitimate-interest toggles, and submitting a negative answer that gets recorded. Done by hand, on every site, that is the chore everyone is trying to escape. Done automatically — as tools like Consent-O-Matic have demonstrated, by learning each platform's interface and filling it in correctly — it takes no effort at all.
That is the difference between hiding and rejecting, and it's the one to insist on.
What a fair banner looks like
You are looking at one. If you haven't seen our consent prompt yet, open Privacy settings in the footer of this page and it will come back.
Here is what we committed to, and what you can check:
- Accept and Reject are the same component. Same size, same colour, same font weight, side by side. Not "similar" — literally the same button with different text, so they cannot drift apart as the site changes.
- Nothing is pre-selected. There is no default answer sitting there waiting for you to not notice it.
- Closing the banner counts as rejecting. The × is not "ask me later" and it is not a quiet yes. It is a no, and the button says so.
- It never blocks the page. No overlay, no scroll lock. You can ignore it entirely and read the site, and ignoring it means nothing loads.
- Withdrawing is as easy as consenting. One link in the footer of every page, always there.
- There are no partners. There is one analytics tool, it is named, and it does not run until you say yes.
We are not claiming credit for this. It is roughly what the law asked for in the first place. It is only remarkable because 88.2% of the sites in that study didn't manage it.
What the extension will do
Can I Throw This? will handle consent properly on your behalf: recognising the major consent platforms, submitting a genuine rejection rather than hiding the box, and turning off the legitimate-interest toggles that hide on the second tab.
Where a banner uses one of the tricks above, it will say which one, so the pattern becomes visible instead of just annoying.
And when we ask you a question on our own site, we will ask it the way we just did.