Cookie banners are not designed symmetrically. According to a CHI 2025 study that scraped 169,901 consent interfaces across 254,148 websites in 31 European countries, 88% of banners display an Accept button on the first screen, but only 45% display a Reject button. The data was collected in August and September 2024 by Nouwens, Kristensen, Maalt, and Bagge (Aarhus University) and published at CHI 2025. That single gap between 88% and 45% explains most of what visitors experience when a cookie banner loads.
Warning
This post draws on two studies from the same research group: the CHI 2025 cross-country scrape (254,148 sites, data collected August-September 2024) for prevalence, wording, and country variation, and an earlier CHI 2020 field study and CMP scrape (680 UK sites, 2019 data) for the click-depth and visual-prominence mechanics the newer study did not re-publish at the same granularity. Each figure below is labeled with its source year so the two datasets are never mixed silently.
How many cookie banners actually offer a reject option?
Less than half. Among the 169,901 consent interfaces the CHI 2025 team detected, 88% had an Accept option, 54% offered some way to reach a settings screen, 45% had a Reject option, and only 16% offered purpose-level toggles on the first screen. A pay-to-opt-out button, letting a visitor subscribe instead of consenting, appeared on just 0.24% of interfaces.
Figure 1: What a cookie banner actually gives a visitor to click. Source: Nouwens, Kristensen, Maalt, Bagge, “A Cross-Country Analysis of GDPR Cookie Banners,” CHI 2025, n=169,901 interfaces across 254,148 sites.
| Design element | Present on first screen | Source |
|---|---|---|
| Accept button | 88% | CHI 2025, n=169,901 |
| Settings/second-layer link | 54% | CHI 2025 |
| Reject button | 45% | CHI 2025 |
| Purpose-level toggles | 16% | CHI 2025 |
A settings link beats a reject button in prevalence, which matters because a settings link routes a visitor to a second screen rather than giving them a one-click way out. The study’s own earlier work found that visitors almost never follow that link: only 6.9% of participants in the 2019 field study clicked through to a second or third page at all.
How many clicks does rejecting cookies take compared to accepting?
More than accepting, and often by a wide margin. In the 2019 CMP scrape of 680 UK sites, 50.1% of sites had no reject-all button whatsoever. Of the sites that did have one, only 12.6% placed it on the first page with the same or fewer clicks required as the accept-all button. The rest buried it: 74.3% of reject-all buttons sat one layer deep, requiring two clicks to reach, and 0.9% sat two layers away, requiring at least three clicks.
Figure 2: What actually happens when a visitor looks for granular cookie controls. Source: Nouwens, Kristensen, Maalt, Bagge, CHI 2025, purpose-control figures; click-depth figures from Nouwens, Liccardi, Veale, Karger, Kagal, CHI 2020, n=680.
A banner that requires an extra click and an extra layer to reject is not offering the same choice twice, it is offering one easy path and one deliberately harder one, no matter what the written cookie policy elsewhere on the site says about a visitor’s right to decline.
Does banner wording quietly turn “reject” into “accept”?
Sometimes. Among banners that do offer a reject option, more than a quarter, 27%, label it with ambiguous phrasing like “Accept necessary” rather than a plain reject action, according to the CHI 2025 analysis. A visitor scanning quickly can read “Accept necessary” as a second accept button rather than the only way to decline optional tracking.
Figure 3: How the reject option is actually labeled when a site includes one. Source: Nouwens, Kristensen, Maalt, Bagge, CHI 2025.
Wording choices like this sit outside most automated compliance scrapers, which count whether a reject-shaped element exists rather than what it says, so this specific dark pattern is easy for a site to run without ever being flagged by a scanner.
Do pre-checked boxes still show up in cookie banner design?
Yes, and the 2019 dataset breaks the practice down by scope. When users navigate to a banner’s granular settings, 56.2% of sites pre-ticked at least one optional vendor, purpose, or category, 54.1% pre-ticked optional purposes specifically, 32.3% pre-ticked optional categories, and 30.3% pre-ticked both purposes and categories at once.
| Pre-ticked scope | Share of sites (2019 UK scrape, n=680) |
|---|---|
| Any optional vendor, purpose, or category | 56.2% |
| Optional purposes specifically | 54.1% |
| Optional categories specifically | 32.3% |
| Both purposes and categories | 30.3% |
Source: Nouwens, Liccardi, Veale, Karger, Kagal, “Dark Patterns after the GDPR,” CHI 2020.
Pre-ticked boxes are explicitly named as an invalid form of consent under GDPR recital 32, yet the majority of sites that offer granular controls at all still default at least one of them to on.
How does reject-button visibility vary by country?
Substantially. National norms, not just individual site choices, decide whether a reject button exists. Reject-option prevalence in the CHI 2025 dataset ranged from 72% of interfaces in Denmark down to 20% in Bulgaria and Slovenia, a standard deviation of 12.6 percentage points across the 31 countries studied. Accept-button prevalence barely moved by comparison, ranging only from 94% in Finland and Denmark to 73% in Slovenia, a standard deviation of 4.3 points.
Figure 4: Whether a banner offers a reject button depends heavily on which country’s top sites you scrape. Source: Nouwens, Kristensen, Maalt, Bagge, CHI 2025.
Since the same five or six consent management platforms power most of this market across countries, this gap looks more like a difference in national enforcement pressure and site-owner defaults than a difference in what the underlying software can do.
Has cookie banner design gotten more compliant since GDPR started?
Barely. The same research team’s own minimal-compliance bar, an interface with no pre-ticked optional boxes, a reject option as easy as accept, and access to granular controls, was met by only 11.8% of the UK’s top 10,000 sites when first measured in 2019. Re-measured across 31 countries’ top 10,000 sites in 2024, the figure had crept up to just 15%.
Figure 5: Design research milestones since GDPR enforcement began. Source: Nouwens et al., CHI 2020 and CHI 2025.
Design mechanics, not visitor behavior, explain most of that flat line. Our companion piece on cookie consent accept rates and trends covers what happens to actual consent numbers once a banner ships with these defaults, and our breakdown of cookie consent rates by device covers how the same design choices play out differently on mobile versus desktop. A third open question, how quickly sites are adopting Google’s Consent Mode alongside these banner designs, does not yet have a published dataset we could verify, so we are flagging it here rather than citing a number.
The Bottom Line
A cookie banner’s design decides the outcome long before a visitor reads a word of it. 88% of banners hand a visitor an Accept button, only 45% hand them a Reject button, and among the minority with real granular controls, close to a fifth still pre-check the boxes that are supposed to be optional. National norms vary more on the reject side than the accept side, which points to enforcement pressure rather than technical limitation as the deciding factor. For a site owner, the practical fix is not complicated: put a real reject option on the first screen, label it plainly, and leave every optional box unchecked by default. A cookie policy generator that documents what each button actually does keeps the written policy honest even when the interface itself is still nudging toward acceptance.
Frequently Asked Questions
What percentage of cookie banners actually have a reject button? 45% of the 169,901 consent interfaces detected across 254,148 websites had a reject option on the first screen, compared with 88% that had an accept option, according to a CHI 2025 study by Nouwens, Kristensen, Maalt, and Bagge (data collected August-September 2024).
Do most cookie banners give Accept and Reject equal visual weight? No. Only 12.6% of banners in an earlier 2019 field study (Nouwens et al., CHI 2020, n=680 UK sites) showed Accept and Reject with equal visual prominence, and 50.1% had no reject button at all on the first screen.
How many cookie banners let visitors control cookie categories individually? Just 16% of consent interfaces offer purpose-level toggles or checkboxes on the first screen, and about 17% of those pre-check the optional purposes by default, according to the CHI 2025 cross-country study.
Do reject buttons always say ‘Reject’? Not always. More than a quarter of reject options, 27%, use ambiguous wording like ‘Accept necessary’ instead of a plain reject action, per the same CHI 2025 analysis of European consent interfaces.
Sources and References
- Nouwens, Kristensen, Maalt, and Bagge. (2025). “A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them.” CHI 2025, ACM. Automated analysis of 169,901 consent interfaces across 254,148 websites in 31 countries, data collected August 12 to September 4, 2024.
- Nouwens, Liccardi, Veale, Karger, and Kagal. (2020). “Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence.” CHI 2020, ACM. Scrape of 680 CMP-provided consent interfaces on the UK’s top 10,000 sites, September 2019, plus a 40-participant field experiment.
- General Data Protection Regulation. Recital 32. Defines valid consent as an affirmative act, ruling out pre-ticked boxes as a lawful basis.
Note: All figures verified as of September 2026. The CHI 2025 dataset is the most recent large-scale, independent, peer-reviewed measurement of cookie banner design available; the click-depth and visual-prominence figures are still the 2019 measurement because no larger replication has published matching detail since. This page is refreshed at least twice a year as newer data becomes available.
