文章
Does Reject All have to be as easy as Accept?
The CNIL page of 12 December 2024 says rejecting cookies should be as easy as accepting them. Record the controls, then compare cookies and requests.
In brief
The CNIL page dated 12 December 2024 says rejecting cookies should be just as easy as accepting them, and it lists uneven designs such as a faint reject link or Accept shown more than once. Record the controls, then compare cookies and requests after Reject All and Accept All. An even button can still leave pixels running. This page is a reading note plus a browser check. It is not legal advice.
Not legal advice
This article explains a public CNIL page about cookie-banner design, and how to record whether Reject All and Accept All are equally available on a storefront. It is not legal advice. It is not a determination that any banner meets French, EU, or UK law. It is not a substitute for counsel.
Short answer
On 12 December 2024 the CNIL published a page stating that rejecting cookies should be just as easy as accepting them. The same page says the law does not impose one layout, and that a design which misleads the person can affect whether consent is valid. It then lists designs the authority treated as a problem on banners it reviewed: Reject drawn as a link that loses on color, size, or weight; Reject buried in the text; Reject sitting against other paragraphs without enough space; and Accept shown more than once while Reject appears once in vague wording such as declining non-essential purposes.
A technical review can screenshot those controls and count the clicks to each one. It can then compare cookies and requests after Reject All and after Accept All. The screenshot is not a legal conclusion. A button pair that looks even can still leave marketing requests running.
What the CNIL page lists
The notes below follow the 12 December 2024 CNIL page. They are a reading aid for that page, not a restatement of French statute text. The page names Article 82 of the French Data Protection Act as the basis for the orders it describes, and it links the French source. This article does not quote that article.
The same CNIL page points readers to the EDPB Cookie Banner Taskforce report, which it dates to 17 January 2023. The EDPB document page for that report is dated 18 January 2023. Read the PDF on that page for the taskforce text. The examples in the table are the ones the CNIL page itself spells out.
| What the page describes | What to record |
|---|---|
| Reject is a link, and color, size, or weight favors Accept | A screenshot of the first screen, with both labels visible. |
| Reject is embedded in the text and not readily apparent | Where the control sits, and how many clicks it takes to reach it. |
| Reject sits against other paragraphs without enough space | The spacing in the screenshot, not a verbal description alone. |
| Accept appears more than once; Reject appears once in vague wording | The visible label, including wording such as declining non-essential purposes. |
Record the controls, then the network
Equal ease is a fact about the controls. Whether the click changed the browser is a separate fact. Keep them in different rows so a tidy button does not get written up as a quiet network.
The older Reject All test and the still-tracking guide cover the network half. The Shopify Reject All guide is the storefront version of that half, including the limit of the Customer Privacy API: it records a choice and does not by itself stop a theme script. The CMP claims guide is where a sentence on the banner is checked against an isolated visit.
| Row | What you did | What the file contains |
|---|---|---|
| Controls | Screenshot the first screen before any click. | Labels, color, size, click count to Reject, click count to Accept. |
| Reject | Clean profile. Click Reject All. Navigate once. | Cookies, storage, and third-party request URLs. |
| Accept | Another clean profile. Click Accept All. | The same surfaces, used only as the comparison baseline. |
An even button can still track
A first-screen Reject control that matches Accept in size and color can still be followed by the same advertising or analytics hosts as the accept file. That pattern belongs in the evidence pack next to the screenshot, not in a sentence that the banner was enough.
The evidence pack guide lists the fields: URL, time, state name, cookies, requests, and screenshots. Circle hosts that appear in both the reject file and the accept file. That circle is what you send the person who owns the tag.
A California Global Privacy Control pair is a different comparison. The GPC test guide covers Sec-GPC. Do not treat a GPC-off visit as the Reject All file in this check.
What this page will not decide
The CNIL page says it issued orders for the publishers it reviewed to modify their banners within one month. The page does not state a euro amount. A screenshot from your store is a separate record. The page also says the authority looks at banners case by case.
A free US-baseline ConsentProbe visit shows report format on one non-California pass. It is not a French or EU banner conclusion. Paid EU scenarios are the fresh, Reject All, and Accept All comparison. The free versus paid guide says when each one applies.
Store the screenshot with the requests
If you want the banner screenshot and the post-reject requests in one labeled report, run ConsentProbe on the public storefront URL. The report records what the browser did. It does not decide whether the banner meets French or EU law, and it does not replace the CMP that collects the choice.
FAQ
Does Reject All have to be as easy as Accept?
The CNIL page of 12 December 2024 says rejecting cookies should be just as easy as accepting them. This page is not a determination about your banner.
Which designs does that page call out?
A faint reject link, a reject control buried in the text, a reject control without enough space around it, and Accept shown more than once while Reject uses vague wording.
Is matching button color enough?
Color is one fact on the screenshot. Also record size, click count, and the words on the control, then compare the network after each choice.
What if Reject takes more clicks than Accept?
Write the click count on the file. The CNIL page does not give a numeric formula. The count is still part of the record.
Does an even banner mean the pixels stopped?
No. Compare cookies and request URLs after Reject All with the same surfaces after Accept All. See the Reject All guide.
Is this legal advice?
No. It explains a public CNIL page and a way to record the browser. Talk to your own counsel about obligations.
Limits of this page
This article explains a public CNIL page about cookie-banner design and a way to record Reject All next to Accept All. It is not legal advice, not a determination that any banner meets French, EU, or UK law, and not a fine schedule. ConsentProbe findings stay tied to requests, cookies, and screenshots.
Related guides
Use the Reject All guide for the network check, the evidence pack guide for the file list, and the three-state guide when fresh has to sit beside reject and accept.
- Reject All Still Tracking: What to Check After You Say No
- Testing “Reject All” on a Cookie Banner
- How do you test a Shopify cookie banner's Reject All button?
- How do you audit cookies across EU fresh, reject, and accept visits?
- What belongs in a cookie consent audit evidence pack?
- CMP claims vs runtime evidence: how do you prove the banner actually works?
- Pre-consent audit checklist: what to verify before Accept
- What is the difference between a cookie consent audit and a cookie banner?
- What does a free US-baseline cookie audit prove vs paid EU or California scans?
- ConsentProbe methodology
- Pricing and listed regional products
Sources
These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.
保存一次美国基线技术记录
完成自行检查后，可以跑一次免费美国基线审计：在加州以外做一次浏览器访问，把 Cookie、请求和截图存成证据。这次访问不会跑欧盟拒绝/接受，也不会跑加州 GPC。欧盟、加州和 Global 2 可在登录后的账单页购买。