34

Proposal

The cookie banner should have a "refuse all" or, to be more accurate, "accept only essential cookies" or "refuse non-essential cookies" or "[insert a label here]" button.

Why

It has an "accept all" button. It is only sensible to have its opposite button.

Although the same can be achieved by going through "customize settings", it takes extra clicks and time to reject all cookies, so that not having that button is (intentionally or not) a dark pattern that induces visitors to click the button which will most swiftly dismiss the annoying banner.

Additionally, it will be a large step to solve this accessibility problem, which currently is .

Example

Cookie banner with reject button

Made with GIMP.

21
  • 3
    There's a baseline of cookies that are enabled regardless of your choice that allow the site to function. "Reject All" doesn't convey that.
    – Kevin B
    Jul 12 at 14:28
  • 9
    I would be happy if the “customize” button didn’t select them all by default. Every time I have to deal with that gigantic dialog (which is far more often than I should have to) strong-arming me it to accepting cookies, I get pissed off. I don’t know why I bother, because I’m going to block those cookies myself in my browser, but it would be nice if a company would stop trying to track me after I’ve told them repeatedly I don’t want them to.
    – ColleenV
    Jul 12 at 16:11
  • 2
    "Reject Optional Cookies" would probably fit the button.
    – BSMP
    Jul 12 at 17:32
  • 2
    I've also seen sites do what ColleenV suggests: unchecking all but the necessary cookies if you chose to customize which cookies you allow. I would also be OK with this, even though a "Reject Optional Cookies" button would be slightly faster.
    – BSMP
    Jul 12 at 17:36
  • 3
    I'm pretty sure that the "Reject All" options on the cookies is mandatory for European visitors, per European law. The rule is basically that rejecting cookies should be as easy as accepting them. I don't have time to find good English references for that, but for anyone who reads French, see cnil.fr/fr/… (CNIL is the French authority that regulates that kind of thing, but I'm pretty sure this is a European law and not just a French one).
    – Dada
    Jul 13 at 10:16
  • 4
    @Dada yes, GDPR mandates the action to be opt-in, not opt-out (although it does not mandate that there should be an explicit button). And the funny thing about all this is that the toggles for all cookies except necessary are supposed to be switched off according to the configuration. That does not mean, of course, that "accept all" being the default button is not a dark practice, though. +1 to the request Jul 13 at 10:25
  • 2
    @Dada Expanding on Oleg's, GDPR says withdrawing consent should be as easy as giving it. It does not prohibit the consent banner from being much more annoying to dismiss with a rejection of the cookies than with an acceptance of all of them. Probably a site can even block all content while the user does not decide about his consent. Still, I guess such practices are not what one would expect from a mindful site which does not treat its user-base as cash cows.
    – Quasímodo
    Jul 13 at 12:37
  • 4
    "It does not prohibit the consent banner from being much more annoying to dismiss with a rejection of the cookies than with an acceptance of all of them" --> well it does, since rejecting should be as easy as accepting. If the banner is much more annoying to dismiss with a rejection than with an acceptance, then it's not as easy... (for anyone wondering, it's in the article 7 paragraph 3 of GDPR).
    – Dada
    Jul 13 at 13:11
  • @Dada I'd very much like it was so, but it isn't. Quoting that article: "It shall be as easy to withdraw as to give consent." The keyword is withdraw. You can't withdraw a consent you have not given. Withdrawing is different from rejecting. If your interpretation were correct, Stack Inc. lawyers would certain not miss it.
    – Quasímodo
    Jul 13 at 13:49
  • You might be right (that sounds like a somewhat valid interpretation indeed), I'm not a lawyer. However, almost all websites I visit have a clear "reject cookies" button, even garbage websites (eg, websites with ads everywhere etc). Maybe the people running those websites are just erring on the cautious side of the law, and SE's lawyers did their research and found this somewhat loophole, which I would find very disturbing (I don't think that's a valid loophole though, or at least not as currently implemented: giving consent is still easier than withdrawing since I can't see where to withdraw)
    – Dada
    Jul 13 at 14:07
  • 1
    Ultimately it's a choice between treating your users with respect or being an asshat. Lawyers looking for loopholes takes the second choice and turns it up to 11.
    – Dan Mašek
    Jul 13 at 15:55
  • 1
    I think It’s been fixed. Customize correctly lets you opt-in instead of forcing you to opt-out.
    – ColleenV
    Jul 13 at 16:34
  • @ColleenV Nope that's not enough for GDPR. If there is an "accept all cookies" button, there has to be a "reject all cookies" button. Nothing less.
    – Dada
    Jul 16 at 10:23
  • 1
    @Dada For me, one button click versus two button clicks is within the rounding error of "easy" because I use a mouse or poke at a screen with my finger. It may not be for someone who is relying on tools to make browsing more accessible, like screen readers or keyboard shortcuts, so I can see the argument, even though for me it's fixed.
    – ColleenV
    Jul 16 at 15:50
  • 1
    @ColleenV from the CNIL document that I linked earlier, the idea is that if there is a button "accept all" but no "reject all", then people will be biased towards accepting (since it's easier, it allows you to be done with it a move on to the site's content), and that's exactly what GDPR tries to prevent (among other things of course).
    – Dada
    Jul 16 at 15:53
12
+50

I would rather see something like this banner:

screenshot of a cookie consent banner with "cookie settings" link, then a "Reject All" and "Accept All" button

We don't need "cookies" in the button text. There is a bunch of text already explaining that this is about consenting to cookies. I think "Cookie Settings" is better than "Customize Settings" though, because what I was hoping to see in there was a "never show me this dialog again" setting and was disappointed.

I think for locales which read left to right, the order of "explanatory text", "customize", "reject", then "accept" in a wide banner helps offset the bias toward just clicking the first button.

Unless of course the goal is just to get people to accept cookies instead of giving real consent. Then by all means put a large irrelevant picture, some legal text with most of the information hidden behind a link, then giant "accept" button, then a "customize" button, leave off the reject button and make sure that the dialog obscures a good portion of the content on the page without covering up so much that it's clearly a modal dialog.

0
3

"Reject all cookies" means rejecting all cookies, including the strictly necessary cookies. The only thing that button will do is close the website from your browser tab because you disagree with all cookies.

An "accept only essential cookies" or "refuse non-essential cookies" button is the feature to be requested, because it is the equivalent of pressing "customize settings", then inconveniently waiting for cookies settings to be shown, and pressing "confirm my choices".

However, adding a button that allow people to accept only strictly necessary cookies with one click is bad for advertising. I personally do not think Stack Exchange will add the button unless there is enough pressure from the community to add it.

New contributor
i'm ashamed with what i asked is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • 1
    I see no need to dwell on the fact that "reject all cookies" is inaccurate, because I disclaim that in the first paragraph. But good answer. Yes, "reject all unessential cookies" is bad for revenue and they won't change it without huge community pressure. At the end of the day it's their server, their rules, and as a user here says, resistance is futile. We need to move on to a better Stack Exchange alternative.
    – Quasímodo
    9 hours ago

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .