Introduction
Fix a missing Reject all button flagged by GDPR scanners. Add a first-layer Reject button with equal visual weight to Accept all.
What it means
The consent banner does not present a clearly visible Reject all button on the first layer. Accept all is prominent but rejecting requires navigating through a settings panel or is entirely absent.
European regulators (CNIL, ICO, EDPB) explicitly require that declining consent be as easy as giving it. A banner without first-layer Reject fails this requirement.
Why it matters
Regulators and compliance scanners treat this issue as a technical indicator that consent processes may not match stated policies. It is one of the most common findings in automated GDPR audits across all website categories.
Fixing this issue typically produces the largest single improvement in compliance scores, because it addresses the most heavily weighted scanning criteria.
Common mistakes
- Assuming the banner UI alone is sufficient — scanner findings are based on network and script behavior, not visual inspection.
- Testing only with an already-consented browser session, which hides the pre-consent behavior.
- Fixing the homepage but not campaign landing pages, subdomains, or localized variants.
Practical checklist
- Add a Reject all button to the first layer of your consent banner, next to Accept all.
- Ensure Reject has the same visual weight: same size, font weight, color contrast, and tap target as Accept.
- Wire the Reject button to set all non-essential categories to denied, update Consent Mode signals, and persist the rejection state.
- Test Reject in a private window — navigate to two internal pages and confirm zero tracking requests on subsequent pages.
- Run a compliance scan after fixes to confirm the issue is resolved.
- Document the fix date and rescan result for audit evidence.
How GDPRChecker helps
GDPRChecker flags missing or hidden Reject button as a high-severity finding in scan reports. The scanner loads your page as a first-time EU visitor and reports the specific network request, script source, or missing element that triggered the finding.
After implementing the fix, rescan your site with GDPRChecker to confirm the finding is cleared and your compliance score improves.