Introduction
A Reject all button is not a nice-to-have accessibility extra—it is a core requirement for valid consent on most EU-facing sites. Authorities treat rejection as the baseline privacy-preserving choice users must reach as easily as acceptance.
Reject all means one action on the first layer (or an equally prominent parallel path) that denies non-essential cookies, keeps strictly necessary functionality, updates Consent Mode to denied, and prevents analytics and marketing tags from firing on that visit and subsequent pages until the user changes preferences.
Sites that hide Reject in settings, style it as a link, or show Reject that only closes the banner without changing defaults fail both UX ethics and enforcement tests. This guide explains what real rejection looks like.
What it means
Equal prominence requires comparable size, color contrast, and placement for Accept all and Reject all. CNIL's 2020 recommendation and subsequent EDPB cookie banner guidelines explicitly reject interfaces that nudge users toward Accept through visual hierarchy.
One-click rejection on the first layer is the emerging standard. Requiring users to open Manage preferences, scroll past analytics toggles, and hunt for Save without Accept is considered a dark pattern. If you offer granular controls, Reject all still belongs on layer one.
Behavior must match the label. When users click Reject all, set all non-essential categories off, persist that state, call consent update with denied analytics and ad signals, and do not load deferred tags that queued during banner display.
Reject is not the same as Close or X. Closing without a choice should leave defaults denied and tags blocked—not treat silence as consent. Some CMPs incorrectly interpret dismiss as Accept; that is high-risk.
After rejection, users still need access to privacy settings to opt in later. Footer links or icons should reopen the preference center without resetting prior choices silently.
Why it matters
French, Belgian, and Spanish authorities fined major publishers partly for rejection paths that required multiple screens. NGO reports name brands explicitly, creating PR damage beyond administrative fines.
Invalid consent from skewed UI undermines ad data too. Platforms may model conversions, but you cannot defend processing if users never meaningfully opted in.
Reject all is also a product trust signal. Users who want essential content only should get a fast, respectful path without guilt copy such as No thanks, I hate privacy.
Common mistakes
- Reject buried on second layer only.
- Reject styled as low-contrast text while Accept is a filled button.
- Reject sets UI state but leaves GTM consent granted.
- Reject on homepage only; landing pages auto-accept.
- Confirm shaming copy adjacent to Reject.
- Reject clears banner but third-party iframes already loaded trackers.
- No persisted reject state—every page view shows Accept again without honoring prior Reject.
Practical checklist
- Add Reject all button on first layer next to Accept all.
- Match button sizing, contrast, and tap targets on mobile.
- On Reject, set all non-essential categories denied in storage.
- Fire Consent Mode update with denied flags immediately.
- Block queued tags and cancel pending network requests where possible.
- Test Reject in fresh session across three internal pages.
- Document Reject behavior in cookie policy.
- Monitor scanner results specifically for post-Reject leaks.
How GDPRChecker helps
GDPRChecker banners include configurable Accept all and Reject all controls on the first layer, designed to meet equal-prominence expectations without custom front-end work.
When users click Reject all, the runtime stores denied categories and keeps tracker blocking active for analytics and marketing scripts defined in your dashboard rules—so rejection is enforced, not cosmetic.
Use the compliance scanner in Reject mode simulation: scan without consent cookies and confirm pre-consent and post-reject phases show blocked Google, Meta, and other configured endpoints.