i
FLR·B·005

The Cookie Banner

broke: consent — the asymmetry between yes and no documented

European law has required consent for non-essential cookies since the ePrivacy Directive was amended in 2009, and the GDPR then defined what consent has to be: freely given, specific, informed and unambiguous, and as easy to withdraw as it was to give. What neither instrument specified was the geometry of the asking — and the interface is geometry.

So the banner arrived, and it converged, everywhere, on the same shape. Accepting is one saturated button in the reading path. Refusing is a text link, a second screen, a list of vendors, and a save. The two answers are nominally equal and physically nothing of the sort; the design encodes which one the site would prefer, and encodes it in distance and click count — Fitts pointed the wrong way, on purpose.

This is the room where the regulation–design feedback loop is visible. The CNIL fined Google €150 million and Facebook €60 million in January 2022, and the reasoning was not about tracking at all: it was that the sites offered a single click to accept and no equivalent to refuse. A rule about consent produced a decade of consent theatre, and the correction, when it came, had to be written in the vocabulary of interaction — buttons, clicks, symmetry — because that is the layer where the law was being defeated.

The honest note this floor owes: the banner is not only an act of bad faith by designers. It is what happens when a requirement lands on an interface without a specification for its form, and when the party asking the question is also the party who benefits from one of the answers. The failure is structural, and it is repeatable anywhere those two conditions hold.

the same question, two costs Accept all done Manage… vendors toggles save legitimate interest — already on yes: 1 click no: 4, and a list
FIG B·005 — the two paths, drawn to their true lengths.
  • Accept all / Manage preferencesOne button ends the interruption; the other opens a second interface. The labels are not opposites, and only one of them is a decision.
  • Legitimate interest, pre-set to onA second legal basis, presented as a second set of toggles, already enabled — so “reject all” frequently does not.
  • The vendor listSeveral hundred third parties, each with its own switch. Hick–Hyman as a defensive weapon: the menu is the deterrent.
  • The re-askRefusal is not remembered as durably as acceptance. Consent that must be re-refused on every visit is being farmed for a mistake.
The lessonA choice is only a choice when both answers cost the same. Where a law requires consent but says nothing about the geometry of the asking, the interface will make refusal expensive and call it compliance — and the regulator will eventually arrive to measure clicks. Design the two paths symmetrically or expect the symmetry to be imposed.
The recordePrivacy Directive 2002/58/EC as amended in 2009; GDPR Articles 4(11) and 7; EDPB Guidelines 05/2020 on consent; CNIL decisions of 6 January 2022 against Google (€150m) and Facebook (€60m), both reasoned on refusal being harder than acceptance; EDPB Cookie Banner Taskforce report, January 2023.
StairwellFitts’s law, inverted — the distance and the click count are the deterrent — and Hick–Hyman weaponised as the vendor list.
Upstairs kinThe deceptive patterns room next door names the taxonomy; the cancellation flow on Floor 4 is the same asymmetry with money attached.

Why documented: The regulators published their reasoning. CNIL’s January 2022 decisions turn specifically on the number of clicks required to refuse versus to accept, which makes the asymmetry a finding of fact rather than a complaint about taste.