Dark Patterns in Cookie Banners: A Growing GDPR Risk

Definition

What Are Dark Patterns?

Deceptive design techniques that manipulate users into making choices they would not otherwise make.

The term “dark pattern” was coined by UX researcher Harry Brignull in 2010 to describe user interface designs that deliberately trick or manipulate people into taking actions that benefit the business at the user’s expense. In the context of cookie consent, dark patterns are design techniques used to steer visitors toward accepting all cookies — including advertising and tracking cookies — rather than making a genuine, informed choice. They exploit cognitive biases, visual hierarchies, and the natural tendency of users to follow the path of least resistance.

Dark patterns are not merely bad UX. They are a deliberate subversion of the consent mechanism that the GDPR and ePrivacy Directive require. Under GDPR Article 4(11), consent must be “freely given, specific, informed and unambiguous.” The European Data Protection Board (EDPB) has issued comprehensive guidelines — most notably Guidelines 3/2022 on Dark Patterns in Social Media Platform Interfaces — that define manipulative design as a direct obstacle to valid consent. When a cookie banner uses dark patterns, the consent collected through that banner is legally void. Every cookie set on the basis of that invalid consent constitutes an independent violation.

The practical implication is severe. If your consent banner uses dark patterns and your website receives 500,000 visitors per month, you are potentially committing 500,000 consent violations per month. This is precisely the kind of calculation that led the CNIL to issue its record-breaking fines. Regulators are no longer interested in whether you intended to manipulate users. They are interested in whether your banner design effectively steers users toward acceptance. If the design makes it easier, faster, or more intuitive to accept cookies than to reject them, you have a dark pattern problem.

Taxonomy

Eight Types of Dark Patterns in Cookie Banners

Regulators have identified and penalized each of these patterns. Many cookie banners use several simultaneously.

Case law

Enforcement Actions: Real Fines for Dark Patterns

From six-figure penalties to nine-figure fines, regulators across Europe are systematically penalizing manipulative cookie consent design. These cases define the boundaries of what is and is not permissible.

The enforcement landscape has shifted dramatically between 2022 and 2026. What began as guidance and formal notices has escalated into immediate, substantial fines. The CNIL in France has been the most aggressive enforcer, but data protection authorities in the Netherlands, Italy, Austria, and Germany have all taken action. The trajectory is clear: penalties are escalating, and repeat offenders face progressively larger fines. Here are the landmark cases that every website operator should understand.

The Dutch DPA’s Systematic Campaign

Beyond individual fines, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has launched the most systematic cookie enforcement campaign in Europe. In April 2025, the Dutch DPA issued formal warnings to 50 organizations — including major online retailers, media companies, and insurers — for deploying misleading cookie banners. These organizations were given three months to comply or face investigations and administrative fines.

The Dutch DPA now monitors approximately 10,000 Dutch websites annually and intends to warn 500 organizations per year for non-compliance. The Dutch government allocated €500,000 per year for three years to the DPA specifically for enhanced supervision of tracking technologies and misleading cookie banners, followed by a permanent annual increase of €350,000 for investigations from 2027 onward. The message is clear: automated, large-scale enforcement is the new norm.

Of the over 200 websites that received warnings from the Dutch DPA, approximately three-quarters adjusted their banners to meet legal requirements. The remaining non-compliant organizations face investigations and fines. Recurring violations identified by the Dutch DPA include missing “Reject All” options on the first banner layer, pre-selected checkboxes, cookies placed before consent, cookie walls without valid justification, and absent or incomplete consent logs.

The Italian Garante’s Approach

Italy’s Garante per la Protezione dei Dati Personali has adopted a dual approach: comprehensive cookie guidelines paired with targeted enforcement. The Garante’s updated cookie guidelines, effective since January 2022, require that cookie banners contain a visible close button (“X”) that dismisses the banner without placing any non-essential cookies, clear information about cookie purposes, a consent button, and a link to detailed cookie preferences. Scrolling is explicitly rejected as a form of consent.

The landmark €300,000 fine in February 2023 against a digital marketing company was the first Italian enforcement action specifically targeting dark patterns under the GDPR. The Garante found that the website placed the “continue without accepting” option outside the consent pop-up, in smaller font and at the bottom of the page, while the consent button was prominently displayed inside the banner. The Garante explicitly referenced the EDPB’s dark pattern guidelines in its ruling, signaling that it views dark pattern enforcement as a permanent priority.

Where Enforcement Is Heading

The European Commission’s proposed Digital Fairness Act and Digital Package introduce standardized requirements for cookie banners, including mandatory one-click reject mechanisms with equal prominence to accept buttons. AI-powered enforcement tools are being developed that can scan millions of websites for dark patterns, moving enforcement from complaint-driven to proactive and automated. With €1.2 billion in GDPR fines issued in 2025 alone and cumulative fines exceeding €5.88 billion since May 2018, the financial risk of non-compliance has never been higher.

Self-assessment

How to Audit Your Own Banner

A five-point checklist to determine whether your cookie banner uses dark patterns. If you cannot answer “yes” to every question, your banner may be non-compliant.

Our approach

FixGDPR’s Approach to Compliant Design

Every enforcement case described above involves the same fundamental failure: the banner was designed to maximize consent rates rather than to respect user choice. FixGDPR takes the opposite approach.

FixGDPR’s consent banner is built from the ground up to be compliant by default. We do not offer toggle switches for dark patterns. We do not provide options to hide the reject button or make it less prominent. We do not allow pre-selected cookie categories. Compliance is not a configuration option; it is the architecture of the product. Every banner we deploy passes the five-point audit above, the EDPB’s Guidelines 3/2022 on dark patterns, and the specific requirements established by the CNIL, the Dutch DPA, the Italian Garante, and Austrian court rulings.