darkpattern.eu
Under EU law, cookie consent must be freely given, specific, informed, and unambiguous. Rejecting tracking cookies should be exactly as easy as accepting them. It almost never is.
This is a list of websites that use dark patterns in their cookie consent banners — making rejection deliberately harder, more confusing, or more time-consuming than acceptance. These practices violate the GDPR, the ePrivacy Directive, and guidance from the EDPB.
The CJEU ruled in Planet49 (C-673/17) that pre-ticked boxes do not constitute valid consent. The EDPB Cookie Banner Taskforce confirmed that asymmetric consent flows fail the "freely given" standard. These aren't edge cases. They're the law.
The List
| Site | Hidden Reject | Asymmetric Buttons | Pre-ticked Boxes | Confusing Language | Forced Action | Nagging | Notes | Added |
|---|---|---|---|---|---|---|---|---|
| Delfi.ee | ✕ | ✕ | Prominent blue "NÕUSTUN KÕIGIGA" (Accept All) button next to an outlined "KOHANDA" (Customise) link. Claims 1017 partners. No "Reject All" option on the first layer — users must click through to customise and disable individually. | 2026-07-21 | ||||
| eKool | ✕ | ✕ | ✕ | ✕ | ✕ | Children's education platform. Filled blue "Consent" button vs outlined "Manage options". 210 partners, 46 vendors pre-enabled via "Legitimate interest" toggle. Quantcast cookies lasting 1825 days. No "Reject All" — users must disable each vendor individually. | 2026-07-21 | |
| Apollo Kino | ✕ | Large orange "Nõustun kõigi küpsistega" (Accept All) button vs grey outlined "Keeldu kõigist" (Reject All) and "Tingimused ja kohandamine" (Customise). Accept is visually dominant with colour and size. | 2026-07-21 | |||||
| Elamus Spa | ✕ | ✕ | Cookiebot banner with "Eelistused", "Statistika", and "Turustamine" toggles all pre-enabled. Only "Vajalik" is labelled as required. "LUBA KÕIK" (Allow All) and "LUBA VALIK" (Allow Selection) but no "Reject All" — users must manually disable each toggle. | 2026-07-21 | ||||
| ERR | ✕ | ✕ | ✕ | Public broadcaster. Green filled "Nõustun kõigi küpsistega" (Accept All) vs outlined "Kohanda valikud" and "Nõustun vajalike küpsistega". Functional, analytics, and embedded content cookies pre-ticked in the personalise tab. Consent spans 23 sub-domains. Implies site may not work without optional cookies. | 2026-07-21 |
What Counts as a Dark Pattern?
We document cookie consent interfaces where the path to rejection is meaningfully harder than acceptance:
- Hidden Reject — reject is buried behind extra screens or settings menus
- Asymmetric Buttons — accept is a large coloured button; reject is a small text link
- Pre-ticked Boxes — tracking categories enabled by default (illegal per Planet49)
- Confusing Language — wording designed to mislead users into accepting
- Forced Action — content blocked until cookies are accepted (cookie walls)
- Nagging — repeated prompts to accept after the user has already declined