Privacy ComplianceConsent Banners
Cookie Banner Dark Patterns Can Void Consent. What Do Regulators Look For?
A cookie banner designed to steer visitors toward accepting tracking does not collect valid consent. California and Colorado both treat these designs as dark patterns. The most common issues involve the styling of the buttons, the number of clicks to decline, and the wording of the choices.
By Alex Proctor
Published September 25, 2026
Summary
A dark pattern is an interface designed to steer a visitor toward the choice the business prefers. California's regulations state that consent obtained through a dark pattern is not valid, and Connecticut and Vermont take the same position. A compliant banner presents accept and decline in the same color and size, requires the same number of clicks for either choice, and labels each choice in neutral terms. In March 2025, California's privacy agency fined Honda $632,500, in part because its banner took two clicks to decline advertising cookies and only one to accept them.
What Is a Dark Pattern?
California defines a dark pattern as a user interface "designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice." The definition sits in Civil Code section 1798.140, and the regulations at section 7004 add that "any agreement obtained through the use of dark patterns shall not constitute consumer consent." Connecticut and Vermont use the same definition in their privacy laws and exclude dark patterns from their definitions of consent. Each also includes any practice the Federal Trade Commission refers to as a dark pattern, which the FTC catalogued in a 2022 report.
The consequence is the same in each state. A banner with a dark pattern cannot produce valid consent. For a site that relies on an opt-in model, the banner is the only source of consent, and a defect in its design puts every non-essential tracking activity on the website at risk.
Why Does the Styling of the Buttons Matter?
The first category of dark patterns is visual. Colorado's rules state that one choice "should not be presented with less prominent size, font, or styling than the other choice." Color is the rule's first example. An "I do not accept" button "in a greyed-out color while the 'I accept' button is presented in a bright or obvious color" is not equal, and neither is an "I accept" button that is larger than the "I do not accept" button.
In practice, the pattern usually appears as a brand-colored button to accept beside a gray or outlined button to decline, or a decline option styled as a small text link. European regulators take a similar view. The cookie banner taskforce of the European Data Protection Board said in 2023 that button colors and contrast are assessed case by case, and that contrast so low the text cannot be read is misleading.
Why Do Extra Clicks to Decline Matter?
The second category of dark patterns involves the number of steps needed to make a choice. Section 7004 requires symmetry in choice, which it describes as a path to the more privacy-protective option that is not "longer or more difficult" than the path to the less protective one. Colorado's rule says a consumer should be able to select either option "within a similar number of steps."
Both states give examples. Under California's regulations, a banner that pairs "Accept All" with "More Information," or "Yes" with "Ask me later," is asymmetrical, while "Accept All" paired with "Decline All" is not. Colorado's rule adds that offering "accept all" without "reject all" is not symmetrical either.
The Honda order applies the rule to a banner. According to the order, turning off advertising cookies on Honda's websites took two steps, a toggle and a "Confirm My Choices" button, while turning them back on took one click on "Allow All." The agency found that this asymmetry impaired the consumer's ability to make a choice, and the order requires a "Reject All" button that mirrors "Allow All." The fine covered other violations as well, including excessive verification for opt-out requests and vendor contracts missing required terms.
Notably, European regulators reached the same conclusion three years earlier. In January 2022, France's data protection authority fined Google 150 million euros and Facebook 60 million euros because their sites accepted cookies in one click and required several clicks to refuse them.
What Counts as Manipulative Language?
The third category of dark patterns involves the wording of the choices. Colorado's rule prohibits "emotionally manipulative language or visuals" that "coerce or steer" the choice, and the rule's own example is a hypothetical pair of buttons reading "I accept, I want to help endangered species" and "No, I don't care about animals." The FTC calls this confirmshaming.
Milder versions are common. A decline option labeled "No, I don't want to save money" carries the same defect as the endangered species example, and an accept button labeled "Accept for the best experience" does the same from the other side. The question for a regulator is whether the wording pushes the visitor toward one answer, no matter how gently it does so.
What Does a Compliant Banner Look Like?
| Pattern | What fails | What passes |
|---|---|---|
| Styling |
|
|
| Clicks |
|
|
| Language |
|
|
Based on section 7004, Colorado rule 7.10, and the Honda order, as of September 2026.
A compliant banner offers accept and decline as equals, in the same size and color and on the same screen, and each takes the same number of clicks. The labels describe the choice. The banner also has to do what it says. A decline that does not halt tracking is a separate problem entirely.
I recommend treating the banner as part of the privacy notice rather than a marketing element. A regulator who reads the notice will test the banner next, and a plaintiff who tests the banner will read the notice for the claims that contradict it. The PlayOn order rested on that comparison.
Questions
Are dark patterns prohibited outside California?+
Yes, in several ways. Colorado's rules list the design factors, and Connecticut and Vermont exclude agreement obtained through a dark pattern from their definitions of consent. The Federal Trade Commission treats dark patterns as unfair or deceptive practices under its general authority, and European regulators have fined companies for banners that made refusal harder than acceptance.
Does an "Accept" button with a "Manage preferences" link comply?+
Probably not under California's regulations, which give a similar pairing, "Accept All" with "More Information," as an example of asymmetry. The visitor can accept in one click but has to open a panel to decline. A decline or reject all option belongs on the first screen, next to accept, in the same color and size.
What is the exposure if a banner has a dark pattern?+
The consent it collected does not count, so the business could be treated as having run its tags without permission. In California, a banner of this kind was part of the basis for a $632,500 fine against Honda in 2025. Plaintiffs in private wiretapping lawsuits can raise the same argument about consent.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.