What Consent Enforcement Cases Teach About Dark Patterns
Consent fines rarely punish exotic behaviour. Case after case turns on ordinary banner design: an accept button in bright colour, a reject route hidden two screens deep, trackers firing before any choice at all. Regulators across Europe and beyond have built a consistent picture of what counts as a dark pattern.
That consistency is useful. It means a team can audit its own banner against decided cases rather than guessing at principles. This guide summarises the patterns enforcement keeps naming, and turns them into a practical self check.
Asymmetry is the most punished pattern
The recurring finding is asymmetry: accepting takes one click, rejecting takes several, through a settings maze. Decisions have repeatedly held that if a banner offers accept on the first layer, reject must be there too, with equal prominence. Colour and wording count as part of the test: a glowing accept beside a grey text link signals the intended answer, and regulators read it that way. The same applies to close buttons that silently count as acceptance, and to banners that return every few days for people who declined while remembering acceptances forever. Count the clicks, compare the visual weight, and look at the banner the way a tired visitor on a phone sees it. That is the regulator's view as well.
Pre selection and forced action still appear constantly
Pre ticked toggles in a preference centre, sliders that start in the on position, and consent bundled into terms acceptance all keep appearing in cases, years after they were clearly ruled out. Consent must be an unambiguous act by the visitor; a default is the vendor's act, not the visitor's. Forced action is the cousin pattern: content walled until consent is given, with no equivalent way to read without agreeing to tracking. Where a site wants a consent or pay model, regulators have scrutinised whether the pay route is real, fairly priced, and genuinely available, rather than a decorative alternative designed to funnel everyone into tracking.
Tracking before consent is a separate, simple violation
Some cases need no design analysis at all, because the site's trackers fired before any choice was offered, making the banner theatre. This is the easiest violation to commit accidentally: tags added through a manager, embeds loading on arrival, or a consent tool configured to record but not to block. It is also the easiest to test. Load your key pages with a clean browser profile, watch the network requests, and list every third party call made before consent. If the list is not empty of trackers, no banner redesign will save the setup. Enforcement teams run exactly this test, so running it yourself first is the cheapest compliance work available.
Turning cases into a quarterly self audit
Build a short audit from the decided patterns and run it quarterly. Check click symmetry between accept and reject, visual prominence, toggle defaults, the wording for steering language, pre consent network calls on your main templates, consent lifetime differences between accepting and declining, and whether withdrawal is as easy as the original grant. Screenshot the banner on mobile and desktop each time, because cases often include the actual screens as evidence. Fix findings in priority order: pre consent tracking first, then asymmetry, then defaults and wording. A filed audit trail showing you looked, found, and fixed is itself valuable evidence of a serious consent practice, whatever a future inspection uncovers.
Related reading
These earlier guides cover connected questions in more depth: Consent and In-Car Data: What Your Dashboard Knows About You, Consent in Newsletter Popups: Timing, Exit Intent, and the Decline Button Problem, and Consent for SMS Marketing: Text Messages Are Not Small Emails.
Frequently asked questions
What is the most common reason consent banners get fined?
Asymmetry between accepting and rejecting, especially a missing or buried reject option, alongside trackers firing before consent. Both appear again and again in enforcement decisions because both are easy to test.
Is a cookie wall allowed?
Blocking all access until tracking is accepted is heavily restricted in many jurisdictions. Consent or pay models face detailed scrutiny of whether the paid alternative is genuine and fairly priced. Most sites should offer a real way to decline and still read.
Do regulators check mobile banners separately?
Yes. Decisions frequently consider how the banner actually appears and behaves on phones, where buried options and cramped layers are more pronounced. Audit on a real phone, not only a desktop browser narrowed to size.
How often should we audit our banner against enforcement patterns?
Quarterly is a practical rhythm, plus a fresh check after any banner redesign, consent platform change, or major site release. Keep dated screenshots and notes so the audits themselves form an evidence trail.