What are “Dark Patterns” and how does Cookie Compliance prevent them?

Applies to: All users

This article explains a concept that applies regardless of which interface you use.

Since 2021, the French DPA (CNIL), as well as the European Center for Digital Rights (noyb) have taken action against non-compliant banners by filing complaints and issuing fines to businesses that violate the core principles of GDPR through the use of Dark Patterns.

Cookie Compliance removes the following Dark Patterns (based on CNIL / noyb guidance):

Type A: Refusing consent should be as simple as providing consent

EU privacy law requires that internet users be given “equal options” regarding cookies. Cookie banners without an initial “reject” or “reject all” option in the first layer violate the GDPR consent requirement
Our approach: provides three equal level choices that represent different configurations of consent, with your Default Consent Level preselected (Private unless you change it) in the first layer on the Classic engine (the New engine preselects nothing)

Type B: No pre-ticked boxes on second layer.

Using pre-ticked boxes to obtain cookie consent violates the GDPR, which expressly states in its recitals that pre-ticked boxes should not constitute consent.
Our approach: configuration is set to ensure that all cookie category toggles are turned off by default, and dynamically toggles cookie categories based on the visitor’s selection in the first layer.

Type C: Deceptive Link Design

Use of confusing hyperlinks to reject cookies, rather than buttons, “nudges” 90% of internet users into clicking an “agree” button. Noyb cites industry statistics indicating that only 3% of internet users actually want to accept cookies.
Our approach: displays equal level choices to represent different configurations of consent, and allows visitors to set granular permissions via a consent preferences link

Types D + E: Deceptive Colors & Contrasts

Use of deceptive colors and contrasts for cookie “accept” and “reject” buttons violates GDPR consent requirements.
Our approach: the 3 Data Access Level choices come with a standard set of 3 colors. You can change them on Configuration → Design (Level 1 / 2 / 3 Color); keep every choice equally visible.

Type H: Legitimate interest claimed.

Any indication that a company relies on legitimate interests, rather than on consent, for its use of cookies violates EU privacy law.
Our approach: by default the banner is shown to every visitor, wherever they are. With Geolocation (Professional) you can hide it in specific regions.

Type I: Inaccurate classification of cookies.

Some companies misclassify non-essential cookies as “essential” (also called “strictly necessary”) cookies to circumvent the ePrivacy Directive’s consent requirements.
Our approach: every built-in provider comes with a default category. On a paid plan you can move a provider to another category, including Basic Operations (some providers are locked); do so only for services that are genuinely essential.

Type K: Not as easy to withdraw as to give consent.

Failing to include an easy and readily accessible option to update or revoke consent violates the GDPR rule that a visitor must be able to withdraw consent as easily as they can give it.
Our approach: by default a floating Update consent icon recalls the consent banner so that visitors can change or withdraw their consent. You can switch to a link you place yourself (Manual) or turn it off.