Deceptive design pattern

Cookie consent dark patterns: double negatives and asymmetric choice

A deceptive consent flow is a cookie or privacy dialog that asks a fair-looking question while making one answer far cheaper to give than the other — accepting takes one obvious click, refusing takes several buried ones, and the wording of the choices has to be decoded before you can act on it. The banner rarely states a falsehood; it manipulates the price of each answer, which is why these designs survive casual review and still shift outcomes by tens of percentage points.

What it is

A consent banner is, on paper, a yes-or-no question. A deceptive one keeps the question intact and rearranges everything around it. There are three levers, and most banners in the wild pull at least one. Effort asymmetry: “Accept all” is a button, refusing means opening a preferences panel, toggling categories and saving. Prominence asymmetry: the two answers are technically both present, but one is a filled brand-coloured button and the other is grey text set into a paragraph. And wording asymmetry: the labels are accurate but structured so that reading them is a small puzzle.

The wording lever is the one this level dramatises. “Cookie Consent Calculus” asks a plain question first — Accept All Cookies, or Decline All Cookies — and then demands that you confirm. The confirmation screen offers five buttons with labels like “Unrefuse all cookies”, “Don’t not decline”, “Reject non-acceptance” and “Unconsent to non-refusal”. Exactly one of them matches the choice you already made. The other four mean its opposite. Nothing on the screen is untrue. Every label is a faithful description of what its button does, and the flow is still close to unusable, because faithful is not the same as intelligible.

This is the useful thing about a double negative in an interface: it is deniable. A designer can defend “Unrefuse all cookies” as literally correct while knowing that the people who parse it wrongly will land on the outcome the site prefers. The same deniability applies to a reject link styled as body text, or a second-layer toggle that arrives pre-enabled. Each element is defensible in isolation. The pattern lives in the arrangement.

Harry Brignull, who started cataloguing these designs in 2010, files the wording lever under “trick wording” and the effort lever under “obstruction”. Consent banners tend to use both at once, along with “preselection” — a default already chosen on the user’s behalf — and “nagging”, which is re-asking a question that has already been answered.

Why it works on people

Negation carries a measurable processing cost. Wason showed in 1959 that people verify negative statements more slowly than equivalent positive ones, and that false negatives are slowest of all: a negated sentence has to be converted into its positive form before it can be checked against the world. Stack two negations and the reader is doing that conversion twice, under time pressure, on a modal that is standing between them and the page they came for. The W3C’s cognitive accessibility guidance makes the same point as a design rule — do not use a double negative to express a positive — because the cost falls hardest on people with language, memory or attention impairments.

The effort lever works because the decision is rarely the user’s actual task. Almost nobody arrives at a site in order to configure cookies. The banner is an obstacle, and the rational response to an obstacle is the cheapest exit. Nouwens and colleagues measured exactly how much that is worth: in a field experiment, removing the opt-out button from the first page of a consent notice increased consent by 22 to 23 percentage points, while putting more granular controls on the first page decreased it by 8 to 20 points. Utz and colleagues, running experiments with over 80,000 users on a live site, found that even the corner of the screen a notice appears in changes how people engage with it.

Repetition does the rest. A person who sees dozens of these dialogs a week stops reading them, which is the point at which a banner becomes a reflex rather than a decision. That reflex is trained by the majority of banners a person meets, so a site that arranges its own banner the same way as everyone else inherits the habit for free.

The last reason these designs persist is that the metric they optimise is easy to see and the harm they cause is not. Consent rate goes up this quarter. The cost — people agreeing to processing they did not want and cannot recall agreeing to — shows up as nothing at all on a dashboard.

Where you meet it

A first-layer banner with a prominent “Accept all” and no equivalent reject control, where declining requires opening a settings panel first.
A refusal offered as an unstyled text link — “continue without accepting” — embedded in a paragraph of explanatory copy, which the EDPB’s cookie banner taskforce singled out as a design its members considered incapable of producing valid consent.
Second-layer preference panels where non-essential categories arrive already switched on, or where some vendors are listed under a separate “legitimate interest” tab that the “reject all” control does not touch.
Privacy settings phrased as a negative instruction paired with a yes/no control — a “Do not sell my personal information” heading over Yes and No buttons — which California’s regulations name outright as a confusing double negative.
Banners that reappear on every page load or every session until the answer changes, so that refusing is a recurring cost and accepting is a one-off.
Confirmation steps that re-ask a question already answered, restating the choice in different words than the ones the user selected.

Designing around it

Put both answers on the first layer, at equal weight and equal cost. Same click count, same size, same contrast, same position in the visual hierarchy. It is the change with the largest effect size in the published field experiments, and the one regulators describe most consistently: California’s regulations call it “symmetry in choice” and state that the path to the more privacy-protective option should not be longer, harder or more time-consuming than the path to the less protective one. The EU’s framework reaches a similar place from a different direction — consent has to be freely given, specific, informed and unambiguous, which an unequal choice architecture undercuts.
Write every control in positive polarity, naming the action it performs. “Accept all cookies” and “Reject all cookies” are two positive statements about two different actions. “Unrefuse” and “don’t not decline” describe the same actions and cost the reader a translation step. If a label needs a moment of parsing, rewrite it rather than explaining it.
Default non-essential processing to off, and leave nothing pre-ticked. The Court of Justice of the EU held in Planet49 that a pre-ticked checkbox does not produce valid consent, because only active behaviour can signify agreement. Treat pre-enabled toggles in a second-layer panel as the same design with extra steps.
Ask once, and remember the answer. Re-prompting someone who has already declined converts a decision into a war of attrition, and it is one of the practices the European Commission may issue guidance on under the Digital Services Act’s interface-design provision, which prohibits designing an online interface in a way that deceives, manipulates, or materially distorts or impairs a user’s ability to make free and informed decisions.
Make withdrawal as cheap as consent, and keep it permanently reachable. The GDPR is explicit that it must be as easy to withdraw consent as to give it. In practice that means a persistent, findable control — a footer link or a settings entry that is present on every page — reachable in no more steps than the original banner took.
If a confirmation step is genuinely necessary, restate the user’s choice in the exact words they chose, and label the confirm button with the outcome rather than with agreement. “Yes, reject all cookies” is a confirmation. “Confirm” next to five paraphrases is a second decision wearing a confirmation’s clothes.
Test comprehension, not completion. Show the banner to people who have not seen it, ask them what each control does before they press anything, and count how many get it right. A flow with a high completion rate and a low comprehension rate is a flow that is working on people rather than for them.
Instrument the asymmetry deliberately. Track reject rate, time-to-decision and step count for each path, and treat a change that raises acceptance while lengthening the refusal path as a regression rather than a win. California’s privacy regulator has been clear that dark patterns are assessed on effect, not intent — which means a team can build one without meaning to, and can find it by measuring.
An honest version of this flow is unremarkable to look at: a short plain-language explanation of what is collected and why, two equally weighted buttons, an optional link to per-category detail for people who want it, no pre-selected non-essential categories, one prompt per decision, and a standing route back to change your mind. It converts worse than the deceptive version. That is what the measurements are telling you.

Questions

What is a deceptive cookie consent banner?

It is a consent dialog that asks a legitimate question while making one answer much cheaper to give than the other. Accepting is one prominent click; refusing takes extra steps, or is offered as a grey text link, or is described in wording the reader has to decode. The banner does not state anything false — it manipulates the cost of each answer.

Are cookie banner dark patterns illegal?

It depends on the jurisdiction and on the specific design. In the EU, consent has to be freely given, specific, informed and unambiguous, and as easy to withdraw as to give, so a design that undermines any of those can invalidate the consent it collects; the Digital Services Act separately prohibits interface designs that manipulate or materially impair free and informed decisions. In California, agreement obtained through dark patterns does not count as consent, and the regulations require symmetry in choice. Elsewhere, the position varies. Whether a particular banner crosses a line is a legal question about that banner, decided by regulators and courts.

Why do consent banners use double negatives?

Because a double negative is accurate and hard to read at the same time. A label like “unrefuse all cookies” is a truthful description of what the button does, which makes it defensible, while the extra parsing step means some readers will pick the wrong one — and the errors tend to fall in the site’s favour. California’s privacy regulations name double negatives specifically as confusing language to avoid.

What does a compliant cookie banner look like?

Two equally weighted controls on the first layer — accept all and reject all — with the same click count and visual prominence, plain positive wording, nothing non-essential pre-enabled, one prompt per decision rather than repeated nagging, and a standing link that lets someone change or withdraw their choice in no more steps than the original banner took.

Sources

Nouwens, M., Liccardi, I., Veale, M., Karger, D., & Kagal, L. (2020). Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence. Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. Scraped 680 consent notices from the top 10,000 UK sites and found 11.8% met the minimal requirements the authors derived from EU law. Their field experiment measured the effect sizes quoted above: removing the opt-out button from the first page increased consent by 22–23 percentage points.
Utz, C., Degeling, M., Fahl, S., Schaub, F., & Holz, T. (2019). (Un)informed Consent: Studying GDPR Consent Notices in the Field. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 973–990. Three field experiments with more than 80,000 users on a live German site. Establishes that notice position, the type of choice offered and the framing of the content all change consent behaviour.
Wason, P. C. (1959). The processing of positive and negative information. Quarterly Journal of Experimental Psychology, 11(2), 92–107. The classic demonstration that negated statements take longer to verify than affirmative ones, with false negatives slowest. The underlying reason a double-negative button label is expensive to read.
European Data Protection Board (2023). Report of the work undertaken by the Cookie Banner Taskforce. The common positions of EEA supervisory authorities on specific banner designs, including deceptive link design and pre-ticked boxes. Note that it records where authorities agreed and where views differed, rather than issuing binding law.
California Privacy Protection Agency, Enforcement Division (2024). Enforcement Advisory No. 2024-02: Avoiding Dark Patterns — Clear and Understandable Language, Symmetry in Choice. Sets out the “symmetry in choice” requirement at 11 CCR § 7004(a)(2) and the prohibition on confusing language and double negatives at § 7004(a)(3). States that dark patterns are about effect, not intent. Under Civil Code § 1798.140(h), agreement obtained through dark patterns does not constitute consent.
Court of Justice of the European Union (2019). Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH, Case C-673/17, judgment of 1 October 2019. Holds that consent for storing cookies is not validly given by a pre-ticked checkbox the user must deselect, because only active behaviour can signify consent.
W3C Web Accessibility Initiative. Cognitive Accessibility Design Pattern: Avoid Double Negatives or Nested Clauses (Supplemental Guidance to WCAG 2). Supplemental guidance, not a WCAG success criterion. Recommends against using a double negative to express a positive, on the grounds that it disproportionately affects people with language, dyslexia-related or memory impairments.