There is a gesture you have made so many times it no longer counts as a decision. The page loads, a rectangle slides up from the bottom or blooms in the center, and your thumb or cursor is already moving toward the big, warm, brightly colored button before you have read a single word. Accept all. The rectangle vanishes. Somewhere beneath it, in a typeface designed by someone who clearly hates you, are the words “manage preferences” — a door you have never opened, leading to a room you have never seen.
Everyone hates this rectangle. Developers hate building it, designers hate placing it, users hate clicking it, and the received wisdom of the entire internet is that we know exactly whom to blame: Brussels. The GDPR, the story goes, is a well-meaning European regulation that bureaucratized the web into a thousand pop-ups a day. It is a satisfying story, and it is wrong in a way that turns out to be much more interesting than the irritation itself.
Because here is the thing the story skips: no law required the banner. Not the GDPR, which never mentions cookie banners at all, and not the actual legal hook — Article 5(3) of the ePrivacy Directive, a rule that has been on the books in its operative form since 2009. What the law requires is consent: freely given, specific, informed, and — this is the part that matters — as easy to take back as it was to give. “Silence, pre-ticked boxes or inactivity should not constitute consent,” the GDPR’s recitals say. Nothing in there says and you must do this with a pop-up. The banner is not the law. The banner is what the industry built to get around the law.
The counter-offer
Once you see it this way, the whole landscape rearranges. A rule was issued targeting an outcome — real consent, or no tracking — and an entire industry responded not by delivering the outcome but by manufacturing an artefact that looks like the outcome. The reject button tucked one layer down, behind a link labeled “options.” The hundreds of “legitimate interest” toggles, pre-set to on, which you are invited to switch off one by one like defusing a bomb made of checkboxes. The button colors engineered so that “accept” glows and “refuse” sulks in gray. None of this is compliance. It is the regulated party’s counter-offer, rendered in CSS.
And regulators keep saying so, in writing, in public, to remarkably little effect on the banner itself. When the European Data Protection Board convened a Cookie Banner Taskforce — prompted by hundreds of complaints filed by the privacy organization NOYB — its 2023 report stated that a “vast majority” of European authorities consider it an infringement when there is no reject option on the same layer as the accept button. Pre-ticked boxes: no. Deceptive button contrast: no. And that familiar wall of “legitimate interest” sliders? The taskforce notes that legitimate interest is not a valid legal basis for placing the cookies in the first place. The Dutch data protection authority’s guidance is plainer still: reject and accept on the same layer, equally visible, and legitimate interest is simply not available for tracking cookies or personalized ads. The designs you encounter dozens of times a day have been ruled against so consistently that the non-compliant banner is now arguably the web’s most thoroughly adjudicated interface element. It remains everywhere.
The courts got there earlier. In 2019, the Court of Justice of the EU decided Planet49 — a case about a German lottery website that had helpfully pre-ticked its consent checkbox for you — and held that consent by pre-ticked box is not consent. The judgment reads the old ePrivacy directive together with the GDPR and lands somewhere almost touchingly literal: consent means you did something. Not that you failed to undo something someone else did on your behalf.
Resenting the wrong party
This is the mechanism the essay is actually about, and it reaches well past cookies. When a rule targets an outcome that threatens a business model, the cheapest response is rarely to change the model. It is to produce a compliant-looking artifact and let the artifact absorb the public’s anger. The banner performs consent the way a mandatory HR webinar performs workplace dignity: everyone involved understands that the performance is the point. And the performance has a second, quieter function — it generates resentment, and then it aims that resentment at the regulator rather than at the company that designed the dark pattern, chose the colors, buried the button, and monetized the data either way. The industry gets the tracking, and the EU gets the complaints. It is, as lobbying strategies go, nearly costless.
The slow, grinding enforcement record shows what it takes to make the counter-offer more expensive than the real thing. A longitudinal study of more than 11,000 websites across 30 countries found that the share offering a “reject all” button climbed from under three percent in 2018 to just over thirty percent in 2024 — movement driven, the researchers found, substantially by national regulators taking action. In other words: a decade of rulings, taskforces, and fines moved one interface element from almost nowhere to not-quite-a-third. That is not a story about a law that failed. It is a story about how much sustained pressure it takes to shift a trillion-dollar industry’s default behavior by thirty percentage points — and a hint of how completely it would have won without any.
Which is why the banner deserves a small rehabilitation. Not as good design — it is atrocious design, built to be hated — but as evidence. Every ugly pop-up is a fossil of a negotiation that actually happened: a law demanded something real, the industry refused, and the compromise is sitting there on your screen, brightly colored and seething. The banner is the visible scar tissue of the only large-scale attempt anyone has made to tell the surveillance economy no. When it irritates you tomorrow morning — and it will — the feeling is correct. The address is wrong. You are not being pestered by a regulation. You are being shown, with remarkable candor, exactly what an industry thinks of your consent: that it is a toll booth to be engineered around, dressed up as a choice, and priced at one glowing button.
The strangest possible outcome is that the banner eventually disappears — not because consent won, but because the industry finally got tired of pretending to ask.