Reject All is one click, unless somebody paid for it to be twelve

These are listed in the order worth acting on, which with cookie consent banners is not the order they are usually presented in.

The asymmetry is the whole design

A banner that offers one prominent accept button and one grey link to a settings page is not offering two choices, it is offering one choice and one chore. Regulators in several jurisdictions have said explicitly that refusing should be as easy as accepting, which is why reject buttons appeared where they previously did not. Where the reject button is still missing, the settings route typically involves a list of vendors with individual toggles and a save action at the bottom.

The design works because the cost of refusing is measured in seconds and the benefit is invisible, which is a trade almost everyone declines to make. Nothing about that arrangement is accidental, since the layout is tested against consent rates in exactly the way a checkout is tested against sales.

Legitimate interest is the trapdoor

Many banners separate consent toggles from a second category described as legitimate interest, which is presented as a different legal basis rather than a choice. Switching everything off in the consent tab therefore leaves a parallel set of switches still on in a tab most people never open.

Read the terms and there it is: the legal basis is real and has genuine uses, and its appearance as a default for behavioural advertising has been repeatedly challenged. The practical effect is that a user who believed they had refused has often refused about half of what they thought. Looking for a second tab, and an object-to-all control inside it, is the single highest-value habit when dealing with these banners.

What the banner actually stores

Your choice is encoded as a consent record and passed down a chain of advertising intermediaries, each of which acts on the encoded answer. That record is stored in your browser, which is why clearing site data resurrects the banner and why the answer does not follow you between devices. It is also why the same publisher asks again after a set period, since consent is generally treated as expiring rather than permanent.

A refusal that is stored correctly should stop the tracking scripts loading, and independent testing has repeatedly found sites where it does not. Enforcement action in this area has tended to focus on those implementation failures rather than on the banner design itself.

Cookie walls and the pay-or-consent model

A cookie wall makes access conditional on accepting tracking, which converts consent into a price and raises an obvious question about whether it was freely given. The pay-or-consent variant offers a paid subscription as the alternative, which regulators have examined closely and treated differently in different markets. The argument for it is that advertising funds the content and someone has to pay for the journalism, which is a genuine point rather than a pretext.

The argument against is that a choice between surveillance and a fee is only meaningful if the fee is proportionate and the refusal is honoured. The legal position is unsettled and moving, and it varies enough that the same publisher shows different walls in different countries.

Why the banners multiplied instead of disappearing

The underlying rules require consent before non-essential storage, so a site with many third-party scripts needs a mechanism to collect it. A site with no third-party tracking needs no banner at all, which is why the least intrusive sites on the internet are also the quietest ones.

The banner is therefore a visible symptom of how much is loading behind the page, and its length is a fairly honest measure. A vendor list running to hundreds of entries tells you something concrete about the page you were about to read. That is the one genuine service these banners provide, entirely by accident.

Practices change, and a company that does this today may have quietly stopped by the time you read it.

Making them cheaper to deal with

Browser-level controls that block third-party storage reduce what the banner can do regardless of which button you press. A content blocker that hides consent dialogues removes the interruption but does not by itself communicate a refusal, which is a meaningful difference. Some browsers and extensions send an automated preference signal, and a growing number of jurisdictions treat such signals as legally binding.

Using a browser profile that clears storage on close means answering more banners and carrying less across sessions, which is a real trade-off. Whichever route you take, the goal is to make refusal cheap, because the entire design assumes refusal will be expensive.

Everything above, in order of what to do first

1. The asymmetry is the whole design. A banner that offers one prominent accept button and one grey link to a settings page is not offering two choices, it is offering one choice and one chore.
2. Legitimate interest is the trapdoor. Many banners separate consent toggles from a second category described as legitimate interest, which is presented as a different legal basis rather than a choice.
3. What the banner actually stores. Your choice is encoded as a consent record and passed down a chain of advertising intermediaries, each of which acts on the encoded answer.
4. Cookie walls and the pay-or-consent model. A cookie wall makes access conditional on accepting tracking, which converts consent into a price and raises an obvious question about whether it was freely given.
5. Why the banners multiplied instead of disappearing. The underlying rules require consent before non-essential storage, so a site with many third-party scripts needs a mechanism to collect it.
6. Making them cheaper to deal with. Browser-level controls that block third-party storage reduce what the banner can do regardless of which button you press.

The takeaway

Check for the second tab, because that is where the switches you missed are living.

None of this is an accident. Somebody drew this flow and somebody approved it.