Cookie banner without a “Reject” button

Many banners show only “Accept all” and “Settings” on the first level. Anyone who wants to reject first has to open a second menu. Whether consent given this way is freely given is increasingly doubted.

Is this a risk?

Consent under Section 25(1) TDDDG and Article 6(1)(a) in conjunction with Article 4(11) GDPR must be freely given and unambiguous. On 19 March 2025, the Hanover Administrative Court (case 10 A 5385/22) ruled that a banner with “Accept all” on the first level must also offer an equally accessible reject option on the same level. In April 2026, the Austrian Federal Administrative Court also objected to a banner where the reject option was on the first level but visually much weaker than the accept button. Since the German Federal Court of Justice rulings of 27 March 2025 (I ZR 186/17, I ZR 222/19, I ZR 223/19), competitors and associations can also pursue data protection breaches via unfair-competition law — no longer only the supervisory authorities.

What you can do

• Offer a “Reject all” button on the first banner level that takes just as few clicks as “Accept all”.
• Design both buttons to be visually equivalent — same size, same contrast, no greying out of “Reject”.
• No pre-ticked box for non-essential categories; the starting state is “not consented”.
• After “Reject”, check that no consent-requiring scripts actually load — developer tools, “Network” tab, private window.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.