EU ePrivacy Directive Reject-All Button

EU-level source material does not phrase Article 5(3) as a literal, standalone command to use the words "reject all". The safer operational rule is stronger than a wording debate: if a banner presents an accept-all control for consent-based cookies, SDKs, pixels, local storage, fingerprinting, or comparable storage/access, it should also present a clear refuse, reject, or continue-without-consenting option at that same decision layer.

The EDPB Cookie Banner Taskforce reported that a vast majority of authorities considered the absence of refuse/reject/not-consent options on any layer with a consent button to be inconsistent with valid consent and an ePrivacy infringement. The same report notes a minority view that Article 5(3) does not explicitly mention a reject option, so teams should avoid saying there is one uniform EU statutory label and instead document the applicable national implementation and regulator guidance.

EU-level sources do not set a universal pixel-for-pixel prominence rule. The Cookie Banner Taskforce reached a common view that banners must not be designed in an obviously misleading way that pushes users to consent, while particular colour and contrast complaints require case-by-case assessment. National authorities may impose more specific presentation rules.

Review the live interaction, not only the design file. A refusal link hidden in a paragraph, made unreadable through contrast, or placed behind navigation that the accept action does not require can impair a genuine choice. The refusal control should operate before consent-required storage or access and block the same optional purposes covered by the accept-all control.

Keep enough evidence to prove both sides of the consent choice: the user-facing refusal path and the technical result after refusal. A screenshot alone is not enough if tags still fire, local storage is populated, or SDKs access device information before or despite rejection.

Consent records should also preserve the banner version, language, country or market setting, purposes shown, vendor/category configuration, timestamp, and withdrawal route. The EDPB consent guidance says controllers must be able to demonstrate valid consent, while the cookie banner taskforce expects website owners to maintain cookie lists and demonstrate why claimed essential cookies are essential where requested.

First, Article 5(3) applies broadly to storage of, or access to, information on terminal equipment; it is not limited to browser cookies or personal data. That means a reject-all review should cover pixels, app SDKs, local storage, unique identifiers, fingerprinting signals, and other similar technologies that store or access device information.

Second, cookie placement or reading is governed by national laws transposing the ePrivacy Directive, while later personal-data processing may also need GDPR analysis. The EDPB taskforce describes its banner positions as a common denominator and says they must be combined with additional national requirements and competent-authority guidance. This FAQ therefore should not be used to infer country-specific rules, penalties, or regulator deadlines that are not separately sourced.