EU ePrivacy Directive Reject-All Button

EU-level source material does not phrase Article 5(3) as a literal, standalone command to use the words "reject all". The safer operational rule is stronger than a wording debate: if a banner presents an accept-all control for consent-based cookies, SDKs, pixels, local storage, fingerprinting, or comparable storage/access, it should also present a clear refuse, reject, or continue-without-consenting option at that same decision layer.

The EDPB Cookie Banner Taskforce reported that a vast majority of authorities considered the absence of refuse/reject/not-consent options on any layer with a consent button to be inconsistent with valid consent and an ePrivacy infringement. The same report notes a minority view that Article 5(3) does not explicitly mention a reject option, so teams should avoid saying there is one uniform EU statutory label and instead document the applicable national implementation and regulator guidance.

Equivalent does not mean every button must be visually identical, but the user must not be pushed toward acceptance by layout, wording, colour, contrast, or hidden navigation. A reject option embedded as a small text link, placed only in a later settings layer, or made unreadable through contrast can undermine the user's ability to understand and refuse the consent request.

Review the banner as a live interaction, not only as a design file. The control should be visible before consent-required storage or access occurs, describe the same category of choice as the accept control, and leave the user able to continue without consent unless a specific national rule or valid exception says otherwise.

Keep enough evidence to prove both sides of the consent choice: the user-facing refusal path and the technical result after refusal. A screenshot alone is not enough if tags still fire, local storage is populated, or SDKs access device information before or despite rejection.

Consent records should also preserve the banner version, language, country or market setting, purposes shown, vendor/category configuration, timestamp, and withdrawal route. The EDPB consent guidance says controllers must be able to demonstrate valid consent, while the cookie banner taskforce expects website owners to maintain cookie lists and demonstrate why claimed essential cookies are essential where requested.

First, Article 5(3) applies broadly to storage of, or access to, information on terminal equipment; it is not limited to browser cookies or personal data. That means a reject-all review should cover pixels, app SDKs, local storage, unique identifiers, fingerprinting signals, and other similar technologies that store or access device information.

Second, cookie placement or reading is governed by national laws transposing the ePrivacy Directive, while later personal-data processing may also need GDPR analysis. The EDPB taskforce describes its banner positions as a common denominator and says they must be combined with additional national requirements and competent-authority guidance. This FAQ therefore should not be used to infer country-specific rules, penalties, or regulator deadlines that are not separately sourced.