Consent Banner A/B Tests: What the Reject Button Data Actually Says

A consent banner is an A/B test that most sites run without knowing it, because every design choice is a test: where the reject button sits, whether it exists at all, and how many clicks it takes to say no. The data is clear, and it is uncomfortable. Hiding the reject button lifts acceptance by nearly a fifth, and one in five sites keeps tracking after the visitor clicks reject. The banner is not neutral, and the test is already running.

The design is the test

A consent banner is an A/B test that most sites run without knowing it, because every design choice is a test. Where the reject button sits, whether it exists at all, and how many clicks it takes to say no are all variables, and the data on them is clear. Hiding the reject all button from the first layer lifts the acceptance rate by nearly 18 percent, according to an experiment cited in a Bruegel study. Removing the opt-out button from the first screen lifted implied consent by 22 to 23 percentage points in the Nouwens 2020 study, Dark Patterns after the GDPR. A default yes on the boxes added 23 percentage points. The design is not neutral, and the test is already running.

The Bruegel study goes further: only 15 percent of the consent tools it analysed fully complied with GDPR standards, and a study of the most accessed 10,000 websites from 31 countries found the same pattern. A banner that shows accept in bright colour and hides reject behind a settings panel is a banner that has already decided for the visitor. The visitor's choice, when it comes, is not a choice, it is a surrender, and the data shows it.

The reject that does not reject

The design is only half the problem. A scanner that visited 23,367 small-business websites in October 2026, in seven EU countries, found that 42.9 percent loaded trackers before the visitor made any choice at all, and 28.6 percent fired an advertising pixel before consent. Only 31.1 percent showed a banner in the first place. And on the 3,514 sites with a first-layer reject button, 21.1 percent kept firing trackers after the visitor clicked it, and 15.3 percent kept firing an advertising pixel.

The banner said no, and the site kept tracking anyway. That is an implementation failure, not a design failure, and it is the one that shows up in the network tab, not in the banner. The visitor clicked reject, and the site kept sending data to Google, Meta, and the rest. The banner was a promise, and the site broke it, and the visitor has no way to know.

What the experiment actually says

A framed field experiment by Farronato, Fradkin, and Lin, published in May 2026, randomised consent banners as users browsed the web during a week, and found that deliberate obstruction, such as removing reject all from the main interface, substantially shifts choices, while purely visual manipulations, such as reordering or highlighting options, have little impact. Under the baseline interface, with no obstruction, most users accept all cookies. The largest welfare gains, the study found, come from replacing site-by-site consent with browser-level consent, which helps consumers avoid the time costs of making repeated consent decisions.

That is the honest reading: the banner is not the problem, the obstruction is. A banner that presents all options without obstruction, and defaults to accept all when the user closes it without choosing, is the optimal design under the study's model. A banner that hides reject is not an optimisation, it is a dark pattern, and the law knows it. The European Commission proposed in November 2025 a general refusal signal at the browser level, which is the same direction the study points: fewer decisions, made once, and honoured everywhere.

The test that catches it in five minutes

Open your site, count the clicks to reject, and watch the network tab after you click it. If rejecting takes more clicks than accepting, the banner is not symmetrical, and the design is the problem. The path to say no cannot be longer or harder than the path to say yes, and that is a legal requirement under the CCPA's symmetry rule, not just a design opinion. If trackers keep firing after reject, the implementation is the problem, and the fix is to gate the tags behind the choice, not to redesign the banner.

Then do the same test on mobile, because the banner that is symmetrical on desktop is often not symmetrical on a phone, where the reject button hides behind a scroll or a settings panel that does not fit the screen. The visitor who cannot find reject on a phone is a visitor who has not consented, and the site that counts them as a yes is a site that is counting wrong.

Frequently asked questions

How much does hiding the reject button change consent rates?

Hiding the reject all button from the first layer lifts the acceptance rate by nearly 18 percent, according to an experiment cited in a Bruegel study, and removing the opt-out button from the first screen lifted implied consent by 22 to 23 percentage points in the Nouwens 2020 study. The effect is large, and it is the reason the design is regulated.

Why do so many banners hide the reject button?

Because the banner is a test, and the test is rigged. A banner that shows accept in bright colour and hides reject behind a settings panel is a banner that has already decided for the visitor. The visitor's choice, when it comes, is not a choice, it is a surrender, and the data shows it.

How do I test my own banner?

Test the banner the way a visitor would: open the site, count the clicks to reject, and watch the network tab after you click it. If rejecting takes more clicks than accepting, the banner is not symmetrical, and the design is the problem. If trackers keep firing after reject, the implementation is the problem.

Can a site keep tracking after I click reject?

Yes, and it is the most common failure. A scanner that visited 23,367 small-business websites in October 2026 found that 21.1 percent kept firing trackers after the visitor clicked reject, and 15.3 percent kept firing an advertising pixel. The banner said no, and the site kept tracking anyway.