Cookie banners have become a standard part of almost every website. Yet many banners still offer visitors just one easy path: a large, colourful 'Accept' button. Users who want to refuse must either hunt for a tiny link or click through several screens in a settings menu. Is this design legally valid? The short answer is no. In this article we explain why a 'reject' button is effectively mandatory and what the symmetrical choice rule actually means.
What Does Valid Consent Mean?
Under both the Turkish KVKK approach and the GDPR, consent collected for non-essential cookies must meet certain qualities. Consent must be:
- Freely given: The user must be able to make a genuine choice.
- Informed: It must be clear which cookies are used and for what purpose.
- Specific and unambiguous: It must be collected per purpose, not through blanket statements.
- Given through an active action: Silence, pre-ticked boxes, or continued browsing do not count as consent.
The most critical of these four is 'freely given'. If accepting and rejecting carry a significantly different burden, the choice is not truly free.
What Is the Symmetrical Choice Rule?
The symmetrical choice rule states that accepting and rejecting must be equally easy for the user. In other words, if a visitor accepts cookies with a single click, they must also be able to reject them with a single click.
When rejecting is harder than accepting, the consent collected is not considered freely given and is therefore invalid.
In practice this means: if the first layer of the banner has an 'Accept' button, it must also feature a 'Reject' (or 'Reject All') button with similar visibility in the same layer. Hiding the reject option behind a second screen, a small link, or a hard-to-notice corner breaks the symmetry.
Why Is a 'Reject' Button Effectively Mandatory?
You will not find a sentence in the regulations that literally says 'add this button to your banner'. But when the conditions for valid consent are combined, the conclusion is clear: it is nearly impossible to collect valid consent without giving users an easy way to refuse. So the reject button is a requirement that flows not from a literal rule, but from the logical consequence of the rule.
Imagine a banner offering only 'Accept' and 'Settings'. To refuse, the user must enter 'Settings', turn off each category one by one, and then save. That is an effort incomparable to the single click accepting requires, and it plainly breaks the symmetry.
Compliant vs. Non-Compliant Banner Comparison
The table below summarises the compliance status of common design choices:
| Design Choice | Compliant? | Why |
|---|---|---|
| Only 'Accept' + 'Settings' | No | Rejecting requires more effort |
| 'Accept' big/colourful, 'Reject' faint grey | No | Visual steering breaks symmetry |
| Pre-ticked cookie boxes | No | No active consent |
| Only 'Accept', no reject | No | No free choice offered |
| 'Reject' hidden on a second screen | No | Burden asymmetry |
How to Build a Symmetrical Banner
Steps to design a compliant banner:
- Separate essential cookies. Cookies strictly necessary for the site to work do not require consent; distinguish them clearly from the rest.
- Place two equal buttons in the first layer. 'Accept All' and 'Reject All' should appear on the same screen, at the same size and with similar colour contrast.
- Ensure visual equality. Avoid colour tricks that make one button prominent and the other invisible.
- Offer purpose-based settings. Add a fine-tuning option per category (analytics, marketing, etc.) for users who want it.
- Keep defaults off. No optional cookie should run before consent; boxes must start empty.
- Make withdrawal easy. Provide a persistent link (e.g. 'Cookie Preferences') so users can change their decision later.
- Store proof of consent. Record who consented, when, and to which categories.
Example Scenario
'ModaX', an e-commerce site, used only an orange 'Accept' button on its banner, with a small grey 'Cookie settings' link beneath it. The analytics team was happy with conversion rates because most users saw the single button and clicked it.
During an audit, a legal advisor flagged this design: to refuse, a user first had to click the link, turn off three categories one by one in the panel that opened, and press 'Save' — four separate interactions. Accepting, by contrast, was a single click.
The ModaX team redesigned the banner: they added equally sized 'Accept All' and 'Reject All' buttons in the first layer, with a 'Manage Preferences' option beside them. They removed pre-ticked boxes and began storing consent records with timestamps. As a result, the consent collected became freely given and provable.
Frequently Asked Questions
Must the reject and accept buttons be exactly the same colour?
The colours do not need to be pixel-identical; what matters is that no option is designed to steer the user by overshadowing the other. If one is bright and large while the other is faint and small, that is visual steering and breaks the symmetry.
Do I also need consent for essential cookies?
No. Cookies strictly necessary for the site's core functions do not require consent. However, you must define them clearly and must not hide analytics or marketing cookies under the 'essential' label.
Isn't offering 'Accept' and 'Settings' enough?
Usually not. If the user must take multiple steps to refuse via 'Settings', the effort gap between accepting and rejecting breaks the symmetry. Offering a direct reject path in the first layer is the safest approach.
If a user closes the banner, does that count as consent?
No. Closing the banner with an 'X', scrolling past it, or continuing to browse is not active, unambiguous consent. In that case, optional cookies must not be run.
This content is for general information purposes only and does not constitute legal advice.
With JUS. you can scan your website for free to discover your cookies and launch a banner that respects the symmetrical choice rule within minutes.