Two choices or three: the consent banner decision

If you run ads or analytics and have any visitors in the European Economic Area, the UK, or Switzerland, you need a consent message. When you set one up, you're offered a choice that looks like a formatting preference and isn't.

• Two choices: Consent, and Manage options.
• Three choices: Consent, Do not consent, and Manage options.

The two-choice version has no visible way to decline. Declining exists, but it's behind "Manage options" — one extra click, on a secondary screen, next to toggles.

Why the asymmetry matters legally

Consent under the GDPR has to be freely given, and regulators have consistently held that a design making acceptance one click and refusal several clicks is not a free choice — it's a nudge with a legal veneer.

Enforcement has repeatedly targeted exactly this pattern: banners where "accept all" is prominent and "reject all" is buried. The remedy demanded is consistent — refusal must be available at the same level, with comparable prominence, as acceptance.

So the three-choice layout isn't the cautious option. It's the one that matches what the guidance actually says.

The counter-argument, taken seriously

The case for two choices is straightforward: fewer visible rejections means more consented traffic, which means better ad revenue and better analytics coverage. That effect is real. Nobody chooses the two-choice layout by accident.

It's still the wrong trade for most businesses, for a reason that has nothing to do with ethics: the downside is unbounded and the upside is marginal. A modest lift in consent rates does not offset regulatory exposure, and if your EEA traffic is small the lift is negligible while the exposure is identical.

For a business whose visitors are overwhelmingly domestic, the banner fires rarely. You are accepting real risk in exchange for an effect you will struggle to measure.

Practical notes

• The setting usually applies to every property under the same account, including ones you add later. Choose as though it's permanent, because functionally it is.
• A hosted consent platform from your ad provider is free and stays current with framework changes. A separate vendor is worth it only if you need consent coverage beyond advertising.
• Your privacy policy has to match what the banner does. If the policy is silent about advertising cookies while a banner asks for consent to set them, the two documents contradict each other.
• Test with a European IP or your browser's location override. Plenty of teams have shipped a banner that never actually appeared to the people it was built for.

The underlying principle

Dark patterns are usually described as an ethics problem, which lets people argue about them indefinitely. It's more useful to treat them as a risk-pricing problem.

A design that extracts consent through friction is borrowing against a future enforcement action at an interest rate you don't get to see. Sometimes that's worth it. For a cookie banner producing a percentage point of extra opt-in, it clearly isn't.