Article · June 17, 2026
Avoid cookie banner dark patterns that undermine voluntary consent
Cookie banner dark patterns to avoid: prominent Accept, hidden Reject, baiting. How to design for voluntary consent.
Quick answer
What cookie banner dark patterns should be avoided?
Cookie banner dark patterns to avoid are UI tricks that steer users toward "Accept" without truly understanding or without an equal choice. Common examples include an overly prominent Accept button, a hidden Reject button, only offering "accept all", or forcing users through multiple layers to refuse.
As a compliance principle, consent must be voluntary, specific, informed, and revocable. If the interface skews the decision, a business can weaken the legal value of consent, especially when cookies/banners are used for behavioral advertising, measurement, or sharing data with third parties.
Which cookie banner dark patterns should be avoided?
The top patterns to avoid include: an "Accept" button with standout color or oversized; a "Reject" button that is faint, small, or buried under "Advanced settings"; pressure statements such as "If you don’t consent, you can’t use the website"; pre-checked checkboxes; or layouts that make users think "continue using the site" equals accepting everything.
Some patterns are more subtle: splitting choices using confusing language, using multiple modal layers, or placing "Accept all" in a convenient, thumb-friendly position while "Manage settings" is tucked away. These approaches don’t yield clearer consent; they merely increase the chance that users click just to get it over with.
| Interface pattern | Issue | Recommended design | |
|---|---|---|---|
| Prominent Accept button, hidden Reject button | Skews the choice | Make both buttons equally prominent | |
| Pre-checked checkbox by default | Does not reflect active choice | Default off; users opt in themselves | |
| Only "Accept" on the first screen | Forces users through extra steps to refuse | Provide a reject button on the first screen | |
| Vague wording like "better experience" | Does not state processing purposes clearly | State specific purposes: measurement, advertising, personalization | |
| Hiding the "Manage preferences" button | Hinders user control | Make settings easy to access, one tap |
Why do dark patterns weaken voluntary consent?
Because consent is not just a click; it is a decision made with genuine freedom of choice. When a banner is designed to steer, users often choose out of habit rather than because they understand and agree to each processing purpose.
In practice in Vietnam, many e-commerce, media, SaaS websites or content apps use banners just to "get a quick click". This creates risk when a business needs to prove it provided adequate notice, separated purposes, and has valid consent logs if inspected or faced with complaints.
How should Vietnamese businesses design cookie banners?
Businesses should prioritize two principles: clarity and balance. The banner should immediately show users the purposes for using cookies, the main cookie categories, and present accept/reject/manage-detail choices at the same, easy-to-access level.
Present choices equally:
Put "Accept" and "Reject" at the same level of prominence; avoid one button overpowering the other.
State purposes very specifically:
For example: traffic measurement, content personalization, advertising, sharing with analytics partners.
Do not pre-check:
All purpose-specific checkboxes that are not necessary should be off by default.
Allow refusal on the first screen:
Users should not have to drill through multiple layers to refuse.
Keep consent evidence:
Record the timestamp, banner version, the user’s choices, and how they can withdraw.
Make withdrawal as easy as consent:
Always provide an entry point to cookie management in the footer or settings.
Do such banners violate the law?
You shouldn’t assert that any single interface always violates or always complies in every case. But under personal data protection rules, if a banner results in consent that is not voluntary or not sufficiently transparent, the business may face compliance risk and have to explain itself during an inspection.
The Personal Data Protection Law (Law 91/2025/QH15) takes effect from 01/01/2026, replacing/upgrading Decree 13/2023/ND-CP. The enforcement authority is the Ministry of Public Security, specifically the Department of Cybersecurity and High-Tech Crime Prevention (A05). Specific penalties will be set by guiding decrees; serious violations may be subject to criminal liability.
A practical point to remember: a cookie banner is not just UI/UX. It is a legal touchpoint. If the banner is used to request consent for tracking/ads, the design must help users understand, choose, and withdraw, rather than being "tricked" into clicking accept.
What should be checked before launching a cookie banner?
Before launch, the team should review three layers: content, interface, and evidence capture. Content must state the purposes correctly; the interface must not skew choices; the system must log choices against the banner version to support later audits.
If the website has many third parties such as analytics, ads, heatmaps, or chat widgets, map exactly which scripts run and when. Many dev teams think adding a banner is enough, but if scripts still fire before a choice is made, the consent is essentially invalid.
If you are standardizing your cookie banner or want to keep consent evidence for audit, consent.vn can help product and legal teams quickly finalize an implementation checklist.
Source: the Personal Data Protection Law (Law 91/2025/QH15), Decree 13/2023/ND-CP: thuvienphapluat.vn; Ministry of Public Security (A05): bocongan.gov.vn
Get started — set up in 5 minutes.
Need help with PDPL compliance?