Keep the "I decline" button, which TermsFeed Free Cookie Consent shows on your cookie banner by default in express mode. In express mode, Cookie Consent places the "I agree" and "I decline" buttons on the first layer, so refusing takes the same single click as accepting.

What "as easy" means under GDPR Article 7

Withdrawing consent must take no more effort than giving it, and the European Data Protection Board (EDPB) and the CNIL hold refusing to the same test. In practice, that means a refusal button on the same layer as the accept button. Article 7(3) of the General Data Protection Regulation (GDPR) sets that rule for withdrawal. Recital 32 adds that silence, pre-ticked boxes, or inactivity is not consent.

The EDPB applied these rules to the reject button on cookie consent banners in its "Cookie Banner Taskforce" report of 17 January 2023. A vast majority of the authorities considered a consent banner with no refuse option on a layer that has an accept button an infringement. The taskforce confirmed that pre-ticked boxes in the second layer do not give valid consent, and it judges button colors and contrast case by case.

The French regulator, the CNIL, fined Google 150 million euros and Facebook 60 million euros in its crackdown on cookie compliance, according to its announcement of 6 January 2022. The CNIL found that facebook.com, google.fr, and youtube.com did not let visitors refuse cookies as easily as accept them.

Cookie Consent follows the button layout these sources describe when you keep its defaults. In express mode, the Preferences Center switches of optional categories start off unless page_load_consent_levels lists them, so the generator defaults pre-tick no box. The "I decline" button uses the same background color as the "I agree" button in the light and the dark palettes.

Why a page-blocking layout with the "I decline" button is not a cookie wall

A cookie wall makes access to the site depend on accepting cookies, which the interstitial and standalone layouts of Cookie Consent never do while they show the "I decline" button. Both layouts show the button in express consent with notice_banner_reject_button_hide off. The EDPB Guidelines 05/2020 on consent state that access to services must not be made conditional on consent to cookies, which rules out cookie consent walls. Example 6a in those guidelines describes a script that hides the content until the visitor clicks an "Accept cookies" button, with no other way in. The EDPB finds that consent not freely given.

The interstitial and standalone layouts cover the page until the visitor answers, and keep the keyboard focus inside the consent banner while the Preferences Center is closed. The visitor answers with the "I agree" or "I decline" button, or saves the switches after clicking the "Change my preferences" button, and each answer uncovers the page. A visitor who declines reads the content, and only the scripts you tagged for optional categories stay blocked.

Keep the site usable after a refusal. Load the parts a visitor needs, such as the navigation and the checkout, without a tag. Give each blocked feature a fallback, such as a contact link in place of a chat widget. Compare the 4 layouts in consent banner layouts.

Why notice_banner_reject_button_hide exists and why to leave it off

The option notice_banner_reject_button_hide removes the "I decline" button from the consent banner, and leaving it off keeps refusal on the first layer. The option is off by default. With it on, a visitor refuses only through the "Change my preferences" and "Save my preferences" buttons, which takes at least 2 clicks against 1 for the "I agree" button.

Turn the option on only after you decide that the EU and UK rules do not reach your site, which is a legal decision for your business.

The checks assume express consent with page_load_consent_levels left out or at the generator value ["strictly-necessary"]. Keep the button in 5 steps and about 5 minutes. You need access to the page template that holds the Cookie Consent code.

  1. Open the template or code injection field that holds the cookieconsent.run({...}) call.
  2. Find "notice_banner_reject_button_hide" in the configuration object, then delete the line or set it to false. Any value other than true or "true" (written in any letter case) keeps the button visible.
  3. Confirm that "consent_type" is "express" or absent, because implied mode never shows the "I decline" button.
  4. Save and deploy the template, and clear your page cache if your site has one.
  5. Close every private window, open the page in a new one with Chrome DevTools open, and click the "I decline" button on the consent banner. In the Network tab, filter for the host of an optional script you tagged, such as googletagmanager.com for a tagged Google tag, and confirm that no request appears. In the Application tab, open Cookies and confirm that cookie_consent_user_accepted reads true and cookie_consent_level holds false for functionality, tracking, and targeting.

Check your stylesheets too. A rule such as .cc-nb-reject { display: none; } hides the button on screens wider than 480 pixels, and a rule that fades its color against the background makes refusing harder to see than accepting.

Visitors withdraw consent through the Preferences Center, which reopens from a link you place on every page. The EDPB taskforce asks for an easily reachable way to withdraw at any time, such as a small icon on every page or a link in a visible, standard place. The generated Cookie Consent code ends with a link <a href="#" id="open_preferences_center">Update cookies preferences</a> for that purpose.

Place that link in the footer of every page, next to your Privacy Policy link. A click opens the Preferences Center with the saved switches, and the "Save my preferences" button stores the new choice. Add the link to a menu or a footer with Add a Cookie Settings Link.

A tagged script that already ran keeps running until the next page load after a withdrawal, and Cookie Consent does not delete cookies a vendor already set. The option page_refresh_confirmation_buttons reloads the page after each answer, so tagged scripts stop at once. Read what a reload clears, such as form input, in reload after consent.