Skip to content

Scan rule · RSC-PRV-010

Consent without an equal reject option

Privacy (GDPR)Severity: Medium

Checks the rendered state for a reject option on the same level as the accept button.

Why this matters

Consent is only valid if it is freely given. According to the consistent view of the German Data Protection Conference, it is free only when declining is as easy as agreeing.

The typical case: "Accept all" prominently placed, decline hidden behind "Settings" and two clicks. Many banner templates are built this way because they optimise the consent rate — which is exactly what makes the consent contestable.

The fix costs no consent rate you would be allowed to keep: a second button on the same level, equally visible, with a clear label such as "Only necessary".

Scan tier

Browser runtime

How to fix it

Place a reject button on the same level as accept — same layer, same reachability.

Scan your own app for free