Auditing Cookie Consent A/B Testing

Overview

A/B testing consent banners is a common practice to optimize consent rates. However, when these experiments manipulate users into consenting through design asymmetry, deceptive patterns, or unequal ease of acceptance versus rejection, they violate GDPR Article 7 and ePrivacy Directive Article 5(3). The CNIL has been the most active enforcer, issuing a EUR 150 million fine to Google (January 2022) and a EUR 60 million fine to Meta (January 2022) specifically for consent banner design violations.

Regulatory Framework for Consent Banner Design

Equal Prominence Requirement

CNIL Deliberation No. 2020-091 (September 17, 2020) and EDPB Guidelines 05/2020 establish:

1. Equal Visual Weight: The "Accept" and "Reject" options must have the same visual prominence — same size, same color treatment, same font, same position hierarchy.
2. Equal Interaction Cost: Rejecting cookies must require the same number of clicks/steps as accepting.
3. No Pre-Selection: No purposes or vendors may be pre-selected.
4. No Cookie Walls: Access to content must not be conditioned on cookie acceptance.
5. Neutral Language: Neither option should use encouraging or discouraging language asymmetrically.

Key Enforcement Actions