A reject all button is the control on a cookie banner that lets a visitor refuse every non-essential cookie in one click, placed alongside the button that accepts them. In the UK, the Information Commissioner’s Office expects rejecting to be as easy as accepting, so a banner with “Accept all” on its first screen and no equally clear way to refuse is unlikely to meet the rules.
How a reject all button works
A cookie banner appears on a visitor’s first page and asks permission for cookies and similar technologies that are not strictly necessary, typically analytics, advertising and some embedded content. “Accept all” switches those categories on, “Reject all” leaves them off, and a third option usually opens settings where the visitor can choose category by category.
Behind the banner, a consent management platform records the choice and tells the site which tags may run. With Google’s consent mode, the banner passes the visitor’s choice to Google tags: after a rejection, analytics and advertising storage stay denied, and Google tags either do not load at all (basic mode) or send limited signals without setting cookies (advanced mode). Whichever approach you use, a rejection has to stop the non-essential cookies, not just close the banner.
Strictly necessary cookies, such as those that keep a basket working or remember the consent choice itself, do not need consent and carry on working after a rejection.
Why it matters
Under PECR, a website needs consent before storing or reading non-essential information on a visitor’s device, and under UK GDPR that consent must be freely given and as easy to withdraw as to give. The ICO’s position is that a banner which makes accepting one click and rejecting several nudges people towards accepting, so the consent it collects is not valid. In late 2023 it wrote to a number of the UK’s most visited websites about exactly this, and it has since run wider reviews of cookie compliance on popular UK sites. Check the ICO’s website for its latest guidance and enforcement before you sign off a banner.
The Data (Use and Access) Act 2025 relaxes the consent requirement for some low-risk cookies, including certain analytics uses, as its provisions come into force, provided visitors are told about them and given a simple way to object. At the time of writing (October 2026), advertising cookies still need consent, so a reject all button remains necessary on almost every site that runs ad tracking.
There is a commercial side. Fewer people accept when refusing is easy, so analytics and ad platforms see fewer users. That loss is the cost of collecting data lawfully, and it is far better planned for than discovered during a complaint.
Common mistakes
- Hiding “Reject all” on a second screen behind “Manage settings” while “Accept all” sits on the first.
- Making the reject option a faint text link next to a large coloured accept button, one of the dark patterns the ICO has criticised.
- Pre-ticked category boxes in the settings screen, or advertising switched on under a “legitimate interest” toggle.
- A reject button that closes the banner while the tags keep firing. Test it rather than trusting the supplier’s demonstration.
- No easy way to change your mind later, such as a footer link that reopens the banner.
How to act on it
Put “Accept all” and “Reject all” on the first screen of the banner, the same size, style and prominence, with a settings link beside them. Then test it. Open the site in a private window, click reject, and use your browser’s developer tools or GTM preview mode to confirm that no analytics or advertising cookies are set and no such tags fire. Accept in a fresh window and confirm they do.
Plan measurement around the people who reject, using consented server-side conversion data and your own sales records, rather than trying to work around their choice. I set up and test the banner, the tags and the consent signals together in performance marketing work for UK sites, because a banner that looks right but still lets tags fire gives a false sense of compliance.