Finding reference

Reject/refusal option not observed or nested

Retained consent-surface evidence showed that a reject, decline, or equivalent refusal control was not observed on the initial consent layer, or appeared less directly available than the accept path within the observed scan scope. Review the evidence context, methodology, common causes, and reviewer questions for this CertScore finding.

Selected finding

Reject/refusal option not observed or nested

MediumGood evidenceAbsence observationConsentSeen on ~4% of scanned top sites

Benchmark frequency is directional market context only. It is not a compliance benchmark, legal conclusion, or severity score. Rare findings may be top-ranked only when retained evidence is strong; common findings may remain medium when evidence is automated or context-dependent. Rarity is not severity, and prevalence is not compliance risk.

Observed

Why this matters

When refusal is not visible or is harder to find than acceptance, users may have difficulty expressing a privacy choice. For review teams, this signal can help identify CMP template, button-label, preference-center, localization, or first-layer design issues that may require consent UI review.

Detection methodology

CertScore retains representative consent-surface evidence for visible controls, button labels, link text, consent-layer structure, first-layer availability, preference or settings paths, and scan coverage context where available. The finding is surfaced when retained evidence indicates that an accept path was observed but a reject, decline, or equivalent refusal control was not observed on the same layer, was nested behind additional steps, or was materially less direct in the observed scan scope. CertScore treats refusal-path availability signals as review signals. The scanner does not determine that a reject option does not exist in every region or layer, legal status, deception, unfairness, consent validity, or compliance status. Reviewers should consider region, CMP configuration, prior consent state, localization, viewport, accessibility, whether an equivalent refusal path exists, and whether the retained evidence reflects the relevant user-facing consent surface.

Confidence semantics: Good when retained consent-surface evidence includes the observed consent layer, accept control, visible button or link labels, refusal-path availability, page context, and scan coverage; stronger when retained evidence also includes step count, preference-path context, repeated examples across regions or viewports, and enough detail for manual UI review. Manual review is still needed for legal interpretation, equivalent choice paths, accessibility, localization, and remediation quality.

Top-finding calibrationWhat must be retained to surface, top-rank, demote, or suppress this finding.

Minimum to surface

Accept visible plus reject/refusal not observed or nested.

High confidence requires

Visible controls retained plus preference path inspected.

Top ranking requires

Accept one step and reject unavailable or materially harder.

Demote or suppress when

Labels not retained.
Scan did not reach consent surface.
Unrelated overlay.

These rules describe ranking calibration for already-projected findings. They do not create findings from raw signals.

Example evidence

Reject availability example

artifact=consent_ui_001
role=finding_supporting_artifact
url=https://example.com/
component=cookie_banner
observed_layer=initial
accept_control_text=Accept all
reject_control_observed=false
preferences_control_text=Manage choices
consent_action_observed=false
scan_scope=public homepage initial load
review_caveat=manual review should confirm whether an equivalent refusal path exists for the relevant region, language, viewport, and CMP configuration

Review context

possible_source=cmp_template_or_region_config
controls_to_review=accept, reject, decline, manage choices, close, continue without accepting
paths_to_review=initial_layer, preferences_layer, footer_privacy_link
accessibility_review_needed=true
manual_review_needed=true

What should not count by itself

cmp_vendor=Example CMP [audit_only_without_visible_controls]
banner_present=true [insufficient_without_button_labels]
policy_mentions_opt_out [insufficient_without_runtime_consent_surface]
reject_not_clicked [insufficient_without_control_availability_context]

View redacted sample JSON

Redacted sample JSON

{
  "findingId": "reject_option_missing_or_hidden",
  "label": "Reject/refusal option not observed or nested",
  "category": "Consent",
  "criticality": "medium",
  "evidenceConfidence": "good",
  "directVsInferred": "absence_observation",
  "evidence": {
    "summary": "Retained consent-surface evidence showed that a reject, decline, or equivalent refusal control was not observed on the initial consent layer, or appeared less directly available than the accept path within the observed scan scope.",
    "examples": [
      {
        "title": "Reject availability example",
        "lines": [
          "artifact=consent_ui_001",
          "role=finding_supporting_artifact",
          "url=https://example.com/",
          "component=cookie_banner",
          "observed_layer=initial",
          "accept_control_text=Accept all",
          "reject_control_observed=false",
          "preferences_control_text=Manage choices",
          "consent_action_observed=false",
          "scan_scope=public homepage initial load",
          "review_caveat=manual review should confirm whether an equivalent refusal path exists for the relevant region, language, viewport, and CMP configuration"
        ]
      },
      {
        "title": "Review context",
        "lines": [
          "possible_source=cmp_template_or_region_config",
          "controls_to_review=accept, reject, decline, manage choices, close, continue without accepting",
          "paths_to_review=initial_layer, preferences_layer, footer_privacy_link",
          "accessibility_review_needed=true",
          "manual_review_needed=true"
        ]
      },
      {
        "title": "What should not count by itself",
        "lines": [
          "cmp_vendor=Example CMP [audit_only_without_visible_controls]",
          "banner_present=true [insufficient_without_button_labels]",
          "policy_mentions_opt_out [insufficient_without_runtime_consent_surface]",
          "reject_not_clicked [insufficient_without_control_availability_context]"
        ]
      }
    ]
  }
}

Regulatory review context

Consent UX: refusal-path availability review signal

Retained consent-surface evidence showed refusal-control availability or path-depth signals, such as a refusal option not observed on the initial layer, nested behind another control, or presented through a less direct path. These signals may be relevant to consent, cookie/tracker, transparency, and choice-architecture review depending on jurisdiction, CMP configuration, equivalent choice paths, accessibility, and manual review.

EDPB cookie banner reject-path reviewGDPR freely given and unambiguous consent reviewCCPA/CPRA choice-architecture and opt-out friction reviewFTC choice architecture / dark-pattern review contextEU GDPR/ePrivacy consent UI reviewUK PECR / ICO cookie-choice reviewMore context in reference notes

View applicability notes

Legal and regulatory frameworks

EDPB cookie banner reject-path reviewRetained consent-surface evidence suggests accept is available on the first layer while an equivalent reject or refusal path may be absent, less visible, or harder to reach.
GDPR freely given and unambiguous consent reviewConsent may be used for cookies, tracking, personal data processing, profiling, or advertising.
CCPA/CPRA choice-architecture and opt-out friction reviewThe interface may affect California privacy choices, opt-out paths, or consent.
FTC choice architecture / dark-pattern review contextThe flow may obscure or burden refusal or privacy choices.

Jurisdictional contexts

EU GDPR/ePrivacy consent UI reviewEU/EEA users and cookie or tracking consent UI may be in scope.
UK PECR / ICO cookie-choice reviewUK users and non-essential cookie choices may be in scope.
U.S. privacy choice-architecture / dark-pattern review contextRetained UI evidence suggests privacy choices, opt-outs, consent, or targeted advertising controls may be affected.

This finding does not determine legal status, whether a reject option exists in all regions or layers, consent validity, deception, unfairness, or dark-pattern status. Review the retained consent-surface evidence, labels, paths, region targeting, CMP configuration, accessibility, and applicable exemptions.

Evidence standard

Strong

Retained consent-surface evidence includes page URL, consent layer or banner observation, visible accept control, and no visible reject, decline, or equivalent refusal control on the same observed layer.
Retained evidence includes labels or control text sufficient to identify the accept path and available preference or settings path, if present.
Evidence includes timing or scan-state context showing the observation occurred before a consent choice was recorded.
Coverage context indicates the consent surface was not materially blocked, truncated, or replaced by unrelated overlays.
Repeated observations across viewports, regions, or pages may strengthen confidence when retained.

Good

Retained evidence shows an accept path and a refusal path that appears nested behind settings, preferences, or additional steps, but some visual context or step detail may require manual review.
The retained example is enough for a reviewer to inspect the observed consent layer and evaluate whether an equivalent refusal path exists.
The evidence is likely a reject-availability issue, but localization, region rules, prior consent state, accessibility, and equivalent-choice analysis require manual review.

Audit-only

CMP or banner present, but retained evidence does not clearly show all controls or their labels.
Button or link labels suggest preferences or settings, but the scan did not retain enough path detail to determine whether reject was available.
Static CMP configuration, policy text, or template name suggests a risk, but no retained consent-surface artifact identifies the user-facing controls.

Insufficient

A banner was detected without retained button or link labels.
Reject button was not observed because the scan was blocked, interrupted, or did not reach the consent surface.
Policy text, vendor name, CMP name, or visual impression alone without retained consent-surface evidence.
Claims about legal status, compliance status, deception, unfairness, consent validity, or dark-pattern status based only on automated UI evidence.

Evidence levels explain how CertScore treats retained consent-surface artifacts. They are not legal conclusions.

Common causes

CMP template includes accept and preferences controls but no first-layer reject control.
Reject is nested inside a preference center or secondary layer.
Region, language, or A/B test configuration changes the consent controls.
Button labels use ambiguous wording that may not clearly express refusal.
Returning-user state or prior cookies suppress the full consent choice surface.

Limitations and cautions

This finding is an automated consent UI review signal, not a legal conclusion, certification, compliance determination, or determination of consent validity.
Automated consent-surface checks can identify visible control and path-availability signals, but they may miss regional variants, A/B tests, localization, returning-user states, CMP configuration, post-login flows, blocked overlays, and user-triggered preference layers.
Automated evidence may not fully determine whether an equivalent refusal path exists or whether a path satisfies any legal standard.
Manual review is needed to confirm UI context, equivalent choice paths, accessibility, legal interpretation, user impact, and remediation quality.
CertScore retains representative evidence for review and may not list every variant across regions, viewports, languages, or CMP states.
Findings should be evaluated with implementation context and applicable privacy, consent, accessibility, and consumer-protection requirements before operational or legal reliance.
Automated findings may contain errors and should be reviewed with the retained evidence.
Not detected means not observed in the scan scope; it is not proof of absence.
Findings are runtime evidence and public-surface observations for review, not legal conclusions.

Reference notes

CertScore uses findings, evidence, signals, and observations consistently: signals are raw runtime or page-surface events, evidence is retained support, observations are interpreted evidence context, and findings are promoted review items.
Findings are runtime evidence and public-surface observations for review. Observed signals may surface possible concerns, but review is recommended before operational or legal reliance.
Finding reference content is reviewed periodically and updated when material guidance changes. CertScore monitors guidance families such as EDPB consent and ePrivacy materials, ICO cookie guidance, CNIL tracker recommendations, FTC privacy and dark-pattern materials, and relevant accessibility guidance where applicable.
EDPB consent guidance is relevant to consent quality and affirmative indication where consent is relied upon.
EU ePrivacy cookie/tracker principles are relevant to storing information or gaining access to information on user terminal equipment.
ICO cookie and similar technologies guidance is relevant to active consent, clear explanation, and essential-cookie exceptions.
CNIL cookie/tracker and analytics guidance is relevant to tracker consent and limited analytics exemptions.
FTC dark-pattern and commercial-surveillance materials may be relevant to hidden tracking or unclear user-choice review, but this finding does not determine deception, unfairness, or legal status.
Prevalence labels use the Tranco top 1-2500 calibration set, an approximately 2,505-scan directional calibration set.

Reject/refusal option not observed or nested