What to actually click on a cookie banner

You see a hundred of these a week and click whatever makes them go away. That is the design.

Here is the two-line version: click Reject All. If you cannot see it, look harder, because it is usually there and legally it is supposed to be as easy as accepting.

What is actually being asked

Not all cookies need consent. The ones that keep you signed in or remember your basket are necessary and do not need to ask.

The banner exists for the others: advertising and analytics cookies, and the "legitimate interest" section behind the settings link, which is often a list of several hundred advertising companies.

What you are consenting to is your browsing being shared with those companies, to be joined up with everything else they know about you.

Why Reject All is hidden

Because compliance and revenue point in opposite directions.

UK and EU rules say refusing should be as easy as accepting. Many banners comply in the letter — a Reject All button exists — and undermine it in practice: grey on grey, below the fold, behind "Manage preferences", or labelled something vague like "Continue without accepting".

The Information Commissioner's Office has been clear that this is not good enough, which is why the button has been appearing on more sites over the last couple of years.

The practical approach

Reject All, every time. One click, and you lose essentially nothing — sites work the same, you stay signed in, your basket survives.

If there is no Reject All, click "Manage preferences" and turn everything off. There is usually a "reject all" or "legitimate interests: object to all" inside. It is two extra clicks.

Do not click "Accept All" because you are in a hurry. That is precisely what the design is buying.

Stop seeing them, mostly

• A content blocker. uBlock Origin blocks most banners and, more importantly, blocks the trackers

behind them so the answer stops mattering.

• Consent-o-Matic, a free browser extension from a university research group, which fills the

banners in for you with everything refused.

• Some browsers now handle it. Brave and Firefox refuse or hide a lot of them by default.

The deeper point: rejecting cookies is a small lever. The bigger one is blocking the trackers so there is nothing to consent to. There is more in how websites follow you around.

What rejecting does not do

It does not stop fingerprinting, which needs no cookie and no consent banner. It does not stop the site itself knowing what you did on it. It does not apply to apps, which have their own permissions.

It reduces one category of tracking. Worth doing, one click, and not the whole picture.