T1.1Interactive artifact · P1 · Agentic AI engineering

Dark patterns lab: cookie consent banners vs GDPR

Build a cookie consent banner from parts, switch on the dark patterns the industry actually ships, and see each one redlined on the banner and cited against the GDPR, the ePrivacy Directive and EDPB guidance.

Title blockT1.1
Type
Privacy tool
Drawn
Runs
In your browser, nothing to install
Tags
privacy · gdpr · interactive · developer-tool

Detail A · Reading the drawing

What it shows

Consent under the GDPR has to be freely given, specific, informed and unambiguous, and refusing has to be as easy as agreeing. Most cookie banners fail at least one of those tests by design: a hidden reject button, pre-ticked boxes, a cookie wall, or tags that fire before anyone clicks anything.

The lab models nine of those patterns on a working banner. Every switch changes the banner, the third-party requests it lets through, and a compliance score from A to F. Each violation gets a numbered redline mark on the drawing, matched to a finding that names the article, recital or ruling it breaks.

Detail B · Procedure

How to use it

  1. Start from a preset: privacy by design, industry standard, consent theater, or post-fine cleanup.
  2. Flip individual dark patterns and watch the banner, the network log and the grade change.
  3. Use the banner: accept, reject, or open manage settings. Then check which trackers actually fired.
  4. Hover a finding to find its redline mark on the banner.
  5. Copy the audit findings, or a prompt for Claude that rewrites the banner to comply.

Detail C · Glossary

Key concepts

Dark pattern
An interface designed to steer people into a choice they wouldn't otherwise make, such as a loud accept button next to a ghosted reject.
Valid consent (GDPR Art 4(11))
A freely given, specific, informed and unambiguous indication of wishes, given by a clear affirmative act.
ePrivacy Art 5(3)
The cookie rule: storing or reading anything on a device needs prior consent, unless it's strictly necessary for the service.
Planet49 (CJEU C-673/17)
The 2019 ruling that a pre-ticked checkbox is not valid consent.
Cookie wall
Blocking access to content until the visitor accepts tracking. EDPB guidance says consent given this way isn't freely given.

Detail D · Cited by

Related writing

Posts that use this drawing as a worked example.

  • D1.3
    Building agentic workflows with Claude Code

    An LLM can do almost anything once. Getting it to do the right thing every time is an engineering problem. Here's the architecture I use, drawn from a skill that audits websites for GDPR end to end.

All artifacts →