My son is at the beginning stages of learning geometry. He sits and recreates the missing half of shapes, carefully drawing each line to mirror the ones on the opposite side. Other times he looks at a shape and must decide whether both sides are identical…in other words, symmetrical.
Although I haven’t used symmetry in my daily life in quite some time, I found it quite interesting that right when my son was learning symmetry at school, I too got a lesson on symmetry at work. This past month I was reviewing a client’s cookie banner and symmetry made an appearance.
In the US, there is no single federal cookie law; instead, cookie banners are shaped by a patchwork of state privacy laws and regulations. Until now these regulations have used words like “dark patterns”. “Dark patterns” sounds so ominous, but this is the way that regulators in many US states describe banner designs that steer people toward saying “yes.” Consent obtained through a dark pattern is not valid. However, some state guidelines and regulations, such as in California, borrow a term straight from my son’s math homework, “symmetry,” and at the beginning of this year some of these guidelines and regulations sharpened the lines even further.
Showing the Work: What the Regulators Say
California’s 11 CCR § 7004(a)(2), “Symmetry in choice” regulation was updated, effective January 1, 2026. The rule itself is simple: the path to the more privacy-protective choice cannot be longer, harder, or more time-consuming than the path to the less protective one. The regulation then gives clear examples of choices that are not symmetrical: more steps to say “no” than to say “yes,” an “Accept All” button paired only with “More Information” or “Preferences” instead of “Decline All,” and a “yes” button that is more prominent than the “no” button, for example larger in size or in a more eye-catching color. The regulations have become more specific on what is compliant and what is not. Colorado’s privacy rules take the same approach, listing a larger “I accept” button or a greyed-out “I do not accept” button as examples of choices given unequal weight. In Connecticut’s Updated Enforcement Report (April 2025), the Attorney General put it plainly:
“To comply with the CTDPA, companies that utilize cookie banners that provide consumers with the option to accept all cookies, should also offer a symmetrical option to reject all cookies. Both options should be displayed on the screen at the same time, and in the same color, font, and size.“
Regulators are removing the wiggle room provided to companies in the past. The language is now so clear that it will be difficult to argue any counter stance before a regulator or in court.
Where Companies Lose Points
To date, no fine has been issued specifically because a “reject” button was the wrong size or color. That does not mean regulators have ignored symmetry. In March 2025, the California Privacy Protection Agency fined American Honda $632,500 in part because accepting cookies took one click while opting out took at least two, a violation of the symmetry rule. Honda was ordered to add a “Reject All” button alongside “Allow All.” In March 2026, PlayOn Sports agreed to pay $1.1 million after its banner pushed visitors to “agree” to tracking without an equal way to say no. Companies should also beware that the color and size requirements are relatively new. I believe more fines are coming. Regulators have gone to the effort of spelling out exactly what symmetry in choice looks like, down to the color, font, and size of a button, and that level of detail signals that they expect it to be followed.
Checking Your Answer: The Fold Test
Before your banner goes live, try the same test my son uses on his homework: fold it in half and see if both sides match.
- Is “Reject All” shown at the same time as “Accept All”?
- Does saying “no” take the same number of clicks as saying “yes”?
- Are both buttons the same size, color, font, and contrast?
- Is the wording neutral, such as “Accept All” and “Reject All” rather than “Yes” and “Ask me later”?
- Does closing the banner leave tracking off, rather than counting as consent?
- Is withdrawing consent as easy as giving it?
If the answer to any of these is “no”, your banner is not symmetrical and needs to be updated.
The Final Grade
Just as with my son’s first steps in geometry, symmetry in a cookie banner is not hard once you know where the lines are, and regulators have now drawn those lines clearly. Companies that take the time to fold their banners in half and check both sides will find that compliance is easily achieved, and their visitors will find a choice they can trust.
No comments