Does a cookie banner need a "Reject all" button?
Not by that name, but in the DIFC the choice to refuse cannot be played down. Regulation 9 gives visitors a chance to refuse the first time data is collected for analytics or advertising, and requires clear, colour-neutral buttons that neither promote nor discourage any setting. Pre-ticked boxes, silence and inactivity are not consent.
The Commissioner has applied this to a real banner. Decision Notice 1/2024, issued to Careem Group under Regulation 9, criticised its cookies banner for lacking colour-neutral buttons. In our reading, a bright Accept button beside a faint Reject link is the pattern Regulation 9.2.3(a) rules out.
Defaults must collect no more than the minimum, and an easily accessible means, such as a preferences link, must let the visitor change their choice later (Regulation 9.2.3). Withdrawing consent must be as easy as giving it (Article 12).
Read the full DIFC Data Protection Law guideHow Arqam360 handles this
Arqam360's banner asks for consent by category, with a Reject all choice beside Accept all, and sends Google Consent Mode v2 signals so Google tags know what the visitor allowed. After the first choice, a small badge stays on the page so visitors can reopen their settings and change or withdraw consent.
See how it worksSources
- 1.DIFC Data Protection Law, DIFC Law No. 5 of 2020 (consolidated July 2025, DIFC)
- 2.DIFC Data Protection Regulations, consolidated version No. 2, in force 1 September 2023 (Regulation 9)
- 3.Commissioner of Data Protection — supervision, enforcement and decision notices (DIFC)
Last reviewed . Not legal advice.