{
  "id": "DPE-2026-0003",
  "name": "No refusal option",
  "family": "consent",
  "summary": "The consent dialogue offers acceptance and no way to refuse.",
  "mechanism": {
    "what": "The banner presents an accept control, and refusing requires either leaving the site or navigating a path that does not lead to a working refusal.",
    "why_it_matters": "A choice with one option is not a choice. Consent must be freely given, and it is not free if the only way out is to leave.",
    "common_causes": [
      "banner template with a single call to action",
      "refusal hidden behind a settings layer that does not save",
      "closing the banner counted as acceptance"
    ],
    "not_this": "If a refusal option exists but does nothing, that is Refusal without effect. Here the option is absent."
  },
  "detection": {
    "indicator": "No refusal affordance in the banner DOM: no control whose action registers a negative consent state, at any layer reachable from the first screen.",
    "method": "static-source",
    "qod": 60,
    "capture_requirements": [
      "inspect every layer of the dialogue, not only the first screen",
      "dismissing by clicking away is not a refusal; check what state it writes"
    ],
    "attribution": [
      "cdp-initiator"
    ]
  },
  "falsifiers": [
    {
      "condition": "A refusal exists on a second layer of the dialogue.",
      "checkable": "manual",
      "if_true": "drop"
    },
    {
      "condition": "The site sets no consent-bound technology at all, so no refusal is required.",
      "checkable": "automated",
      "if_true": "drop"
    }
  ],
  "reproduction": {
    "methods": [
      {
        "tier": "manual",
        "path": "METHOD.md",
        "expect": "no dedicated reproduction exists yet; follow the general method and the indicator above"
      },
      {
        "tier": "script",
        "path": "repro/web/check.mjs",
        "expect": "the run reports DPE-2026-0003 as present, with the detail behind it"
      }
    ],
    "public_scanners": [
      "urlscan.io"
    ]
  },
  "legal": {
    "provisions": [
      "eu-gdpr-6-1-a"
    ],
    "caselaw": [
      "cjeu-planet49"
    ],
    "rebuttals": [
      {
        "objection": "Visitors can refuse in their browser settings.",
        "answer": "Consent is sought by the controller and must be refusable where it is sought. Delegating that to the browser does not discharge it."
      }
    ]
  },
  "related": [
    "DPE-2026-0002"
  ],
  "seen_in_the_wild": {
    "confirmed": false,
    "note": "Observed in practice by the authors but not yet backed by a published reference. Set to false until a citation exists: a claim without a source is exactly what this catalogue holds others to."
  },
  "schema_version": "2.0",
  "applies_to": [
    "web"
  ],
  "status": "active",
  "credit": [
    {
      "name": "Mick Beer",
      "role": "proposed",
      "date": "2026-07-26"
    }
  ],
  "does_not_establish": [
    "harm; the catalogue standardises a finding so it can be referred to, it does not weigh it",
    "severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case",
    "unlawfulness; that is for a supervisory authority or a court",
    "intent; a fault is usually a build decision, not a plan",
    "absence: not finding it in one capture is not evidence that it is not there"
  ],
  "changes": [
    {
      "at": "2026-07-26T00:00:00Z",
      "actor": "registry",
      "entries": [
        "Entry created.",
        "Name assigned.",
        "Detection method and falsifiers defined.",
        "Legal provisions linked."
      ]
    }
  ],
  "slug": "no-refusal-option",
  "name_nl": "Geen weigeroptie",
  "summary_nl": "De toestemmingsdialoog biedt accepteren en geen manier om te weigeren.",
  "in_practice": {
    "dpia": "Verify that a refusal control exists and writes a negative state, rather than that a banner is present.",
    "procurement": "The consent dialogue offers refusal at the same level as acceptance, verifiable from the first screen.",
    "complaint": "A screenshot of every layer of the dialogue and the consent state written by each control.",
    "audit_question": "Where in the banner does someone say no, and what does that store?",
    "audit_question_nl": "Waar in de banner zegt iemand nee, en wat slaat die knop op?",
    "complaint_nl": "Een opname of uitdraai die laat zien wat er werkelijk gebeurt, met de datum erbij en het land van waaruit is gemeten.",
    "objection_nl": "Wie niet wil, kan het in zijn browser uitzetten.",
    "answer_nl": "Toestemming wordt door u gevraagd en moet dus bij u geweigerd kunnen worden."
  }
}