The Cookie Banner Is a Trap Door, and I Won't Frame One

I’ve framed a lot of rooms. Every one of them had a door. None of them had a door that only opened if you signed something first, and if you’re building a website in 2026 and your cookie banner works that way, you built a trap door and called it a foyer.

TL;DR: A cookie banner that hides the article until you consent is what Gruber named a dickover, and the legal cover for it is thinner than the plugin vendor implies. GDPR asks for affirmative consent before tracking and says nothing about walling off the content. A decent consent flow puts the banner at the bottom, defaults every non-essential toggle to off, and makes reject one click. There is also a bill nobody shows you: AI crawlers do not click accept, so the banner can eat your article before the bot ever reaches it.

There’s a word for this now. John Gruber coined it, Cory Doctorow ran with it in a recent Pluralistic post: a “dickover” is any modal, popover, or curtain a site throws up specifically to obscure its own content until you do something the site wants and you don’t. Cookie banners are the flagship example, but they’re not the only one. Paywalls that won’t let you scroll past the third paragraph. Newsletter signups that block the recipe until you hand over an email. Age gates on content that isn’t age-restricted anywhere else on earth. Same trap door, different bait.

I build sites for a living. I have to answer for every one of these when a client asks for it, so let’s talk about what’s actually going on under the floorboards.

Most GDPR compliance is malicious compliance

Because most of what gets sold as “GDPR compliance” is malicious compliance. The law says you need affirmative consent before you track someone. It does not say you get to hide the article behind a wall until they click yes. That’s a choice the site made, and it’s usually made by whoever bought the cheapest consent-management plugin and left every default switched on.

Doctorow’s post walks through Facebook’s version of this trick directly: claiming the surveillance is contractually required because the terms of service say so, then pointing at the contract as if it fell from the sky instead of being written by the company that benefits from it. That’s a business deciding the tracking is worth more than the visitor’s patience, then hiring a lawyer to make the decision sound inevitable.

I’ve built consent flows that don’t do this. You put the banner at the bottom of the screen, not over the headline. You default every non-essential toggle to off. You let “reject all” take exactly one click, same as “accept all.” Right now most banners bury the reject option three menus deep on purpose, and that asymmetry alone is enough to get a site fined in some jurisdictions once a regulator notices. None of this is hard. It’s slower to build than pasting in a script tag, which is the entire reason most sites don’t do it.

What can a visitor actually do about it right now?

More than most people think, and none of it requires becoming a systems administrator.

Firefox ships Global Privacy Control as a signal your browser sends automatically, telling every site “don’t sell or share my data” before the page even finishes loading. It’s supposed to carry the same legal weight as clicking “reject” manually. Some sites honor it. Some sites, per Doctorow’s post, detect the GPC signal and throw up a second dickover demanding you click through anyway, which tells you everything about how much good faith is actually in the room.

Beyond that: Reader Mode strips a page down to the article text and skips the modal entirely, and it’s built into Firefox for free (Ctrl+Alt+R, or force it on for every site via about:config if a particular publisher never plays along). Adblock Plus has a “Block Element” option in the right-click menu that lets you point at the exact overlay and make it disappear, permanently, for that domain. There are bookmarklets, Kill Sticky being the one Doctorow names, that do the same thing in one click without installing anything.

None of this is a hack in the illegal sense. It’s the browser doing what a browser is supposed to do: rendering the page the way the person in front of it wants it rendered. The site published it. The visitor gets to decide how they read it.

Why does this actually matter to a site owner, not just a visitor?

Because a dickover doesn’t just annoy the person on the other end. It costs you the search engines and the AI crawlers you’re trying to get indexed by.

GPTBot, PerplexityBot and ClaudeBot do not click “accept.” They see a wall, they see nothing behind it, and they either skip the page or index the six words of banner text instead of your actual content. If your AI visibility strategy is any good, it depends on the crawler reaching the words you wrote, not the consent dialog your plugin vendor wrote. I’ve watched sites tank their own indexing this way and then ask why they’re invisible to the tools everyone’s using to search now. The banner ate the article before the bot ever got a look at it.

There’s a compounding cost too. Every dickover that trains a visitor to reflexively click “accept all” without reading it is also training them to distrust the next site that asks honestly. You’re spending the web’s credibility along with your own.

Frequently asked questions

Is a cookie banner always a dickover?

No. A banner that sits quietly at the bottom of the screen, doesn’t block content, and gives reject and accept equal weight is just disclosure done properly. It becomes a dickover the moment it’s built to obscure the page until you comply, or when “reject” is buried behind extra clicks that “accept” doesn’t have to clear. The tell isn’t that a banner exists. It’s what the banner is engineered to make harder.

Does Global Privacy Control actually do anything, or is it symbolic?

It’s legally meaningful in California under the CCPA and treated as valid opt-out signal in a growing number of jurisdictions, which is more than symbolic. Whether a given site honors it is a separate question entirely, and Doctorow’s post is blunt about the sites that detect the signal and demand a second confirmation anyway. Sending the signal costs you nothing. Getting a site to respect it is still a fight in progress.

I don’t build trap doors. If a client asks for one, I’ll build the honest version instead and tell them why, and if that costs the sale, it costs the sale. A foyer that only opens one way isn’t a foyer. It’s a cell with better lighting, and I measure twice before I frame anything, especially the door.