CookiePolicyOptions - how to setup a "Reject" of the consent?

[n1ghtmare]

So I have enabled the cookie consent banner in my asp.net core project:

// ... Startup.cs

services.Configure<CookiePolicyOptions>(x => {
    // This lambda determines whether user consent for non-essential cookies is needed for a given request.
    x.CheckConsentNeeded = context => true;
    x.MinimumSameSitePolicy = SameSiteMode.None;
});

Then I have a partial view:

@using Microsoft.AspNetCore.Http.Features

@{
    var consentFeature = Context.Features.Get<ITrackingConsentFeature>();
    var showBanner = !consentFeature?.CanTrack ?? false;
    var cookieString = consentFeature?.CreateConsentCookie();
}

@if (showBanner) {
    <nav id="cookie-consent" class="container fixed inset-x-0 bottom-0 mx-auto border border-red-500" role="alert">
        <div class="p-4 m-6 bg-white border rounded shadow-md">
            <div class="navbar-text">
                Use this space to summarize your privacy and cookie use policy.
            </div>
            <div class="ml-3">
                <a asp-controller="Policy" asp-action="Privacy" class="btn btn-outline-info btn-sm"><i class="fa fa-question-circle"></i> Learn More</a>
                <button type="button" class="btn btn-dark btn-sm" data-cookie-string="@cookieString"><i class="fa fa-check-circle"></i> Accept</button>
            </div>
        </div>
    </nav>

    <script>
        (function () {
            document.querySelector("#cookie-consent button[data-cookie-string]").addEventListener("click", function (e) {
                document.cookie = e.target.dataset.cookieString;
                document.querySelector("#cookie-consent").classList.add("d-none");
            }, false);
        })();
    </script>
}

The cookieString has a value of .AspNet.Consent=yes (with other things appended). So when a user clicks on the Accept button a cookie with this value will be set.

Now my question is, how would I create a Reject button - I would like to identify that a user was prompted and he explicitly rejected the prompt. I'm looking for an "idiomatic" way to do this, I can think of several solutions that feel like hacks. Any suggestions.

[blowdart]

I honestly don't think we ever wrote anything for this, so there's nothing idomatic that I've seen.

[n1ghtmare]

Thanks for the reply. The reason I'm asking is, that what we have right now is not really GDPR compliant. To be GDPR (also check out the ePrivacy Directive) compliant a user needs to be given the choice to either Accept or Reject "non-essential" cookies used by the site. It should be an opt-in solution, no pre-checks etc.

Most sites that have the banner "we use cookies, here is more info -> 'Got it'", are not compliant. You can check out the "planet 49" ruling, for an example, here.

The way microsoft.com, or even github.com is doing it is the right way. Here is the github consent banner:

Anyway, I'll workout something on my own, but I'm just throwing this out there for your team to consider if you get the time for future releases. If the framework helps in this, it would save a lot of people a lot of time :)

Thanks for all the great work you guys are doing!