Everyone hates cookie banners. Europe is divided over the solution

The Commission's proposal works on two fronts. A new Article 88a of the GDPR would broaden some exceptions to consent for access to information stored on a user's device, including certain forms of audience measurement. Article 88b would allow some preferences to be expressed through automated, machine-readable signals: a browser or operating system could tell sites what the user has chosen instead of asking the same question every time.

Consent would remain the general rule, but it would be requested less often and a response could persist. The exceptions are the part with the most immediate consequences for advertising.

On 11 February 2026 the EDPB and EDPS published their Joint Opinion on the Digital Omnibus. They support the goal of reducing consent fatigue and welcome limited derogations. But they draw a narrow line around audience measurement: it should produce aggregated and anonymous information about use of a service, without combining it with data from other services, reusing it for other purposes or sharing it with third parties.

They also invite legislators to consider a new exception for contextual advertising. It is more privacy-friendly than behavioural advertising when it depends only on the page being viewed or the search being made at that moment, without storing or linking past and future activity.

They recognise that a contextual campaign still has to be operated and measured. Frequency capping, advertising audience measurement and click-fraud prevention may require trackers and could be included in cases that do not require consent, if the exception is tightly drawn.

The EPP, and Aura Salla in particular, support a more risk-based approach: remove unnecessary banners, increase legal certainty and make it easier for European businesses to use data without abandoning fundamental safeguards. Salla also repeats a second argument: badly designed regulation can strengthen the large US platforms Europe wants to make less dominant.

The ECR is even more explicit about proportionality. Diego Solier has cited audience measurement, advertising, cybersecurity updates and fraud prevention as cases where relatively low-intrusion activity should not be treated like behavioural tracking.

S&D begins from a different concern. Marina Kaljurand also supports risk-based application of the GDPR, but argues that the Digital Omnibus must not weaken core definitions and protections, beginning with the definition of personal data. The point is to simplify without creating exceptions that can reclassify invasive activity as harmless.

Renew takes a middle position. Michael McNamara has called for genuine simplification while retaining safeguards for fundamental rights, with the emphasis on a technically workable compromise.

Greens/EFA and The Left are much more suspicious of the exercise. The Greens warn that reopening GDPR and ePrivacy could become a gift to large platforms and call for stronger enforcement of existing rules. Markéta Gregorová still supports finding a real way to remove cookie banners as they work today. The Left sees the proposal as a possible retreat from consumer and data protection.

There is no single cookie position even among conservative or nationalist groups. Patriots for Europe, for example, has focused more on pseudonymisation and legal certainty than on a particular consent architecture. Calling the story simply left versus right misses too much.

Outside Parliament the conflict is clearer. IAB Europe accepts the Commission's aim but says the Article 88a exceptions are too narrow. Continuing to ask consent for low-risk operational activity, it argues, will not remove consent fatigue. At the same time, IAB opposes browser-centred consent because it could damage the ad-funded content ecosystem and increase the power of large technology intermediaries.

Alliance Digitale, the French marketing and data association, reaches a similar conclusion. It sees the Article 88b centralised mechanism as a risk to proportionality, competition and technological neutrality, and instead calls for exceptions for low-risk activities including contextual advertising, frequency capping, anti-fraud and aggregated analytics.

EuroCommerce makes a similar case: more risk-based exceptions for low-risk processing and more recognition for privacy-enhancing technologies, but no general obligation to manage preferences through the browser and no rigid six-month ban on asking again. Its stated concern is the emergence of new gatekeepers.

If a user's preference is expressed mainly through Chrome or Safari, Google and Apple stop being only browser makers. They become part of the infrastructure through which a legal right is exercised. The Commission sees a way to end cookie fatigue; part of the industry sees power moving from publishers to two of the world's largest companies.

BEUC, which represents European consumer organisations, sees the same architecture from the other side. It cautiously welcomes browser signals because they could make consent easier to exercise, but wants consent to remain the baseline and the exceptions defined much more precisely. It also supports a specific treatment for contextual advertising, provided it does not become a shortcut to profiling.

EDRi pushes the criticism further. Cookie fatigue, it argues, does not mainly come from banners but from an economic model built on tracking, manipulative interfaces and weak enforcement. Removing the symptom without changing those incentives could make tracking less visible.

The Commission has offered an apparently simple answer to a problem on which there is broad agreement. In doing so, it has opened at least three separate conflicts.

The Council has shown how hard it is to hold those questions together. A Presidency compromise text of 17 April included a new exception for contextual advertising, in the direction suggested by the EDPB and EDPS. In June, however, Member States removed several of the main cookie-banner simplification provisions from the compromise, effectively postponing the issue.

The process in Parliament is still open. Salla and Kaljurand's draft report arrived in June; more than a thousand amendments were tabled in July; the next step is to negotiate compromise amendments before the committee vote. On 31 August, the official 2025/0360(COD) file was still listed as “Awaiting committee decision”.

For advertising, the result could matter far more than the disappearance of a few banners. A more favourable legal treatment for contextual advertising would make ads based on the page, rather than an individual's history, more economically attractive. Clear exceptions for audience measurement, frequency capping and anti-fraud could separate operational advertising functions from behavioural profiling.

Strong browser signals could sharply reduce the number of people available for some forms of tracking while increasing the power of browsers and operating systems. Publishers and retailers would have an even stronger incentive to develop first-party data and direct relationships with users.

There is also a measurement question worth watching without attributing conclusions to the legislator that it has not drawn. The Digital Omnibus does not propose new marketing-effectiveness models or tell companies to replace attribution with incrementality or marketing mix modelling. It does introduce an important regulatory distinction: not every activity needed to measure a campaign requires reconstructing a person's behaviour across services.

Digital advertising has had little reason to make that distinction while the same technical infrastructure could handle targeting, tracking, attribution and measurement. It may now have to.

No one in this debate really wants to preserve cookie banners. The EDPB and EDPS want proportion between risk and processing; the ad industry wants to fund and measure advertising and content; publishers want a direct relationship with their audience; consumers want real control; Greens and digital-rights organisations want existing protections kept intact; EPP and ECR want competitiveness and room for European businesses to use data; S&D and Renew want simplification without new escape routes.

The question behind the banner is who gets to observe what we do next, for what purpose and at what level of detail.

• European Commission — Digital Omnibus proposal
• European Parliament — file 2025/0360(COD)
• EDPB and EDPS — Joint Opinion (11 February 2026)
• Council of the EU — Presidency compromise text (17 April 2026)
• IAB Europe — position paper
• Alliance Digitale — position paper
• EuroCommerce — position paper
• BEUC — protecting EU data and privacy rights
• EDRi — The Digital Omnibus and ePrivacy