Key takeaways
- Article 88b of the Digital Omnibus would allow consent to be expressed through an automated browser signal, valid across every website.
- The Council of the EU removed it from the text on 18 June 2026, with Germany, France and Poland named by noyb as the countries pushing for removal.
- Nineteen organisations, including Spain’s CECU, want it back with six conditions, among them that refusal takes precedence and persists.
- If it goes ahead, the proposed timescales are two years for websites and four for browsers and operating systems.
What is happening with the cookie banner?
The cookie banner is the notice asking permission to set non-essential cookies. On 19 November 2025 the European Commission proposed a package called the Digital Omnibus, reference COM(2025) 837. It included a way to replace the banner: express the decision once, from the browser, and have websites respect it.
That route was Article 88b. The Council of the EU dropped it from the text on 18 June 2026. In September, a coalition of nineteen organisations published a letter asking for its return.
What the nineteen organisations are asking for
They are not asking simply for the article back, but for the article back with conditions. There are six, and the differences between them matter to anyone running a website:
- That the signal meets the GDPR standard of consent, with granularity by controller and by purpose.
- That any access to data respects valid signals, with refusal taking precedence.
- That no dominant company controls the infrastructure carrying those signals.
- That their legal meaning is set in EU law rather than in delegated technical standards.
- That refusal persists, without repeated prompts or degraded service for saying no.
- That signals reach their destination without interference from gatekeepers.
The fifth condition is the one that changes daily life for a user. Today a refusal lasts until a technical cookie expires and the question returns.
Who signed, and who pushed back
The letter is led by the European Consumer Organisation, Check My Ads, the Civil Liberties Union for Europe, European Digital Rights, the Electronic Frontier Foundation, Enforce, noyb and Stichting Data Bescherming Nederland. Among the supporting signatories is CECU, the Spanish consumer federation.
On the other side, trade publication PPC Land reports that Google played a central role in lobbying against the article. The interest is specific. As a browser vendor, European rules on automated privacy signals would limit its control over that data. noyb identified Germany, France and Poland as the countries that drove the removal. In May 2026 the French industry body Alliance Digitale had called for deleting it outright.
The figures in the debate, and which ones hold
The coalition leans on two numbers. Current banners produce around 90% acceptance, while only 3% of people actually want to be tracked. That gap is precisely their argument: the banner measures fatigue more than intent.
Two other figures deserve more caution. The claim of «hundreds of millions of hours» saved each year circulates without published methodology. And the €40–50 billion of revenue supposedly at risk is an estimate going around Brussels with no identifiable source. They appear here because they will be quoted, not because they stand up.
What should your website do meanwhile?
Nothing urgent, and that is information too. If the article returned and passed, the proposed timescales are two years for websites and four for browsers and operating systems. No new obligation arrives this year.
What does make sense is not building on sand. Measurement that depends entirely on consent runs out of data the day refusal becomes easy and permanent. The reasonable response is reducing that dependency: server-side measurement, first-party data and analytics that work without cookies. It is the work we do in analytics and CRO, and on this site the visit measurement uses no cookies at all.
The real issue: who controls the signal
The third condition, banning a dominant company from controlling the signal infrastructure, looks technical and is the most political of the six. Whoever controls the browser controls how billions of people express consent.
For an advertiser that becomes a practical question over the medium term: how much of your measurement depends on decisions somebody else makes. The more first-party signals you hold, from CRM to server conversions to store data, the less the outcome matters. It is the reasoning behind offline conversions.
Where to start
The useful exercise today is working out how much of what you measure would collapse if refusal became universal and permanent. That number comes from checking what share of your conversions depends on the browser alone. Above 80%, you have a business risk rather than a legal matter. With that figure on the table, decisions about server-side measurement take themselves, much as they do with a GTM implementation.
Frequently asked questions
Is the cookie banner disappearing in 2026?
No. The article that would allow it was removed from the text in June 2026, and nineteen organisations are now asking for it back. Even if it returned and passed, the proposed timescale is two years for websites.
What is Article 88b?
The Digital Omnibus provision that would let consent be expressed through an automated browser signal, valid across every website. It would remove the need to answer a notice on each site separately.
Why did Google push back?
According to PPC Land, because of its position as a browser vendor. European rules on automated privacy signals would limit its control over how those permissions are expressed and transmitted.
Does my website need changing now?
No new obligation takes effect this year. The prudent move is reducing how much your measurement depends on consent, through first-party data and server-side measurement, which is useful work in any scenario.
