Privacy

EU Strips the Cookie-Banner Fix: Consent Pop-ups Stay

European Union flag and policy documents on a negotiating table, wine-toned

The EU provision that was supposed to end the cookie-banner grind is gone from the Council’s text. In its June 18, 2026 position paper, the Council of the EU removed Article 88b, the measure that would have let users set consent preferences once at the browser or OS level and made per-site pop-ups redundant. So until further notice, banners stay exactly as they are.

If you followed the Digital Omnibus story earlier this year, this is a direct reversal of what was expected. The November 2025 Commission proposal contained Article 88b as a structural fix: browsers would carry a machine-readable consent signal, sites would read and honor it, and the per-site consent ceremony would fade out. For the background on what Articles 88a and 88b were meant to do, see inimino’s May explainer on the Digital Omnibus cookie proposals. Less than four weeks after that piece, the Council’s position dropped 88b entirely.

What happened in the Council

The Digital Omnibus is a Commission proposal, not yet law. It moves through three institutions: the Commission (which drafted it), the Council (member states), and the European Parliament. Each must agree before trilogue negotiations can conclude. The Council’s June 18 paper is a negotiating position, not a final text.

Getting to that position was not straightforward. EU ambassadors failed to reach agreement on June 8. A presidency compromise paper around June 10 had floated removing the cookie-consent articles together. By June 18, Article 88b was gone. A Council mandate vote is reported to be expected around June 26, after which the file moves to trilogue. The European Parliament has not yet taken a position on Article 88b, so the outcome is still open.

See also  Privacy-First Analytics Surge: 78% of Consumers Demand Ethical AI While Regulators Crack Down

Privacy advocacy group noyb is tracking the Council’s moves closely. According to noyb, member states Germany, France, and Poland pushed for the provision’s removal, which noyb characterizes as following pressure from the tracking lobby. The group also claims Google circulated a lobbying paper arguing advertising would suffer without banners. noyb calls cookie banners a “farce” responsible for “several billion clicks a year.” Max Schrems put it plainly: “Cookie banners are not an invention of data protection, but of the tracking industry.” These are noyb’s characterizations; the structural facts above (the Council’s position, the removal of 88b, the legislative timeline) are confirmed by independent legal analysis of the Digital Omnibus.

Did the EU get rid of cookie banners?

No. The Council removed Article 88b, the browser-signal measure that would have replaced per-site banners with a centralized consent preference, meaning consent pop-ups remain in place. The Digital Omnibus is still a proposal in negotiation, not law, and the European Parliament has not yet set its position on Article 88b, so the final text is not determined.

What this means for site owners now

The practical implication is simple: do not plan around banner relief from Brussels. The status quo persists, and the earliest this regulation could be in force is around late 2027, assuming it survives trilogue intact, which is now less certain on the consent provisions.

Article 88a, the part that would codify cookie rules inside the GDPR with a single-click refuse, an equal-prominence reject button, and a 6-month no-re-prompt cooldown, was also caught up in the Council’s June maneuvering. Whether any of the ePrivacy simplification survives into the final text depends on what Parliament brings to trilogue and what negotiators can agree on.

See also  Permanent TSB Hit With €277,500 GDPR Fine: Irish DPC Cites Contact-Centre Security and 72-Hour Notification Failures

The current consent regime, the ePrivacy Directive rules that have governed banners since before the GDPR, remains the operative framework. Good practice here has not changed: make the reject option as easy to reach as accept, honor refusals without re-prompting, keep your CMP configuration clean, and document your consent records. Those are the rules as they stand, and they will remain the rules whether the Digital Omnibus passes, stalls, or is stripped further.

The broader context is that browser-level consent is not a new idea. The third-party cookies that refused to die are part of the same story: every structural attempt to move consent or tracking controls to the infrastructure layer has run into industry resistance. Article 88b was the legislative version of that idea. For now, the Council’s position has shelved it.

Watch the mandate vote around June 26 and the Parliament’s subsequent position on the consent articles. If Parliament restores 88b in its text, it goes to trilogue and anything is possible. If both institutions land without it, the browser-signal fix is off the table for this legislative cycle.