A single line of browser code could do what a decade of European privacy law has not: make the cookie banner disappear. That fix exists in draft form inside the EU’s Digital Omnibus, and this month a coalition of 19 civil society groups is fighting to keep it alive after Google’s lobbying helped strip it out.
The shift: consent moves from the page to the device
On September 10, 2026, a coalition of consumer groups, digital rights organizations and academics published an open letter asking EU lawmakers to restore Article 88b, a provision that would require browsers and operating systems to transmit a legally binding privacy signal automatically, on a user’s behalf, to every website and app they visit. If the signal says no, tracking stops, without a pop-up. If it says yes, per controller and per purpose, consent is already granted. Either way, the banner becomes optional rather than mandatory.
The European Commission proposed Article 88b in November 2025 as part of the wider Digital Omnibus package. The Council removed it from its negotiating text on June 18, 2026, following lobbying that the coalition’s letter attributes chiefly to Google, with Germany, France and Poland identified as the member states that pushed hardest for its removal. The provision has not been restored, and Parliament has not yet adopted its own position, which is why the letter is addressed jointly to the Irish Council presidency, two parliamentary co-rapporteurs and two European commissioners.
Ursula Pachl, Head of Policy at noyb, one of the letter’s organizers, framed the stakes plainly: “There is no valid justification to drop the Commission’s proposal for Article 88b and to uphold the current cookie banner disaster. This is a moment of truth for the EU to show what values it cares about and what are its priorities.”
Why the mechanism matters more than the politics
For a marketing organization, the interesting part of Article 88b is not who is lobbying whom. It is the technical shape of the fix. The coalition’s letter attaches a six-point annex specifying what the signal must do: meet the GDPR’s Article 4(11) consent standard, work per controller and per purpose rather than as a single blanket toggle, take precedence over any later on-page consent request, persist until the user changes it, and remain free of gatekeeper interference from browser and OS vendors such as Google. Two existing technical protocols, Advanced Data Protection Control (developed with the Vienna University of Economics) and navigator.consent, are cited as implementations already capable of carrying that level of granularity, distinct from the blunter Global Privacy Control signal that some U.S. states already treat as legally binding.
That granularity is the detail that determines whether Article 88b helps or hurts addressable advertising and first-party data collection. A signal that can only express refusal functions as a permanent opt-out, shrinking the pool of consented traffic in proportion to adoption. A signal capable of carrying affirmative, purpose-specific consent does the opposite: it could let a visitor grant permission once, at the device level, and have that permission recognized by every controller and purpose it was intended for, without a repeated interface fight. The coalition explicitly rejects the “kill switch” framing that opponents have applied to the article, arguing the mechanism was designed to carry both answers, not just no.
What it means for the marketing leader
Consent architecture built around page-level banners was already under strain before this letter. If Article 88b returns to the Digital Omnibus in anything close to its original form, every consent management platform, tag manager and CDP ingestion pipeline built around a banner click event will need a parallel path for a signal that arrives before the page renders, at the browser or OS layer, and that takes precedence over anything the interface later asks. That is a bigger integration lift than swapping one banner vendor for another; it changes where the authoritative record of consent lives.
The near-term uncertainty cuts against over-building for either outcome. The Council has already shown it will strip the provision under lobbying pressure, and the campaign’s own headline statistics, that current banners produce acceptance in up to 90% of visits while only a small minority of people actually want to be tracked, come from the coalition’s campaign materials rather than a cited, methodical study, which is itself a signal that the political fight is not yet settled on data either side can call definitive.
What marketing and data teams can do now is separate from that outcome: audit which consent decisions currently live only in banner click logs versus a portable, per-purpose consent record, since a device-level signal standard, whenever it lands, will reward whichever architecture already resembles per-purpose consent rather than a single accept-or-reject toggle. Regulators are already treating consent and disclosure as enforcement priorities elsewhere, and a data architecture that can answer “did this specific controller have permission for this specific purpose” will be the one that survives whichever version of Article 88b, if any, reaches the statute book.
What to watch next
The near-term signal to track is procedural: whether the Irish presidency reopens Council discussion on Article 88b and whether the Parliament’s two co-rapporteurs, MEPs Kaljurand and Salla, can broker a restored text from amendments already tabled in committee. Cláudio Teixeira, Head of Digital Policy at the European Consumer Organisation, put the underlying argument in terms marketers will recognize from their own simplification pitches: “Automated signals is the only proposal from the Commission’s Digital Omnibus aimed at actually simplifying the life of consumers. It is therefore extremely concerning to see that policy makers would consider dropping this proposal.”
Whether that argument survives contact with the Council a second time is an open question. What is not open is the direction of travel: consent infrastructure is moving toward the device and away from the page, in the U.S. through state-level signals and in Europe through this fight over Article 88b, and martech stacks built only for banner-based consent are building for a standard that is already being legislated around.
Source: noyb
