If you’ve ever felt irritated by a website nagging you to “accept cookies” before showing you content, you’re not alone. The European Union is now considering scrapping the very rule that unleashed this deluge of pop-ups across the internet. In a move to cut red tape, the European Commission is targeting one of its most visible—and arguably most unpopular—laws: the 2009 update to the e-Privacy Directive, which mandated consent banners for website cookies.
How Did We Get Here?
Cookies are small pieces of data stored on a user’s device that allow websites to remember who you are and what you’re doing. They power essential functions, like keeping items in your shopping cart or making sure you stay logged in. They also underpin targeted advertising, allowing companies to track browsing habits across sites.
Back in 2009, EU lawmakers updated the e-Privacy Directive to require websites to get user consent before storing cookies—unless those cookies were “strictly necessary” to deliver a service. At the time, the goal was to empower consumers and strengthen privacy online. But the outcome has been a digital ecosystem where users are trained to blindly click “Accept” without reading the fine print.
As Peter Craddock, a data lawyer at Keller and Heckman, explains: “Too much consent basically kills consent. People are used to giving consent for everything, so they might stop reading things in as much detail, and if consent is the default for everything, it’s no longer perceived in the same way by users.”
Brussels’ Deregulation Drive
Fast-forward to 2025, and cookie banners have become the face of over-regulation for many Europeans. Commission President Ursula von der Leyen has made deregulation a priority, and the cookie consent regime is squarely in her crosshairs.
On Monday, Commission officials met with tech industry representatives to discuss reforms. According to a note circulated ahead of a September 15 focus group, Brussels is exploring ways to streamline consent:
- One-time settings: Users could decide on cookie preferences once, perhaps via their browser, instead of being asked repeatedly on every site.
- More exceptions: Certain types of cookies—those used for technical functions or simple statistics—could be exempted from consent banners.
Member states like Denmark have floated similar ideas, arguing that “harmless” cookies shouldn’t require the same heavy compliance as those used for marketing or data sharing.
The Commission is expected to bundle these reforms into an “omnibus” legislative package by December. But cookie rules are just the start: a broader battle looms with the upcoming Digital Fairness Act, an advertising-focused law planned for next year.
Industry Push for GDPR Integration
One proposal gaining traction is to fold cookie regulation into the EU’s flagship privacy law, the General Data Protection Regulation (GDPR). Unlike the rigid consent requirements of the e-Privacy Directive, the GDPR allows companies to take a risk-based approach, adjusting safeguards based on how sensitive or risky the data processing is.
Franck Thomas, policy director at advertisers’ lobby IAB Europe, argues that the e-Privacy Directive is too inflexible. By aligning cookie rules with the GDPR, companies could rely on legal bases beyond consent, such as “legitimate interest.”
Still, Thomas insists that simplification doesn’t mean abandoning privacy: “Our call for simplification should not be confused with a light-touch approach on data protection, but everyone agrees we need to maintain this balance between safeguarding privacy rights and preserving the competitiveness of the European tech industry.”
Privacy Advocates Push Back
Not everyone is convinced. Civil society groups warn that tweaking cookie rules could weaken privacy protections and entrench the dominance of surveillance advertising.
“Focusing on cookies is like rearranging deckchairs on the Titanic, the ship being surveillance advertising,” said Itxaso Domínguez de Olazábal, a policy adviser at European Digital Rights. She points out that current law already exempts cookies necessary for user-expected services, like shopping carts. Expanding that category risks blurring the line between functionality and adtech.
From this perspective, the problem isn’t the banners themselves but the broader reliance on invasive advertising models. Diluting consent rules could further normalize pervasive tracking.
The Politics of Privacy in Brussels
Privacy debates have long been some of the fiercest in EU policymaking. The 2017 proposal for an e-Privacy Regulation, intended to modernize the rules, was ultimately shelved in February after years of deadlock. That failure was chalked up as a win for von der Leyen’s deregulation agenda, but it also underscored just how contentious cookie law is.
The latest attempt to revisit the rules is setting up another showdown: industry groups lobbying for flexibility versus privacy advocates pushing to protect hard-won safeguards. With the Digital Fairness Act on the horizon, the fight is likely to intensify in 2026.
For ordinary Europeans, the Commission’s reforms may seem like a welcome reprieve from annoying pop-ups. Allowing people to set preferences once, rather than dozens of times a day, could streamline the online experience.
But beneath the surface lies a deeper policy struggle: should Europe double down on protecting user privacy, even at the cost of friction and compliance burdens, or relax rules to boost competitiveness and innovation?
The answer will shape not only the future of cookie banners but also the balance of power between regulators, industry, and civil society in Europe’s digital economy.
What Comes Next
By December, the Commission plans to table its omnibus deregulation package. Expect fierce lobbying from both sides in the months ahead. And with the Digital Fairness Act set to follow, the debate over cookies may just be the opening act in a much larger clash over online advertising and consumer rights.
One thing is certain: the days of clicking away cookie banners without a second thought may soon come to an end—not because users finally engage with them, but because Brussels may decide to sweep them off the screen altogether.
