Fewer cookie banners? What the EU’s new cookie deal means for your website
By Viribus · · 5 min read
Last week EU governments agreed how they want to change the cookie rules. If the plan survives the talks with the European Parliament, many websites will be able to measure visits without asking first, and the banners that remain will have to take no for an answer. None of it is law yet, but it shows where the rules are heading, and the sites that are ready will need no work when it lands.
What was agreed on 21 October
The Council of the EU adopted its negotiating mandate on the Digital Omnibus, the package that simplifies the GDPR, the cookie rules and incident reporting. For cookies, three things stand out.
- Six purposes without consent. Transmitting a communication, a service the visitor explicitly asked for, first-party audience measurement, media audience measurement, technical security, and measuring how contextual ads display and perform.
- One click to refuse. Visitors must be able to say no with a single button, as easily as they say yes.
- A four-month pause. After a refusal, a site may not ask again for the same purpose for at least four months. The Commission had proposed six.
The Council also dropped the Commission’s idea of making websites respect automated consent signals from the browser, and kept the cookie rules in the ePrivacy Directive instead of moving them into the GDPR.
When it applies
Not yet. The European Parliament still has to adopt its own position; a committee vote is expected in early 2027. Then the two sides negotiate a final text, and member states get time to bring it into national law. Realistically, the new rules will not apply before 2027, and probably later.
Until then the current rules stand. In Belgium that means consent before any cookie that is not strictly necessary, analytics included, and a refuse option as visible as the accept button. The Data Protection Authority already expects that today.
What it means for a business website
Most small business sites set cookies for two reasons: to count visitors and to run marketing pixels. The first will likely be allowed without a banner, as long as the measurement is aggregated and serves the site itself. The second will not: behavioural advertising and social media pixels still need consent.
So the question to ask is not “which banner do we need?” but “what does this site really need to track?” A site that only counts visits may soon need no banner at all. A site full of third-party scripts will still need one, and it will have to accept a no for four months.
What to do now
- List every cookie, pixel and script on your site, and what each one is for.
- Remove what nobody looks at. Old pixels from a campaign three years ago still slow the site down and still need consent.
- Switch to cookieless, aggregated analytics where you can. It is allowed today without a banner when no personal data is stored, and it fits the new exemption.
- Put a clear refuse button on the first layer of your banner. It is expected now and will be required later.
- Make the re-ask period a setting in your consent tool, so moving from today’s practice to four months is a change of one number.
How we build sites
Our own site has no cookie banner, because it sets no cookies: we count visits with cookieless analytics and serve fonts and images from our own domain. We build client sites the same way by default, and add consent only for the tools a client really needs. That makes the site faster, keeps the first screen clean, and means a change like this one needs no rebuild.
Not sure what your current site loads? Book a free 30-minute call and we will go through it with you.
Sources
Free · 30 minutes