Fact vs. myth · as at 25 July 2026

Will cookie banners disappear because the browser will handle it?

You hear it more and more in meetings: the Omnibus reform will abolish banners, Google will handle it in Chrome, cookies are obsolete anyway. We checked all three claims against primary documents. The reform is real — but the conclusion is the opposite of what is claimed. Below is every claim with a date and a link to its source.

3 claims 16 sources Verified 25 July 2026

Summary

1. “The Digital Omnibus will abolish cookie banners.” On 18 June 2026 the Council deleted the very provision that would have replaced them →

False

2. “Google will solve it in the browser.” Privacy Sandbox was switched off in October 2025 and Google lobbied to keep banners →

False

3. “Cookies are obsolete, new technology is coming.” Technically true, legally irrelevant — the law never spoke about cookies →

Misleading

The reform is real and does change things. Stricter refusal, a six-month pause, a narrow measurement exemption →

Confirmed

“The Omnibus reform is under way and banners will be gone”

“The Omnibus is under way, cookie banners will be gone, because browsers will handle it.”
— the wording you hear in meetings with agencies

False The reform exists. Abolishing banners has dropped out of it.

The Digital Omnibus is a real proposal. The Commission tabled it on 19 November 20251 and it moves the cookie rules out of the ePrivacy Directive straight into the GDPR — as new Articles 88a and 88b16. So far the agency is right.

The difference lies in what those two articles do. Only Article 88b would have replaced banners — it would have made the browser signal legally binding on controllers. Article 88a does not abolish banners at all; it tightens the rules for them.

And it is precisely Article 88b that the Council deleted in full in its position of 18 June 20265 6. According to noyb and the trade press, after lobbying by the advertising industry; the deletion was supported by Germany, France and Poland among others7.

11. 2. 2025 The Commission withdraws the ePrivacy Regulation proposal after eight years of deadlock in the Council. The route via a separate regulation ends.9
19. 11. 2025 The Commission tables the Digital Omnibus — cookies move into the GDPR as Articles 88a and 88b.1
10. 2. 2026 The EDPB and EDPS issue Joint Opinion 2/2026: they welcome the six-month pause after a refusal, but recommend also setting a maximum validity period for the consent itself.3 4
18. 6. 2026 The Council deletes Article 88b — the only provision that would have replaced banners with an automated signal.5 6
today Parliament has not taken a position on Article 88b; trilogues are under way. The final text is expected in late 2026 / early 2027; Article 88a would apply only six months after entry into force.2 8

What follows from this

Even if Article 88b miraculously survived the trilogues, we are talking about an obligation that would take effect in 2028 at the earliest — the proposal gave it 24 months to be implemented. Until then the current rules apply without any change. Postponing compliance by pointing to the Omnibus means spending two years in breach of the law that applies today.

“Google will solve it in the browser”

“There is no need to deal with banners, Google will solve it in the browser anyway — Chrome will do it by itself.”
— the most common version of the myth among IT companies

False Google is doing the exact opposite — in the product and in Brussels.

Privacy Sandbox is dead. In April 2025 Google scrapped the plan to introduce a third-party cookie prompt in Chrome and kept the existing settings. In October 2025 it retired the remaining Privacy Sandbox APIs — Topics, Protected Audience and Attribution Reporting — citing low adoption12 13. Only a handful of smaller pieces such as CHIPS survived.

Third-party cookies remain in Chrome, with no removal date whatsoever13. Seven years of talk about a “cookieless” future ended with nothing changing at all.

And the point worth saying out loud: Google was among the main lobbyists for removing the browser signal from the legislation6 7. The claim that “Google will solve it in the browser” is the opposite of what Google is doing.

A counter-argument when someone objects “then national law will solve it”

Germany already has such a regime in law. The Einwilligungsverwaltungsverordnung has applied since 1 April 202515 and is exactly the “a recognised service manages consent instead of a banner” model. After more than a year there is a single recognised service — Consenter, recognised on 17 October 202514. Real-world coverage of websites is negligible. Even where the option legally exists, banners do not disappear.

“Cookies are obsolete, new technology is coming”

“New technology is emerging, cookies are obsolete — we will move to server-side and the banner will go away.”
— the technical version of the myth

Misleading Technically true. Legally without any effect whatsoever.

The law never spoke about cookies. Article 5(3) of the ePrivacy Directive speaks about storing information on terminal equipment and gaining access to information stored there. The word “cookie” does not appear in that provision. It is technology-neutral — deliberately so.

The EDPB confirmed this by name. Guidelines 2/2023 on the technical scope of Article 5(3), adopted in their final version on 16 October 2024, expressly bring tracking pixels, tracked URLs, local storage, device fingerprinting and server-side setups within that provision11. If client-side code sends anything from the device to a server, that is “gaining of access” according to the EDPB.

Moving to server-side GTM, first-party identifiers or fingerprinting therefore does not remove the consent obligation — it merely makes it less visible. From a regulator's point of view that is an aggravating factor, not a mitigating one: it means the tracking continued and is simply harder to prove.

In practice

Migrating to a “cookieless” solution is a technical project with no legal effect. If the banner disappears afterwards, the site is not more modern — it is non-compliant and harder to audit as well. The check is simple: is anything read from or written to the device before consent?

Evidence

Timeline: what actually happened

The chronology matters here, because it is the argument. Every step over the past two years led away from “banners will disappear”, not towards it. The points that refute the myth directly are highlighted.

16 October 2024

The EDPB adopts Guidelines 2/2023 on the technical scope of Article 5(3)

Pixels, URL tracking, local storage, fingerprinting and server-side setups fall under the same rule as cookies.11
11 February 2025

The Commission withdraws the ePrivacy Regulation proposal

After eight years of deadlock in the Council. The reform moves elsewhere.9
1 April 2025

The Einwilligungsverwaltungsverordnung enters into force in Germany

A legal framework for recognised consent management services — the “instead of a banner” model.15
April 2025

Google scraps the third-party cookie prompt planned for Chrome

Third-party cookies stay, with no removal date.13
October 2025

Google retires the remaining Privacy Sandbox APIs

Topics, Protected Audience, Attribution Reporting — reason: low adoption.12
17 October 2025

The first service recognised under the German EinwV: Consenter

More than six months after the rules took effect. Still the only one.14
19 November 2025

The Commission tables the Digital Omnibus

Cookies move into the GDPR as Article 88a (consent rules) and 88b (browser signal).1
10 February 2026

The EDPB and EDPS issue Joint Opinion 2/2026

They support simplification but warn against lowering the level of protection and creating legal uncertainty.3
18 June 2026

The Council deletes Article 88b from the proposal

The only provision that would have replaced banners with an automated signal is gone. Article 88a remains in the text.5 6
2026 – 2027

Trilogues, final text, then six months to prepare

Until it enters into force, the current obligations apply unchanged.2

In fairness

What the Omnibus actually changes

Confirmed The reform does change things — in the opposite direction to what is claimed.

To be fair: Article 88a as currently drafted is not cosmetic. According to the proposal and its analysis in the EDPB/EDPS Joint Opinion3 it brings:

Article 88a(4) Refusal in a single click — in an easy and intelligible manner, with a single-click button or equivalent means.8
Article 88a(4) A ban on asking again for six months after a refusal, unless the processing changes materially. The EDPB welcomes this and recommends adding a maximum validity period for consent given.3
Article 88a(3) Exemptions from consent for transmitting a communication, a service explicitly requested by the user, the security of the service or the terminal, and aggregated audience measurement.3
measurement The measurement exemption is narrow: first-party only, carried out by the operator of its own service and solely for its own internal use, with no sharing with third parties.3 10

Watch out for the measurement exemption

This is the part marketers will seize on first. But the criterion reads “solely for its own internal use, without sharing with third parties” — and GA4 in a standard deployment sends data to Google, which also uses it for its own purposes. On the literal wording of the proposed provision, a standard GA4 deployment would not fall within the exemption. (This is our reading of the draft text, not settled interpretation — the proposal is not law yet and there is no case law on it.)

In short: the Omnibus is not the end of the CMP, it is its specification. One-click refusal, a six-month pause, granularity and a demonstrable record of consent — all of that has to be delivered and logged by something. A site that lacks this today will have a bigger problem after the reform, not a smaller one.

Impact

What this means for you

If you run a website

The obligations have not changed and will not change for the next two years. A supervisory authority assesses the position at the time of the inspection, not planned legislation.

Postponing on the strength of the Omnibus is a decision to be non-compliant — knowingly, and with a written trail in the meeting minutes.

If you are an agency

Advising that “there is no need to deal with it, the Omnibus is coming” is professional advice that exposes the client to a fine. And the liability sits with the operator of the website — that is, the client.

What is more, the tightening under Article 88a means more work, not less. Anyone whose banner is in order today will meet the reform without lifting a finger.

If you are considering server-side

It is a legitimate technical step — but not a legal one. Consent is still required; it just becomes harder to demonstrate and harder to audit.

The check question is always the same: is anything read from or written to the visitor's device before they consent?

Documented

Resources

The label primary means a document from the institution that decides or issues the matter. The rest are professional analyses and news reporting.

European Commission — Digital Omnibus Regulation Proposal Primary19. 11. 2025 · digital-strategy.ec.europa.eu
European Parliament — Legislative Train: The Digital Omnibus Regulation Proposal Primarycontinuously updated state of negotiations · europarl.europa.eu
EDPB–EDPS Joint Opinion 2/2026 on the Digital Omnibus proposal (PDF) Primary10. 2. 2026 · edpb.europa.eu
EDPB — Digital Omnibus: EDPB and EDPS support simplification while raising key concerns Primarypress release, 2026 · edpb.europa.eu
Digital Watch Observatory — EU drops browser-based cookie consent proposal from Digital Omnibus Secondaryon the Council position of 18 June 2026 · dig.watch
PPC Land — EU Council drops cookie signal after Google lobbying Secondaryon the Council position of 18 June 2026 · ppc.land
noyb — EU Member States (and Google) suddenly want to keep cookie banners! Secondarystatement by a digital rights organisation · noyb.eu
Osborne Clarke — Digital Omnibus reshapes EU cookie rules but leaves banner fatigue largely intact Secondarylaw firm analysis · osborneclarke.com
Bird & Bird — Introduction to the European Commission's Digital Omnibus Package Secondaryincluding the withdrawal of the ePrivacy Regulation proposal · twobirds.com
Taylor Wessing — The Digital Omnibus: cookies, consent and digital advertising Secondarylaw firm analysis · taylorwessing.com
EDPB — Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, v2.0 (PDF) Primaryfinal version adopted 16 October 2024 · edpb.europa.eu
Adweek — Google's Privacy Sandbox Is Officially Dead Secondaryon the retirement of the APIs in October 2025 · adweek.com
eMarketer — Google's Privacy Sandbox elimination ends the quest for a cookieless Chrome Secondaryon third-party cookies being retained · emarketer.com
BfDI — Dienste zur Einwilligungsverwaltung nach § 26 TDDDG PrimaryGerman supervisory authority, list of recognised services · bfdi.bund.de
Einwilligungsverwaltungsverordnung (EinwV) — full text Primaryin force since 1 April 2025 · gesetze-im-internet.de
White & Case — GDPR under revision: Key takeaways from the Digital Omnibus Regulation proposal Secondaryoverview of the changes including Articles 88a and 88b · whitecase.com

A note on verification

The position is as at 25 July 2026. The Digital Omnibus is a live legislative process — the wording of Articles 88a and 88b may still change in the trilogues. Until the text is adopted, none of it is binding.

The claim that the Council deleted Article 88b on 18 June 2026 rests on two independent secondary sources, [5] and [6], which agree on both the date and the substance; the Council document itself was not publicly available in consolidated form at the time of writing. The remaining claims are supported by primary documents.

So what should a banner look like while today's law applies? 12 rules, each with a link to the law →

This overview is for information only and does not constitute legal advice.