Cookie banners ask people to make the same privacy choices on almost every site they visit. For media buyers running EU traffic, those choices affect conversion tracking: a visitor can reject cookies, complete a purchase, and leave no browser-side signal linking the sale to the campaign.
The European Commission proposed changes to this system in November 2025 as part of its Digital Omnibus package. The proposal would revise cookie consent rules and let users communicate their choices through browser settings, reducing the need to respond to individual banners.
The browser provision is now disputed, and the reform is still being negotiated. Buyers already face a more immediate problem: how much of an EU campaign’s reported performance reflects actual sales, and how much depends on which visitors agreed to tracking?
TL;DR
- The EU is proposing changes to cookie consent rules, but the reform is not final. No confirmed implementation date exists.
- Browser-level consent is still disputed. The Council removed the provision from its draft; some Parliament amendments would restore it.
- The proposed analytics exemption is narrow. It would cover a site’s own aggregated audience measurement, not retargeting or advertising pixels.
- Consent already affects campaign reporting. Differences in opt-in rates can make EU markets look less profitable than they are.
- Check your measurement setup now. Compare consent rates by market, verify conversion-modeling eligibility, and use server-to-server tracking where appropriate. What the processing behind it requires under the GDPR is a separate question.
Where the Cookie Reform Stands Right Now
The proposal is still under negotiation. Before it can become law, the European Parliament and the Council, representing EU member-state governments, must agree on a final text.
As of September 2026, several steps remain:
- Parliament has not adopted its position. Two committees published a joint draft report on 22 June, followed by proposed amendments on 27 July. A committee vote and authorization to begin negotiations are still pending, according to Parliament’s legislative record.
- The Council is still revising its draft. Member-state representatives were asked to approve a negotiating position in June, and the Council circulated a revised draft on 11 September. Final negotiations between the Council, Parliament and Commission have not begun.
- Browser-level consent remains contested. According to reporting on the Council’s June draft, it removed Article 88b. Some amendments proposed in Parliament would restore it.
- Implementation would take additional time. Published analyses read the proposed transition periods as roughly six months for Article 88a, 24 months for browser signals and 48 months for the obligations on larger browser providers, counting from entry into force. Interpretations of the Article 88a deadline differ, and these timelines may change during negotiations.
For media buyers, there is no confirmed date to plan around. The reform does not provide a reliable basis for expecting cookie banners to disappear in 2027, particularly while the browser-level alternative remains disputed.
How People Actually Use Cookie Banners
A cookie banner interrupts whatever someone came to a site to do: read an article, check a price, or buy something. They can accept, reject, open the settings, or leave it unanswered. Those responses produce very different numbers, which helps explain why consent benchmarks vary so much.
In a 2019 study by Utz and colleagues, researchers tested cookie notices with 82,890 visitors to a German online store. Even the banner placement that attracted the most interaction got a response from only 37.1% of visitors. When visitors had to actively opt in to third-party tracking, fewer than 0.1% accepted all third parties, while 1– 4% accepted at least one. These results came from one store and specific banner designs, rather than a representative sample of European users.
More detailed choices were also uncommon in a study covering almost 25 million consent interactions across over 6,000 websites. The researchers recorded just 8,297 partial acceptances – cases where someone allowed some purposes or vendors but not others. Only 0.22% clicked through to the cookie or privacy policy.
Recent commercial benchmarks report much higher acceptance, but the definition matters. Didomi’s European benchmark, based on 2025 data, distinguishes between two measures:
| Measure | What it counts | Western Europe | Eastern Europe |
| Consent rate | Acceptances as a share of recorded choices | 75.1% | 89.3% |
| Opt-in rate | Acceptances as a share of all banners shown | 55.7% | 67.6% |
In Western Europe, around 75% of visitors who responded to the banner accepted cookies. But when everyone shown a banner is included, that figure falls to about 56%. Visitors who leave the banner unanswered account for the gap: they saw the consent request but did not agree to tracking.
What the Proposed Cookie Rules Would Change
Under the proposed Article 88a, websites would generally need permission to store or access personal data on a visitor’s device. That includes data used by advertising cookies and tracking pixels.
The proposal allows four exceptions where that permission would not be required:
- Sending data over a network: technical operations needed to carry the communication.
- Delivering a service the visitor requested: functions needed to provide that service.
- Measuring the site’s own audience: collecting aggregated audience statistics solely for the site operator’s own use.
- Keeping the service secure: operations needed to protect the service the visitor is using.
The audience measurement exception needs a closer look. It would not mean that all analytics tools could run without consent. A site counting visits for its own reports is the kind of use the exception describes. An analytics provider reusing visitor data across customers or for advertising is a different case. Osborne Clarke’s analysis describes the exception as narrow and says tools operating across services, customers and platforms are unlikely to qualify.
The proposal would also change what happens after someone rejects cookies. Visitors would have to be able to refuse with one click, and the same site operator could not ask again for the same purpose for at least six months. That means a returning visitor who has already said no would not face the same request on every visit.
Six steps. November 2025, the European Commission proposes the package. February 2026, the EU’s data protection regulators back it. June 2026, the member-state governments are reported to have dropped Article 88b, the browser-level refusal, in a draft they never published. June 2026, two Parliament committees publish a draft report. July 2026, members of the Parliament file amendments to restore Article 88b. September 2026, nineteen organizations ask for it back. Still to come: a committee vote, an agreed position on each side, the closing negotiations and a final vote. If it passes, Article 88a applies six months later, the browser refusal at twenty-four months and the duty on browser makers at forty-eight.
Status as of 16 September 2026
19 Nov 2025
Commission proposes the package
10 Feb 2026
EU data protection regulators back it
18 Jun 2026
Governments drop Article 88b, the browser refusal. Reported; draft never published
22 Jun 2026
Parliament committees publish a draft report
27 Jul 2026
Amendments filed to put 88b back
10 Sep 2026
19 organizations ask for 88b back
Still to come: committee vote, an agreed position on each side, the closing negotiations, the final vote.
+6 months
Article 88a applies
+24 months
Browser refusal, if 88b survives
+48 months
Browser makers must supply it
The three periods are not confirmed dates. They are how law firms and consent vendors read the draft, and the countdown would only start once the regulation enters into force, which has not happened. Source: European Parliament file 2025/0360(COD) and reporting on the 18 June draft.
Why Browser-Level Consent Is Still in Dispute
Article 88b would let people save their cookie choices in their browser and have websites respect them, with an exception for certain media services. That could spare visitors from answering the same question on every site.
But the Council reportedly removed the provision from its June 2026 draft. According to noyb, Germany, France and Poland pushed for the change. The draft itself has not been published.
Consumer and privacy groups want the provision restored. IAB Europe opposes browser-level consent, arguing that publishers should be able to explain directly to visitors how advertising funds their content.
The outcome is still undecided. For buyers, there is no confirmed timeline for browser-level consent to replace the banners used today.
How Consent Affects Campaign Reporting
A visitor can reject cookies and still make a purchase. The order appears in the store’s records, but the tracking setup may no longer connect it to the ad that brought them there.
As a result, campaign reports can show fewer conversions than the campaign actually generated.
Google’s consent mode shows how this works. In basic mode, Google tags remain blocked when consent is refused. In advanced mode, they send measurements without cookies.
Conversion modeling can help estimate missing conversions in either setup, but advanced mode provides more information for those estimates. Neither guarantees a complete count.
An Orbit Media study across 33 accounts illustrates the reporting gap. Comparing GA4 with records from internal systems, the agency found average underreporting of 20.3% on sites with consent banners and 11.2% on sites without them. These were results from the agency’s sample, not an EU-wide benchmark, and the comparison does not establish that banners caused the entire difference.
A drop in reported conversions therefore does not necessarily mean fewer people are buying. Order and lead records can help establish whether sales or inquiries have also fallen.
Connecting those results to a particular campaign, however, requires additional information, such as a campaign identifier saved with the order or a click ID linked to the conversion.
For example, if the store records 100 orders while paid campaign reports show 70, you cannot assume the other 30 are missing ad conversions. Some may have come from organic search, email, or returning customers. Comparing the totals is a useful starting point, but explaining the difference requires checking how each order’s source was recorded.
If the visitor clicks Accept on the cookie banner, everything reports normally: the pixel fires, the Google tag sends real conversions, and the advertiser’s postback returns the click ID. If they click Reject, the pixel is dead and a Google tag in the basic setup never loads. In the advanced setup the tag loads but sends nothing cookie-based, and Google only estimates the gap where there are at least 700 ad clicks in seven days for that country and domain. The postback still fires, as long as the click ID survives the redirects and the advertiser sends it back. Nothing here is a way to track a person who said no.
Same click, same lander, two very different reports
Visitor clicks Accept
Your pixel on the lander. Fires, and the visitor keeps an ID
Google tag. Sends everything. Real conversions, not estimates
Postback from the advertiser. The click ID comes back with the sale
Visitor clicks Reject
Your pixel on the lander. Nothing is written to or read from the device
Google tag, basic setup. Never loads. Google gets nothing at all
Google tag, advanced setup. Loads, sends nothing cookie-based. Google estimates the rest only above 700 ad clicks in 7 days, per country and domain
Postback from the advertiser. Still fires, if the click ID survives the redirects and the advertiser sends it back
None of this is a way to track someone who said no. Rejecting the banner switches off the browser side on purpose, and what is left is the click you already paid for plus what the advertiser’s own server tells you about the sale. A postback working without cookies is a fact about the plumbing; whether the data behind it needs consent is a separate question for your counsel. The Reject column assumes the cookie banner is wired up correctly, because when it is not, tags can keep firing or quietly stop reporting without either showing up in the report. Sources: Google’s consent mode and conversion modeling documentation, and affiliate tracker documentation.
What This Means for Your Tracking Setup
If you buy EU traffic, the proposed analytics exception would not cover everything you use to measure a campaign. Counting visits for your own reports is different from tracking sales or building retargeting audiences.
| In your campaign | What the proposal would mean |
| Your landing page counts visits for your own aggregate reports | This could qualify for the audience measurement exception, provided it meets the conditions. |
| A pixel adds visitors to a retargeting audience | The audience measurement exception would not cover it. |
| A conversion pixel uses cookies to connect a lead or sale to your campaign | Advertising attribution would not qualify for this exception either. |
| An affiliate network or advertiser sends conversions to your tracker through an S2S postback | The postback itself does not need browser cookies. Consent requirements still depend on how you collect and use the tracking data. |
For affiliates, that last setup is particularly relevant.
In a typical S2S integration, your tracker passes a unique click ID to the affiliate network or advertiser through the offer URL. When their system records a conversion and attributes it to that click, it sends the ID back in a postback. Your tracker then matches the conversion to the original campaign.
If the click ID is missing, the wrong parameter is used, or the postback fails, a conversion may appear in the affiliate network’s dashboard but not in your tracker. These integration problems can occur even when consent settings work correctly.
The distinction is that sending a conversion without cookies does not make the whole tracking process consent-free. The postback handles the transfer between servers; how the conversion was linked to the click still matters.
Our guide to postback and S2S tracking explains how to set up that connection.
Do Affiliates Need to Change Anything Now?
The proposal itself does not require affiliates to change their tracking setup today. It is still being negotiated, and the final rules and implementation dates remain unsettled.
The proposed analytics exception is not yet a basis for removing consent requests or firing advertising pixels without permission. Browser-level consent is also unresolved, so there is no confirmed date when it would replace today’s banners.
For now, the reform is something to follow as it develops. Existing consent requirements continue to apply, and any reporting gaps in live campaigns need to be assessed under the setup and rules already in place.
Questions Buyers Are Asking About EU Consent Rules
There is no confirmed date for cookie banners to disappear. The proposal has not been adopted, and the browser-based alternative was removed from the Council’s draft. Even if it returns, the proposed timelines would give websites two years and larger browser providers four years after the law enters into force to implement it.
Only for basic audience statistics collected solely for the site operator’s own use, such as total visits. If an analytics provider also uses that data for its own advertising or other purposes, the proposed exception would not cover it.
It removes the dependence on cookies, which is a different matter. Trackers document the method as working without cookies. What the processing behind it requires under the GDPR is a separate question, and vendor documentation does not claim to answer it.
No changes are required by the proposal at this stage. It is still being negotiated, so it does not introduce new obligations or remove existing consent requirements. There is no need to change your tracking setup because of it yet.
What Happens Next?
The final text will determine whether browser-level consent returns and how far the analytics exception extends. Until then, the proposal gives affiliates no confirmed date or new rules to build their campaigns around.
For your next EU campaign, the existing consent requirements still apply. The reform could eventually change how visitors express their choices, but it is too early to say how that will affect your reporting.
Join our Telegram community for more practical affiliate marketing discussions.
Estimated reading time: 11 minutes
