In this week's column, Shirley Marschall looks at GDPR, red shoes and the most annoying thing Europe ever came up with...

Europe; famous for its rich history, culture, food and cities. For Paris, the city of love. London, the city of finance. Munich, the city of Oktoberfest. For wine, beer, pizza, croissants and Mozartkugeln in between. It’s Europe, "Emily in Paris" style.

And then there is the other side of Europe… the cookie banner one.

GDPR and red shoes

When GDPR was making its first appearance there was a rumour that at the very core of it was a European politician who had been searching for red shoes. After an initial search, she found herself being tracked across the internet by red shoe ads. Again and again. The source of this stalking was easy to find. Retargeting. Which was possible thanks to… cookies. GDPR was supposed to fix this, giving users a choice to allow (or reject) this kind of tracking. But it didn't, and now Europeans are both being tracked and getting harassed by pop-up cookie banners on top of it.

Cookie banners are easily one of the most annoying things Europe ever came up with. Nobody ever asked for it and Europeans hate it. Consumers never understood what cookies are to begin with (and why should they?), let alone why they now have to deal with those banners. And ask a random user what happens when they click 'accept all.' Odds are, they have absolutely no idea.

And yet, according to Kill the Cookie Banner, up to 90% of visitors click 'accept' on a banner anyway, even though 1-10% (depending on the study) of people actually 'want' to be tracked. This acceptance rate is purely a design outcome of a banner that was never built to inform anyone to begin with. It was solely built to produce a yes…malicious compliance, anyone?

The Potential Fixes

The Transparency and Consent Framework (TCF), IAB Europe's permission-slip system for tracking-based advertising, was supposed to be the plumbing that made all of this legal. It's been fighting its way through Belgian courts for years instead. Current status: the Belgian Market Court annulled the regulator's earlier order requiring IAB Europe to fix the TCF.

If you want to see what that plumbing produces at full extension, dict.cc can show you. The online dictionary's consent banner asks users to wave through tracking by 1,741 separate "partner" companies with a single click. noyb did the math: reading every one of those partners' privacy policies, at six minutes each, would take 170 hours. A week of full-time reading, for one dictionary lookup. noyb's response: a complaint. Felix Mikolasch, the noyb lawyer who filed it, called the idea of informed consent under those terms "ridiculous."

There is/was a fix on the table. The European Commission's proposal, Article 88b in the Digital Omnibus, would have let people set their tracking preference once, in the browser, and skip the banner theatre entirely. But on 18 June 2026, Member States stripped Article 88b out of their negotiating position entirely, after intense industry lobbying. The provision isn't dead exactly, it's just gone from the text, with only the European Parliament left to put it back before the three institutions sit down to settle on a final version. 

Which tells you plenty about how threatening a working opt-out actually is to the business model underneath it. And which is why initiatives such as Kill the Cookie Banner, led by civil society organisations across Europe including Check My Ads and noyb, have been (and won't stop) pushing for exactly this change to correct a long overdue mistake of the past. Especially since your browser settings already tell every site what language you speak, it could just as easily tell every site to leave you alone. 

Sounds like this topic will keep courts busy for another couple of years.

The Future of the Cookie

Iesha White, Director of Intelligence at Check My Ads, notes: “Data remains the currency of digital advertising, and the industry is adept at finding new ways to pivot around regulation and innovate despite user-initiated privacy protections. But consumers are more fed up than ever. Has the digital cookie finally burnt out its welcome?” 

And still, suppose the browser signal ships, satisfies every regulator in Brussels, and the banner disappears for good, there’s a rather large problem left. A project called taken by Since You Arrived (Click on it. Seriously, do it.) built a page that shows visitors what their own browser handed over the moment they landed: location, device, fonts installed, battery's discharge curve, etc. And none of it needs consent, because none of it was ever covered by the law.