Your cookie banner is not going away because of anything happening in Brussels. On 18 June 2026 the EU Council removed the provision that would have replaced banners with an automatic browser signal, according to noyb, which published the position paper's effect. The European Parliament has not taken a position and negotiations continue. Nothing about your legal obligations changed in June, and nothing will change for a long time. Meanwhile there is a way to remove your banner today that never depended on the reform: stop setting the trackers that require consent.
What was on the table, and what was cut
The Commission's autumn 2025 package proposed an automated signal that would, in the words of the campaign now pushing for it, "communicate your privacy preferences between your device and websites or apps". Instead of clicking through a dialog on every site, you would set a preference once in the browser and sites would read it.
noyb reports that Germany, France and Poland pushed for the deletion of that article before the Council vote, and quotes Max Schrems saying "the tracking industry is so terrified of consumers being able to simply say 'no' that, after a bit of lobbying, everyone gives in." Whatever you think of that framing, the practical reading is the same for a site owner: the version of the law that would have let you delete your banner is not currently in the Council's text, the Parliament has yet to decide, and any final rule is years from applying to your site.
So the interesting question is not what the EU will do. It is what you can subtract.
Myth: the banner is required. Fact: certain trackers are
Consent attaches to what you store on or read from the visitor's device for non-essential purposes. A site that sets nothing beyond a session cookie for its own checkout has nothing to ask permission for. The banner is a consequence of your tag list, not of running a website.
Which is why the useful first step is an inventory rather than a legal opinion. Open your own site in a private window, open the browser developer tools, go to the Application tab (Storage in Firefox), and read Cookies and Local Storage before you click anything. Everything listed there was set before consent. Write down each item and the tool that set it. In most small sites the list is short and predictable: a session cookie, a Google Analytics identifier, a Meta pixel, an embedded video player, a chat widget, and a consent tool storing its own record of the choice.
France drew the clearest line on analytics
The CNIL publishes the most concrete test any European regulator has put in writing for when analytics can run without consent. Its Sheet 16 sets conditions that all have to hold at once:
- the purpose is limited to audience measurement and A/B testing;
- users are informed and can object;
- the data is not cross-checked against other processing;
- the tracker's scope is limited to a single site or application publisher;
- the last byte of the IP address is truncated;
- tracker lifetime is capped at 13 months;
- where a third party provides the tool, data is collected, processed and stored independently for each publisher.
CNIL then adds the sentence that decides most cases: "Most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration." Read that as written. It is not a configuration problem you can solve inside a mainstream analytics product.
Two caveats before you lean on this. Sheet 16 is French guidance addressed to French supervision, not an EU-wide safe harbour, so treat it as the strictest published template rather than a permission slip in every member state. And an exemption from consent is not an exemption from the rest of your privacy obligations: you still have to disclose the processing.
Three routes, and what each one costs
| Route | What you do | What it costs you |
|---|---|---|
| Keep the banner, fix it | Reject is as easy as accept, no pre-ticked boxes, nothing fires before a choice | Lowest effort. You keep the banner, the click-through friction and the reduced data from everyone who refuses. |
| Remove the trackers | Replace analytics with a tool that stores nothing on the device; drop ad pixels; self-host fonts and video | You lose cross-site remarketing and ad-platform conversion attribution. You keep traffic, referrers and conversion counts. |
| Consent mode | Keep Google tags and signal the choice through them | You keep the banner. You get modelled rather than observed data for refusals. |
The middle route is more available than most site owners think. Plausible's data policy states plainly that it does not use "cookies, browser cache or local storage" and does not generate persistent identifiers; it counts unique visitors from a hash of a daily salt, the domain, the IP and the user agent, with the salt "rotated and deleted every 24 hours" and raw IPs never stored. It collects page URL, referrer, browser and operating system, device type and coarse location. That is enough to run the measurement work described in our piece on tracking clicks lost to AI summaries, and not enough to need a dialog.
If you stay on Google, be precise about what you are choosing. Consent mode uses four named parameters: ad_storage, analytics_storage, ad_user_data and ad_personalization. In the advanced implementation, tags load before the dialog and send cookieless pings on refusal so Google can model the gap; in the basic implementation, tags stay blocked until consent is given. Google's own recommendation is to "load Google tags in all cases, not only if the user consents". That recommendation serves Google's modelling. Whether it fits your risk posture is your call, and it is the kind of call worth writing down, in the same way the disclosure duties in our AI Act explainer are worth writing down before an auditor asks.
An afternoon's work, in order
- Inventory what loads before consent, using the developer tools method above. Aim for a list with a named owner per item.
- Cross off anything you cannot name a business decision for. Abandoned pixels from a campaign two years ago are the most common finding.
- For each survivor, ask what you would lose. If the honest answer is "a number nobody reads", remove it.
- If the remaining list is only first-party essentials plus a storage-free analytics tool, delete the banner and publish a plain privacy page describing the measurement instead.
- If ad platforms are load-bearing for your revenue, keep the banner and make refusal genuinely one click, because a dialog designed to wear people down is the version regulators act on.
The rule worth carrying out of this: treat the banner as a bill you are paying for your tag list. Reform may or may not arrive, and it will not arrive soon. The tag list is yours to cut this week.
Discussion
Sign in with Google or just a name. No email link, no password to remember.