The EU cookie law, last amended in 2009, says a website may store something on your device, or read something from it, only with your consent, unless it is strictly necessary. Its visible result is the cookie banner, and the European Commission now describes the effect of its own rule this way: users "often click on any button, just to be able to access the visited site." In November 2025 the Commission proposed rewriting the rule as part of the Digital Omnibus, and in October 2026 the Council of the EU agreed a different version of its own. This article puts the figures side by side: what the banners cost in time by the only official estimate there is, what people click and why, what each version of the new rule would change, and what a website owner should do in the meantime. Every figure comes from the source named next to it, read on 3 November 2026.
— News
EU cookie law: what the banners cost, and what the Digital Omnibus changes
By the European Commission’s own estimate, Europeans spend 334 million hours a year on cookie banners. What that figure rests on, what people actually click, and where the plan to change the rules stands in November 2026.
The cookie rule today and in the two proposals
| Point | Today | Commission, Nov 2025 | Council, Oct 2026 |
|---|---|---|---|
| Where the rule sits | ePrivacy Directive, Art. 5(3) | GDPR, new Art. 88a | ePrivacy Directive, Art. 5(3) rewritten |
| Visitor statistics without consent | No | Aggregated, by the site, for its own use | Anonymous and aggregated, also by a third party on the site’s behalf |
| Other new exceptions | None | Security | Security; media audience measurement; contextual ad measurement |
| Refusing | Not set in the text | Single click | Single click |
| Asking again after a refusal | Not set in the text | After at least 6 months | After at least 4 months |
| Choices set in the browser | No | Sites after 24 months, browsers after 48 | Dropped; report on privacy technology within 12 months |
| Applies from | In force | 6 months after entry into force | Through national law, 24 months after adoption |
From the Commission’s questions and answers of 20 November 2025 and the Council’s mandate, document 14756/26 of 22 October 2026, which marks every change to the Commission’s text. Read on 3 November 2026. Neither version is law, and the European Parliament has not adopted a position.
What studies found people click
| Source | Setting | Finding |
|---|---|---|
| Utz et al., 2019 | German e-commerce site, all boxes pre-ticked | About 30% on mobile and 10% on desktop accept all |
| Utz et al., 2019 | Same site, boxes unticked (opt-in) | Fewer than 0.1% accept all |
| Utz et al., 2019 | Same site, time until visitors interact | Median 4 to 8 seconds |
| Nouwens et al., 2020 | Scraped consent pop-ups | 11.8% meet minimal legal requirements |
| Nouwens et al., 2020 | Reject button removed from the first page | Consent up 22 to 23 points |
| IAB Europe, 2025, cited by the Commission | Industry survey | 54% accept all, 26% reject all |
| forsa for the BfDI, Nov 2025 | Survey of German internet users | 60% reject all when it takes one click |
Surveys report what people say they do; the two field studies record what they did. Figures as published in each source.
A privacy rule that turned into a click
Article 5(3) of the ePrivacy Directive requires consent before a website stores information on a visitor’s device or reads information from it, unless that is strictly necessary for a service the visitor asked for. The rule dates from the early 2000s and was last amended in 2009. Most websites meet it with a banner, and by the Commission’s working assumption 85% of the sites a European visits show one.
The authorities that enforce the rule are not convinced by it either. In a 2022 evaluation cited in the Commission’s impact assessment, only 3 of 30 competent authorities said Article 5(3) works "well"; 13 said "fair" and 3 said "poor". Businesses pay for it as well: the same assessment puts the average cost of a cookie banner at €400 per website per year and, with about 41% of 10 million active EU websites showing one, the total at €1.64 billion a year.
How much time cookie banners cost
The only official estimate is in the impact assessment the Commission published with its proposal on 19 November 2025. Its method: 450.4 million people in the EU, 75% of whom use the internet to look for goods and services; 100 websites visited a month, 85% of them with a banner; 3.5 seconds per banner. The result is about 334 million hours a year. At the average EU hourly wage that is roughly €11.2 billion, and because most browsing happens in free time, the Commission scales it down to between €3.36 billion and €5.6 billion, using the value transport planners put on leisure time.
Nobody has measured the total; every figure in circulation is a multiplication of assumptions. The visits and the banner share come from a 2024 blog post by Legiscope, which the Commission’s footnote cites by its title, "Europeans Spend 575 Million Hours Clicking Cookie Banners Every Year." That post used 5 seconds per banner, and Simple Analytics, among others, repeated its figure. Legiscope’s page at the same address now says that no reliable EU-wide total can be inferred without measured banner exposure and interaction time. The nearest thing to a measurement comes from a 2019 field study on one German website, where the median time until a visitor interacted with the banner was 4 to 8 seconds.
What people actually click
Asked directly, people say they refuse. In a forsa survey for Germany’s Federal Data Protection Commissioner, the BfDI, published on 4 November 2025, 60% of internet users said they reject cookies across the board when one click allows it. The industry survey the Commission cites, by IAB Europe in 2025, found the opposite habit: 54% of users accepting all cookies and 26% rejecting all, in the Commission’s words often without making an informed decision.
How many people accept depends less on the people than on the banner. In the 2019 field study by Utz and colleagues, with 82,890 visitors to a German e-commerce website, a banner with every box pre-ticked led about 30% of mobile visitors and 10% of desktop visitors to accept all third parties. Offered the same choice with the boxes unticked, fewer than 0.1% accepted everything.
The banner is a design decision
A 2020 study by Nouwens and colleagues, presented at the CHI conference, scraped consent pop-ups and found that only 11.8% met the minimal requirements the authors derived from European law. In an experiment, removing the reject button from the first page raised consent by 22 to 23 percentage points, while putting more detailed choices on the first page lowered it by 8 to 20 points.
Put next to each other, these figures explain the banner most people know: a large accept button, and refusal one layer down. It is the layout that collects the most consent, which is why it is the textbook example of a dark pattern, and why both versions of the reform begin with a reject button that takes a single click.
What the Commission proposed in November 2025
On 19 November 2025 the Commission published the Digital Omnibus, a proposal to simplify several EU digital laws at once, alongside a separate Digital Omnibus on AI, which we follow in our EU AI Act timeline. For cookies, it would move the rule out of the ePrivacy Directive and into the GDPR as a new Article 88a, with GDPR fines of up to 4% of global turnover. Consent would remain the rule, with a short list of uses that need none: transmitting a communication, a service the visitor asked for, security, and aggregated statistics a site creates about its own audience for its own use.
Where consent is needed, refusing would take a single click, and a refusal would have to be respected for at least six months before the site asks again. A new Article 88b would require sites to accept choices sent automatically in a machine-readable form, for example from browser settings, 24 months after the law takes effect, and browsers from companies that are not SMEs to offer that option after 48 months; media services would be exempt. The Commission expects more than €800 million a year in savings for businesses, and calculates that choices set once in the browser would spare about 200 million users 198 million hours a year.
What the Council changed in October 2026
On 21 October 2026 the member states’ ambassadors agreed the Council’s negotiating mandate. It keeps the cookie rule in the ePrivacy Directive and rewrites Article 5(3) instead of moving it into the GDPR. The exceptions become a closed list, and a longer one: besides transmission, requested services and security, it allows anonymous visitor statistics that a third party may compile on the site’s behalf, audience measurement for media under the European Media Freedom Act, and measuring the display and performance of contextual advertising, with pseudonymised data and no profiling. Refusing still takes a single click, and the wait before asking again after a refusal falls from six months to four.
The only saving the Commission counted in hours, choices set once in the browser, is the measure the Council removed. In its place, the Council asks the Commission for a report on privacy-enhancing technologies within 12 months of adoption. And because the rule stays in a directive, each country would have 24 months after adoption to write it into national law, so the details would keep differing from one country to the next.
Where it stands in November 2026
In the European Parliament the file sits jointly with the industry committee, ITRE, and the civil liberties committee, LIBE, with Aura Salla and Marina Kaljurand as rapporteurs since 25 February 2026. On 3 November 2026 the Parliament’s Legislative Observatory gives its status as "Awaiting committee decision", with no committee or plenary vote recorded. Negotiations between Parliament and Council can only begin once Parliament has a position, and they have not begun.
So none of it applies yet, and the road is longer than the headlines suggest: a Parliament position, a deal with the Council, formal adoption and, under the Council’s version, up to 24 months of national lawmaking after that. Until then, a website is judged by the rule in force today.
Germany already built the browser option
Germany did not wait for Brussels. Its consent management ordinance, the EinwV, signed on 6 February 2025 and in force since 1 April 2025, lets the BfDI recognise services that store a person’s cookie choices centrally, so that websites can read them instead of asking again. The BfDI recognised the first one, Consenter from Law & Innovation Technology GmbH, on 17 October 2025, and on 3 November 2026 it is still the only service in the register.
Demand is not the obstacle, on paper: in the forsa survey for the BfDI, two thirds of respondents could imagine using such a cookie manager, and 83% want their settings to apply on every website. Section 18 of the ordinance, however, makes connecting to a recognised service voluntary for websites, so a choice stored once counts only on the sites that decide to read it.
What to do now, and what to wait for
Change nothing because of the Omnibus yet. The rules that apply are the ones in force: Article 5(3) of the ePrivacy Directive as each country implemented it, § 25 TDDDG in Germany and Law 506/2004 in Romania, which our guide to cookie banners and Consent Mode v2 explains step by step. Removing a banner because a proposal would exempt your analytics, or asking again after a refusal on a timetable nobody has adopted, means acting on a text that can still change. The one point every version agrees on is a single-click refusal, and that is worth having now.
A site that stores nothing that needs consent needs no banner, today and under every version on the table. Login sessions, shopping carts and language choices are strictly necessary, and a banner on a site that uses nothing else is a click that protects no one. Most banners exist because of one or two tools, usually analytics or advertising, and analytics that stores nothing on the device, compared in our guide to Google Analytics alternatives, removes the question instead of waiting for an exemption. Whether a site needs a banner at all is settled by how it is built, which is our web development work.
— FAQ
Frequently asked questions
Sources and method
All pages read on 3 November 2026. The comparison of the Commission’s and the Council’s texts comes from the Council’s mandate, which marks every change to the Commission proposal. The time estimate is the Commission’s; we did not make one of our own, because no measured data exists to make it from.
- European Commission — Digital Package: questions and answers ↗
Last updated 20 November 2025. Cookie reform: refusal with a single click, choices respected for at least six months, central settings for example via the browser, a whitelist of harmless purposes, fines of up to 4% of global turnover, more than €800 million a year in savings for businesses.
- European Commission — Staff working document SWD(2025) 836 on the Digital Omnibus ↗
19 November 2025, section 1.3: about 334 million hours a year on cookie banners (100 sites a month, 85% with a banner, 3.5 seconds each, inputs from Legiscope 2024), €11.2 billion at wage value, €3.36 billion to €5.6 billion at leisure value; €400 per website a year; 54% accept all and 26% reject all, citing IAB Europe 2025; 3 of 30 authorities rate Article 5(3) as working well; 198 million hours saved through browser settings.
- Council of the EU — Digital Omnibus, mandate for negotiations with the European Parliament (14756/26) ↗
Agreed by the Permanent Representatives Committee on 21 October 2026. Rewrites Article 5(3) of the ePrivacy Directive: a closed list of exceptions, refusal with a single click, no new request for at least four months after a refusal, national law within 24 months of adoption, a report on privacy-enhancing technologies within 12 months.
- European Parliament Legislative Observatory — Digital Omnibus, 2025/0360(COD) ↗
Status "Awaiting committee decision"; ITRE and LIBE jointly responsible, rapporteurs Aura Salla and Marina Kaljurand appointed 25 February 2026; proposal published 19 November 2025.
- EU Internet Law & Policy Blog — The Council’s Digital Omnibus mandate: what would it change in the GDPR? ↗
23 October 2026: the Commission’s Articles 88a and 88b deleted, browser signals dropped, a four-month wait after a refusal instead of six, contextual advertising measurement exempted, talks with Parliament not yet begun.
- Utz, Degeling, Fahl, Schaub, Holz — (Un)informed Consent: Studying GDPR Consent Notices in the Field (CCS 2019) ↗
Field experiments with 82,890 visitors to a German e-commerce website: pre-ticked boxes led about 30% of mobile and 10% of desktop visitors to accept all third parties, opt-in fewer than 0.1%; median time until interaction 4 to 8 seconds.
- Nouwens, Liccardi, Veale, Karger, Kagal — Dark Patterns after the GDPR (CHI 2020) ↗
Only 11.8% of scraped consent pop-ups met minimal requirements based on European law; removing the reject button from the first page raised consent by 22 to 23 percentage points; more detailed choices on the first page lowered it by 8 to 20.
- Legiscope — Cookie Banner Fatigue: Consent Rules and Narrow Exemptions ↗
The address the 575 million hours figure is credited to, now dated 26 September 2026: no reliable EU-wide total can be inferred without measured banner exposure and interaction time.
- Simple Analytics — Europeans spend 575 million hours per year clicking cookie banners ↗
Published 12 November 2024, edited 2 April 2025: repeats the 575 million hours figure and credits Legiscope.
- BfDI — Press release 16/2025 on cookie consent ↗
4 November 2025, forsa survey for the BfDI: 60% reject cookies across the board when one click allows it, two thirds could imagine using a cookie manager, 83% want their settings to apply on all websites.
- BfDI — Einwilligungsverwaltung ↗
The register under § 13 EinwV lists one recognised service: Consenter, Law & Innovation Technology GmbH, recognised on 17 October 2025.
- Einwilligungsverwaltungsverordnung (EinwV), full text ↗
Signed 6 February 2025, in force since 1 April 2025; the BfDI recognises consent management services (§ 8).
- EinwV § 18 ↗
Connecting to a recognised consent management service is voluntary for providers of digital services.
Want a website that needs less of a banner?
We build websites that load only what they need, so the consent question shrinks or disappears, and we set up a banner that really blocks what it says where your tools still need one.