You have clicked "Accept" on more cookie banners than you could ever count. So have your customers. Every time someone lands on your website, that little grey box gets between them and the thing they actually came for. In November the European Commission finally admitted the obvious: the banners have become a problem worth fixing. I had a version of this conversation with a business owner only last week, so let me save you the worry and tell you what is actually changing, and what is not.

What the EU actually proposed

On 19 November 2025 the European Commission published its Digital Omnibus, a package aimed at simplifying the rules that sit on top of the GDPR, the ePrivacy framework and a handful of other digital laws. The Commission was unusually blunt about the reason. It pointed straight at "consent fatigue" and the endless proliferation of cookie banners as something a fix was long overdue for ^[1].

The headline changes are sensible. A single click to accept or reject, with both options given equal weight on the banner. A rule that once a visitor says no, you cannot keep asking them for at least six months. And, further down the road, browser-level signals so a person can set their preference once and have every website respect it automatically, instead of clicking through the same pop-up a thousand times a year.

Underneath the surface there is a bigger structural shift. The proposal lifts the rules on cookies out of the old ePrivacy Directive and folds them into the GDPR itself ^[3]. For you, the plumbing matters less than the direction of travel. That direction is clear: less friction, fewer banners, more sensible defaults.

The proposal trades a thousand pop-ups a year for a single preference, set once.

Why the banner became the enemy

Here is the part nobody at the Commission needed a study to understand, though plenty of studies back it up. Most people do not read cookie banners. They dismiss them. Survey after survey finds that a clear majority of users find the pop-ups irritating, and a growing share now reject by default the moment a proper reject button appears.

Think about what that means on your own site. Picture a café owner on the Galway Quays who has spent good money getting found on Google. Someone taps through, lands on the homepage on their phone, and the first thing they meet is a grey box demanding a decision about cookies before they can even see the lunch menu. Some of them give up right there. Not because the food is wrong or the prices are high, but because you made them do paperwork at the door. That is a real cost, paid in lost visitors, and you never see the invoice.

What is actually changing, and what is not

Now the honest part, because I am not going to sell you a fairy tale. The cookie banner is not disappearing next week, or next month. This is a proposal. It still has to pass through the European Parliament and the Council, with the usual rounds of negotiation, and the optimistic guess from people who follow this closely is adoption by the end of 2026 at the earliest, with the rules biting some time in 2027. As the law firm Osborne Clarke put it, the package "leaves banner fatigue largely intact" for now ^[2]. Even the EU's own privacy watchdogs, the European Data Protection Board and the EDPS, gave the simplification a cautious nod while warning that the detail still needs work ^[4].

More importantly, consent does not go away as the default. The Commission has loosened the rules for a short, specific list of low-risk situations. It has not declared open season on tracking. If you run real marketing cookies, retargeting pixels, or anything that builds a profile of a visitor, you will still need consent, and you will still need that banner. So do not rip it out. If you are unsure where your site sits, that is a conversation for your solicitor, not a blog post, mine included.

This is also worth a fair concession. If your business genuinely lives on paid retargeting, the kind where you follow a visitor around the internet with ads, then consented tracking is the right tool and the banner is the price of admission. That is a legitimate setup. It is just not how most local firms actually operate.

Counting how many people visited is not the same as tracking who they are.

The quiet win hiding in the detail

The part of this proposal that should interest the ordinary business owner is not the banner choreography. It is a small exemption with big consequences. The draft would let you collect aggregated, anonymous audience measurement, the basic visitor numbers and trends for your own use, without consent and without a banner, as long as you are not building profiles of individuals.

Read that again, because it matters. Most owner-operators do not need to know that one particular visitor looked at three pages on a Tuesday night. They need to know how many people came, where they arrived from, and which pages do the work. That is aggregate data. The kind of measurement that, done properly, never required a banner in the first place.

This is where the better solutions already point. A good analytics setup measures what you need to run the business without harvesting personal data at all. We have covered before how cookie-free analytics gives you the visitor insight without the consent headache, and the principle is exactly what the EU is now nudging the whole web towards. The platforms that build privacy-first analytics on Irish infrastructure in by default, where your data stays in the country, hand you your numbers without a tracking script or a banner to apologise for. One measured caveat: even with cookie-free measurement, best practice is still to mention your analytics in your privacy policy. Less consent overhead is not the same as no transparency.

Cookie rules are only one slice of a much bigger data-protection picture. Backups, access control, and how your site handles customer information all sit alongside them, and our complete security and backup guide for Irish websites is a better place to start on the rest than any banner ever was.

So what should you do now

Nothing dramatic. Keep your banner if you are running marketing cookies. Stop treating it as permanent furniture, because the ground is shifting under it. And take the hint Brussels is giving everyone: the future of the web is less tracking, fewer interruptions, and measurement that respects the person on the other end of the screen. Build on a platform that already works that way, and the next round of rule changes becomes someone else's scramble, not yours.

The banner was never the point. Knowing your customers without ambushing them was. That is the standard worth building to, whatever the Commission decides next.