The proposed streamlining of EU rules on consent for processing personal data must consider how digital-market incentives shape implementation. Online, users’ personal data flows through a complex system involving publishers, third-party vendors, analytics providers, and advertising technologies, making large-scale data sharing a routine part of online business models. For instance, a retail site might share users’ personal data with various third-party vendors, including social media platforms and advertising services.
EU rules, particularly the General Data Protection Regulation (GDPR) and the ePrivacy Directive, aim to give users meaningful control over their personal data. For many types of data processing, these regulations require online entities to obtain users’ consent before handling personal data or storing cookies and other tracking technologies on devices. This requirement is typically implemented through online consent banners that users encounter routinely. However, this approach often fails to meet regulatory expectations or genuinely support users’ interests.
Among the top European websites, fewer than 15 percent deploy consent banners that are fully GDPR-compliant. Internal audits by industry initiatives also reveal that many consent-management solutions fall short of compliance. Persistent regulatory under-enforcement enables this patchy compliance; the responsibility for ensuring that consent banners comply with EU law lies with national data protection authorities, many of which are under-resourced and have differing interpretations of the rules. The deeper reason for these patterns lies in firms’ commercial interests. The industry’s approach to implementing the GDPR and ePrivacy Directive is driven by strong profit incentives to structure consent options in ways that increase user acceptance rates. This frequently arises in the form of ‘dark patterns’—misleading and manipulative website designs and configurations intended to steer users toward disclosing more personal data.
Even if fully compliant, the consent system presents significant practical problems for users. Visitors are confronted with numerous consent decisions each time they access a website, leading to user fatigue. As a result, people often make choices that fail to reflect how they weigh privacy costs against the benefits of sharing their data. Studies show that many users have nuanced preferences, yet binary shortcuts push them to share either more or less than they would ideally choose. Users would be better off if they could set blanket preferences, reducing the consent burden and helping users make choices that truly align with how they want their data handled. Setting preferences globally lets users configure everything once, at a convenient time, rather than while they’re trying to accomplish another task. This makes them more likely to take the time to make more informed choices that align with their preferences.
Proposed Digital Omnibus
In this context, the European Commission proposed a digital omnibus on 19 November 2025—a draft law that would amend several EU digital laws as part of a simplification drive aimed at strengthening EU competitiveness. A large portion of the expected reduction in administrative burden for consumers and firms would stem from revisions to the GDPR and the ePrivacy Directive to simplify online consent management. These changes affect everything from the situations in which user consent is required to browser-level controls and the design of consent banners.
The Commission’s proposal would significantly reduce the number of situations in which publishers must ask for consent. Firstly, the Commission proposes to integrate elements of the ePrivacy Directive into the GDPR regarding the processing of information stored on user devices. At the same time, it proposes to amend these provisions by defining a set of low-risk data-use purposes that would no longer require consent. In addition, the Commission also proposes narrowing the definition of ‘personal data,’ thereby reducing the range of situations in which the GDPR applies. Through these proposed reductions in scope, the Commission claims that 50 percent of private websites and 80 percent of public websites would no longer have to rely on consent and the use of cookie banners.
In principle, excluding low-risk activities from the scope of the GDPR and reducing unnecessary consent prompts is a natural first step to tackle users’ consent banner fatigue. Yet questions remain about whether companies may interpret these exceptions too broadly in practice, reducing user control. While these reductions may ease compliance burdens, the Commission must ensure that the resulting rebalancing does not unduly diminish individual protections.
Where publishers and vendors still require consent, the Commission’s proposal seeks to shift consent management away from website-level banners and toward centralized, user-controlled settings. Users would be able to set their privacy preferences for various types of data processing through their web browser, which would respond to consent prompts automatically. This would offer a centralized and accessible way for users to accept or refuse data processing, significantly reducing repeated interactions with consent banners. However, delegating implementation to browser providers raises concerns. Many browsers profit from the sharing of personal data and therefore have limited commercial incentives to facilitate such user-friendly mechanisms. They could, for instance, design confusing and difficult-to-navigate interfaces to hinder users from rejecting personal data-sharing.
Alternative Technical Solutions
The Commission also explicitly encourages alternative technical solutions, including the potential use of agentic AI systems, which would process information on user preferences and companies’ stated uses of personal data to manage consent decisions on behalf of users. However, without clearer expectations or tangible support, the proposal’s brief mention of agentic AI systems is unlikely to spur such solutions. Industry has little incentive to build user-empowering consent tools, and the few promising solutions that do exist often fail to gain traction. The Commission should take on a more proactive role, for example by funding research into innovative consent tools, or by creating an EU certification for trusted consent tools.
Exemptions and Limitations
Lastly, one large exemption undermines the omnibus’ broader aim of establishing a consistent and user-centred consent framework: media service providers would not be required to respect automated consent signals and may continue relying on traditional consent banners. The Commission justifies this exemption as necessary to protect the financial basis of independent journalism. But limiting this exemption to media organisations appears arbitrary: although supporting independent journalism is a valid aim, the same logic could arguably extend to other sectors that also rely on data-driven revenue. A similar outcome could be achieved by mandating the global consent signal to include industry-specific preferences, so that users can choose different privacy settings for sectors such as news media if they wish.
Addressing Dark Patterns
The Commission directly addresses several common dark patterns used in consent collection. First, it stipulates that users must be able to give or refuse consent through a single-click mechanism, simplifying consent choices. In addition, it prohibits websites from repeatedly prompting users for consent after a refusal in the hope of eventually securing approval. Under the proposed rules, publishers are barred from requesting consent again for six months. These steps may help tackle some dark patterns, but they are reactive and largely address the symptoms rather than the underlying cause. As long as consent banner designs are mainly guided by the preferences of websites and vendors, new dark patterns will continue to appear, and actual practices will fall short of regulatory intent.
Aligning Design Choices with User Interests
If the companies that design consent interfaces benefitted from aligning their design choices with user interests, dark patterns would go away naturally. This would require a fundamental shift in the way consent interfaces are designed, prioritizing user needs and preferences over commercial interests. By taking a more user-centric approach, companies can create consent interfaces that are intuitive, transparent, and respectful of users’ autonomy.
