Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: AdTech & Commercial Privacy

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Cookie-consent fatigue is a recognised, unresolved policy problem; the principal legislative fix (Art. 88b) is currently stalled in the Council, leaving practical mechanics unsettled.

Primary frameworkePrivacy Directive 2002/58/EC read with GDPR consent standards (Regulation (EU) 2016/679)
Supervisory authorityNational DPAs (oversight of Art. 88b-type mechanisms proposed to be entrusted to DPAs)
Traffic-light rationale — AmberCookie-consent fatigue is a recognised, unresolved policy problem; the principal legislative fix (Art. 88b) is currently stalled in the Council, leaving practical mechanics unsettled.

Sub-modules (6)

Category narrative247 words

AdTech and commercial tracking in the EEA are governed by the dual layer of Art. 5(3) of the ePrivacy Directive 2002/58/EC (device storage/access) and the GDPR (subsequent personal data processing and profiling). Under EDPB Guidelines 2/2023 on the Technical Scope of Art. 5(3) (adopted 7 October 2024), Art. 5(3) prior opt-in consent applies not only to traditional HTTP cookies but also to tracking pixels, URL/link decoration, local storage, SDKs, IoT telemetry, and IP-only / device fingerprinting. For platform profiling, the Digital Services Act (Regulation (EU) 2022/2065) strictly prohibits targeted advertising based on profiling using Art. 9 special categories (Art. 26(3) DSA) or profiling of minors (Art. 28(2) DSA), while Art. 5(2) of the Digital Markets Act (Regulation (EU) 2022/1925) prohibits designated gatekeepers from combining or cross-using personal data across core platform services and third-party services without valid GDPR opt-in consent. On 'Consent or Pay', EDPB Opinion 08/2024 (17 April 2024) and the European Commission's DMA non-compliance decision against Meta (€200m fine, 23 April 2025) establish that gatekeepers and large platforms cannot force a binary choice between pervasive behavioural tracking and a paid subscription without offering a less-personalised free alternative. In the Digital Omnibus Proposal COM(2025) 837 final (19 November 2025; legislative proposal, NOT yet in force), the Commission has proposed folding device-access rules for personal data directly into a new Art. 88a GDPR (preserving exemptions for transmission, user-requested services, first-party aggregated audience measurement, and security) and mandating browser/OS-level automated consent/refusal signals under Art. 88b within 24–48 months.

Sources and claims (5)
  1. Confirmedunavailable — The Digital Omnibus's proposed Article 88b GDPR would allow automated, machine-readable expression of individuals' data-processing choices, with oversight of such mechanisms entrusted to DPAs; in June 2026 the Council of the EU removed this provision from its position paper after industry lobbying.
  2. ProbableIAPP — Cookie banners are widely characterised as causing consent fatigue and facilitating data exploitation rather than achieving the meaningful, effective data protection the ePrivacy Directive and GDPR were intended to deliver.observed
  3. ConfirmedIAPP — Global Privacy Control is implemented on at least 385,000 websites and recognised under California, Colorado, Connecticut and other US state privacy laws, and is discussed as a candidate technical standard for the EU's proposed automated consent-signal mechanism, though as an opt-out-only specification it cannot natively express affirmative consent.observed
  4. Confirmedunavailable — The EDPB and EDPS welcome limited additional ePrivacy derogations proposed in the Digital Omnibus and invite co-legislators to incentivise contextual advertising over behavioural advertising through a specific, safeguarded exception.
  5. Confirmedunavailable — Digital Omnibus (Data track) classifies as: The Digital Omnibus's Data track (amending GDPR, ePrivacy, NIS2 and DORA, including the Art. 88b automated-consent-signal mechanism) remained under negotiation as of this cycle, separate from and slower than the AI Omnibus track which entered into force 27 July 2026.