Cookie banners exist because European law requires a website to ask before it stores or reads non-essential information on a visitor's device. That rule has applied in the EU since 2009, and as of October 2026 none of the reforms on the table removes it. The reforms change when you must ask, not whether, and enforcement has grown stricter, not softer.
The legal foundation is Article 5(3) of the ePrivacy Directive
The obligation to show a cookie banner traces back to a single provision: Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, as amended in 2009). It states that storing information on, or accessing information already stored in, a user's device requires prior consent, unless the storage is strictly necessary to deliver a service the user has requested. The ePrivacy Directive is still the law that governs cookies in every EU member state.
That rule is technology-neutral. It covers HTTP cookies, local storage, session storage, tracking pixels, browser fingerprinting, and any other mechanism that reads from or writes to a visitor's device. The EDPB confirmed this broad scope in its Guidelines 2/2023, explicitly bringing tracking links, IoT reporting, and certain forms of IP tracking within scope.
Each EU member state transposed Article 5(3) into national law, which is why the specific rules differ slightly between France, Germany, and Spain. But the core principle is identical everywhere: no non-essential cookie without informed, prior consent.
How the GDPR reinforces the consent requirement
The ePrivacy Directive tells you that consent is needed. The GDPR tells you what valid consent looks like.
Under Article 4(11) of the GDPR, consent must be freely given, specific, informed, and unambiguous. Article 7 adds further conditions: you must be able to prove consent was given, and withdrawing it must be as easy as giving it. Pre-ticked boxes, scrolling, and continuing to browse a site do not count. The EDPB's Guidelines 05/2020 on consent say so explicitly.
Recital 30 classifies cookie identifiers as personal data where they can identify a natural person. Since almost every analytics or marketing cookie carries a unique identifier, the GDPR applies to the data collected. You need a lawful basis under the GDPR (typically consent) and you must meet the ePrivacy Directive's device-access rules. A cookie banner is where both happen.
Enforcement is getting stricter, not softer
Regulators across Europe are not winding down cookie enforcement. They are scaling it up.
On 1 September 2025 the CNIL, France's data protection authority, fined Google EUR 325 million for showing advertisements between Gmail users' emails without their consent and for placing cookies, without valid consent, when people created a Google account. The same day it fined SHEIN EUR 150 million: advertising cookies were placed before visitors made any choice, and after a click on "Refuse all", new cookies were still placed and existing ones were still read.
In the UK, the ICO announced in January 2025 that it would review the top 1,000 UK websites, after raising concerns with 134 of the top 200. By its December 2025 update, 979 of the 1,000 met its checks, 564 of them only after the ICO contacted them. When it published its final storage and access technologies guidance on 29 April 2026, the ICO said 99% of the top 1,000 now met its standards for cookie banners. A summary of recent decisions is in the roundup of cookie consent fines in 2025 and 2026.
| Regulator | Action | Year | Key issue |
|---|---|---|---|
| CNIL (France) | EUR 325M fine, Google | 2025 | Ads between Gmail emails without consent, invalid consent to cookies at account creation |
| CNIL (France) | EUR 150M fine, SHEIN | 2025 | Cookies before any choice, refusal not respected |
| CNIL (France) | EUR 150M fine, Google | 2022 (announced) | Dark pattern cookie banners |
| ICO (UK) | Concerns sent to 134 of the top 200 sites | 2025 | Consent and transparency failures |
These are not fringe actions. They represent a coordinated trend across multiple jurisdictions, with the EDPB driving consistent interpretation of what counts as valid consent.
Third-party cookies are not going away in Chrome either
People who ask when cookies will go away are usually thinking of Google's plan to end third-party cookies in Chrome. That plan is over. Google dropped it in July 2024, later said Chrome would keep its current approach to third-party cookie choice, and on 17 October 2025 retired most of its Privacy Sandbox technologies, including Topics and Protected Audience. As of October 2026, Chrome still allows third-party cookies by default. Safari and Firefox block or isolate them.
None of this removes the need for a banner. Browser-level blocking addresses third-party cookies only. First-party analytics cookies, persistent functional cookies, and server-side tracking that writes to the device still require consent under Article 5(3). A browser cannot present the specific, informed disclosure about each cookie's purpose, duration and third-party involvement that the GDPR demands, nor record proof of consent for regulators.
The EU cookie banner rule after the ePrivacy Regulation
The EU spent eight years trying to replace the ePrivacy Directive with a directly applicable ePrivacy Regulation, proposed in January 2017. The Commission announced the withdrawal in its 2025 work programme, and the European Parliament's Legislative Observatory records the proposal as withdrawn on 6 October 2025. More detail is in the update on the ePrivacy Regulation's status.
The ePrivacy Directive stays in force. The live reform track is now the Digital Omnibus proposals, published on 19 November 2025, which would move the cookie rules into the GDPR and let browsers send a consent signal (a new Article 88b). As of October 2026 the proposal is still with the Parliament's committees, with no position adopted. The Council's compromise text of 18 June 2026 dropped Article 88b entirely, according to noyb, which published the change on 23 June 2026. A banner might change form, but a consent interface stays.
Why the cookie banner has outlived every reform
The UK's Data (Use and Access) Act 2025 shows banners survive reform
The UK's Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, and its cookie changes took effect on 5 February 2026. It amends the Privacy and Electronic Communications Regulations (PECR), the UK's version of the ePrivacy rules, and moves the exceptions to the consent requirement into a new Schedule A1 to PECR.
Schedule A1 lists storage that is strictly necessary, giving security, fraud prevention, fault detection and automatic authentication as examples. It adds three exceptions: collecting information for statistical purposes to improve a service or website, adapting a site's appearance or functionality to a visitor's preferences, and locating a visitor who asks for emergency assistance. The statistics and appearance exceptions only apply if visitors are told and given a simple, free way to object.
Advertising, marketing, behavioural targeting and ad measurement cookies still require consent. The DUAA also raised the maximum fine for PECR breaches from GBP 500,000 to GBP 17.5 million or 4% of global annual turnover, whichever is higher. The UK relaxed the rules for a few low-risk uses and raised the cost of getting the rest wrong. For most UK sites with advertising tags, the banner stays, though it may now ask about fewer things.
In its final storage and access technologies guidance, published on 29 April 2026, the ICO reflects the law as it stands. Its review of regulation 6 of PECR for online advertising is a separate piece of work, with updates still to come.
Do you need a cookie banner in 2026?
As of October 2026, the short answer depends on where your visitors are:
EU visitors: yes, for any non-essential cookie or similar technology. Article 5(3) and its national laws apply, and no exemption covers advertising or most analytics.
UK visitors: yes, for advertising and marketing tags. First-party statistics and appearance settings can run without opt-in consent, if visitors are told and can object.
US-only visitors: usually not a European-style opt-in banner, but state laws such as the CCPA and CPRA require opt-out links and, in a growing number of states, honouring signals such as Global Privacy Control.
Regions without opt-in banners still need choices
The CCPA and CPRA in California use an opt-out model, requiring a "Do Not Sell or Share My Personal Information" link rather than a pre-access consent prompt. Many other US states now have comprehensive privacy laws, most following a similar opt-out pattern.
Brazil's LGPD lists consent as one of ten legal bases for processing, and its enforcement authority, the ANPD, has issued cookie guidance that increasingly aligns with European expectations. PIPEDA in Canada requires meaningful consent for collection and use of personal information, though its approach to cookies is less prescriptive than the EU's.
For any website with a global audience, the strictest applicable standard tends to set the floor. If even a fraction of your traffic comes from the EU or UK, you need a consent mechanism that meets the GDPR and ePrivacy requirements. Running separate banners per jurisdiction adds complexity, which is why consent tools show different rules for each region from one setup.
Consent fatigue is real, but it does not remove the obligation
Consent fatigue is a genuine usability problem, and regulators acknowledge it.
So far, the response has been to make consent less repetitive, not to remove it. The Global Privacy Control (GPC) signal is a machine-readable opt-out already recognised under California law. The EU's browser-signal idea in Article 88b would have done something similar for consent, and its future now depends on the Parliament and the final negotiations. These developments may reduce how often a banner appears, but they do not remove the obligation to obtain, record and respect consent. A website running WordPress, Shopify or a custom stack still needs a mechanism that meets Article 5(3).
Still unsure? Quick answers
Are cookie banners legally required or just best practice?
They are legally required under EU and UK law for non-essential cookies. Article 5(3) of the ePrivacy Directive requires prior consent, and the GDPR defines what valid consent must look like. Failing to obtain valid consent can lead to fines of up to EUR 20 million or 4% of global turnover under the GDPR.
Will browsers eventually replace cookie banners?
Not under current law. Browser controls block third-party cookies but cannot give the specific, informed disclosure the GDPR requires, and the EU's plan for browser consent signals was dropped from the Council's text in June 2026.
Does the UK still require cookie consent after the Data (Use and Access) Act 2025?
Yes, for most non-essential cookies. Since 5 February 2026, first-party statistics and appearance settings can run without opt-in consent if visitors are told and can object, but advertising, marketing and behavioural targeting cookies still need consent. PECR fines can now reach GBP 17.5 million or 4% of global turnover.
Can I use legitimate interest instead of consent for cookies?
Not for storing or reading information on a device. Article 5(3) of the ePrivacy Directive allows only consent or the strictly necessary exemption, so legitimate interest under the GDPR cannot replace consent for analytics or marketing cookies in the EU.
What happened to the ePrivacy Regulation that was supposed to replace the Directive?
It was withdrawn. The Commission announced the withdrawal in its 2025 work programme, and the proposal was formally withdrawn on 6 October 2025. The ePrivacy Directive stays in force, and the Digital Omnibus is now the main reform proposal.
When will cookies go away?
Not soon. Google stopped its plan to end third-party cookies in Chrome in 2024 and retired most of its Privacy Sandbox replacements in October 2025, and first-party cookies remain essential for logins, baskets and settings.
See what your site sets before it asks
If your website sets any non-essential cookies, from analytics to marketing tags and social media embeds, the banner has to know about them first. The Cookie scanner lists every cookie your site sets and the category each belongs to, so you know what your banner must ask about.
