At the bottom of this site there is no cookie wall. There is a notice: this site is a provocation to the GDPR. No “Accept all” button, no “Manage preferences” button, no list of 847 partners processing your behaviour under “legitimate interest”. If you don’t like it, you are free to leave. That is rude. It is also the point.
Here is why.
Strictly speaking, my quarrel is not with the GDPR itself but with the ePrivacy Directive — in the Netherlands, Article 11.7a of the Telecommunications Act. But the Digital Omnibus moves the cookie rule into the GDPR, so that is where this fight will be decided.
I was there when it started
In 2002 I was CTO of the once-notorious Ab.Fab. We faced the Dutch internet provider XS4All in the very first spam case in the Netherlands. The headline read: King of Spam brought down by lawsuits. What followed was meant to curb e-mail abuse. The result was a single law in 2004: opt-in for marketing e-mail, and the first cookie rule. Eight years later, that became the cookie banner. The spam folder turned out to be the real solution. The rules stayed.
Years later I sat on the other side of the table. At Vakantieveilingen, a Dutch holiday auction site, I lost tens of percent of my team to DPIAs, a central opt-out service across 23 subsystems, and consortium-wide cookie consent within a media holding of more than a hundred websites, each with its own architecture. What did our customers get in return, apart from a higher cost price?
The bill nobody sees
The cost of the cookie law appears on no budget as “cookie law”. It hides in licences for consent platforms, legal reviews, consent modes in tag managers, A/B tests because a banner hurts conversion, and developers spending months debugging the state of “analytics yes, marketing no, pixel half-loaded”. Every organisation builds the same thing again. Multiply that by every website in Europe.
And then the citizen. New phone: click again. Cleared your cache: click again. Different site: click again. Billions of times a day, Europe answers the same question, and the answer is remembered nowhere it matters.
What the banner protects
Very little. People click through because they want to read the article. And whoever clicks “accept” lawfully consents to remarketing, to real-time bidding, to their behavioural profile being shared with hundreds of parties. In March 2024 the European Court of Justice ruled that even the consent string of IAB Europe’s advertising ecosystem is personal data. The machine simply keeps running — with consent.
That is the core of it. The most repulsive cookie policies are perfectly legal, as long as somebody clicked. The banner protects no privacy. It legitimises tracking, and shifts the responsibility onto the visitor’s tired thumb.
Where the choice belongs
Your privacy preference is a property of you, not of the website. You set your language once, in your browser. No site asks you afterwards whether you might speak Dutch after all. Cookies could work exactly the same way: one setting, in your browser or operating system, synchronised across all your devices, and legally binding on every site you visit.
It has been tried. Do Not Track existed as early as 2009. It died because nobody was obliged to listen to it. A standard you cannot build on is merely vigerend.
Europe nearly fixed it
On 19 November 2025 the European Commission proposed exactly this in the Digital Omnibus. Article 88b: consent and refusal through automated, machine-readable signals; browsers must make them possible, websites must respect them. At last.
On 18 June 2026 the Council struck the article out again — according to the privacy organisation noyb, at the urging of Germany, France and Poland among others. Shortly before, a study commissioned by Google had calculated that browser signals would cost European businesses 40 to 50 billion euros a year in advertising revenue. In the Council text of October 2026 the signal is still gone. The European Parliament has not yet taken a position.
Forty to fifty billion. That is what the banner protects. Not your privacy.
My provocation
This site asks nothing. It uses Google Analytics to see which pieces get read, and says so plainly in the privacy policy. No remarketing, no profiles, no partners. And it already does what I ask of the law: through Google Consent Mode, a browser that sends a Global Privacy Control or Do Not Track signal gets no analytics cookies at all. No law requires that. No banner was needed for it either. Legally, I am on thin ice, and I know it. That is precisely the point: a regime that makes the honest small site owner choose between a meaningless banner and an infringement, while the advertising industry collects lawful consent with a single click, is not a privacy regime. It is a click regime.
My plea for a citizen-friendlier system:
- Consent is a setting, not a pop-up. One choice in your browser or operating system, carried across all your devices.
- The signal is binding. Sites must respect it and may not ask around it.
- Measuring for your own use is not tracking. If all you want to know is which page gets read, you have no reason to bother anyone.
- Whoever wants more must earn it. Sharing profiles is only possible if the visitor has switched that on in their own setting.
Join in. I have joined Kill the Cookie Banner, the European campaign led by noyb, BEUC, EDRi, EFF and others to bring the browser signal back. Write to your MEP — it takes two minutes — and if you run a website yourself, do what this site does: replace the cookie wall with a consent setup that simply listens to the browser. On WordPress that is Google Consent Mode plus the free WP Consent API plugin; an afternoon of work, no banner required.
Members of the European Parliament: put Article 88b back. Until then, this banner stays.
Sources
- European Commission, Digital Omnibus proposal, COM(2025) 837, 19 November 2025
- Taylor Wessing, The Digital Omnibus — cookies (on Articles 88a/88b)
- PPC Land, EU Council drops cookie signal after Google lobbying — EUR 40–50 bn at stake (Council text of 18 June 2026)
- Implement Consulting Group (commissioned by Google), Gone in one click, March 2026
- noyb, Open letter: civil society coalition urges EU to kill the cookie banner, 10 September 2026
- Court of Justice of the EU, IAB Europe, case C-604/22, 7 March 2024
A preview of the Age of Regulation series. More patterns from the history of data: History of Data.