Cookie banners are not going to fix themselves. The EU is now considering scrapping them entirely, and the case for doing so is stronger than it looks.
You know the drill. You open a website and before you can read anything, a banner slides up asking whether you accept cookies. You click agree. You always click agree.
Everyone clicks agree. The banner disappears and you get on with your life, having consented to something you did not read, do not understand, and cannot reverse.
This is the system working as designed. That is the problem.
What cookies actually are
A cookie is not inherently sinister. It is a small piece of data a website stores on your browser so it can remember you between pages, keep you logged in, save items in your basket. Without cookies, the internet would be considerably less functional. The technology is neutral.
The tracking use is different. Advertising technology companies worked out that cookies could also follow you across websites, building profiles of your behaviour, your interests, your income bracket, your politics. That data is used to target you with advertising. This is what the banners are nominally about: giving you the right to refuse that kind of cross-site tracking.
How banners were born
The legal origin is the EU's e-privacy directive, passed in the early 2000s, out of concern about online advertising and user surveillance. The directive did not mandate cookie banners specifically. It said users should have the right to refuse certain kinds of data processing. The industry interpreted that requirement and, through lobbying and regulatory capture, arrived at the banner as its answer.
The GDPR, which came into force in 2018, is often blamed for the explosion of banners across European websites. But they were already widespread before it passed. The GDPR accelerated the trend rather than starting it.
Taking part in The Verge podcast, Kate Klonick, a professor and writer who spent time in Paris on a Fulbright scholarship researching the EU's Digital Services Act, wrote recently that cookie banners should not be reformed or made smaller. They should be abolished.
Living in Europe and relying on her phone for translations, directions and currency conversions, she found herself hitting consent walls dozens of times a day for basic information. That experience, she argues, is not a bug in the system. It is the system.
Manufactured consent
The deeper problem Klonick identifies is what she calls manufactured consent. The banner creates the appearance of choice while delivering none. Users who decline cookies are sometimes locked out of the site entirely.
Those who accept have consented to terms they have not read and cannot meaningfully evaluate. The banner satisfies the letter of privacy law while hollowing out its purpose.
This suits everyone except the user. Tech companies get their tracking data and a legal fig leaf. Regulators can point to a compliance mechanism. The burden falls on the individual, asked hundreds of times a day to make an informed decision about data processing, with neither the time nor expertise to do so.
Research on terms of service has shown that people will agree to almost anything if the cost of refusal is high enough. One study embedded a clause requiring users to surrender their firstborn child. People clicked agree anyway.
The EU is now reconsidering the regulations that produced this outcome. The European Commission has reopened the question of whether the e-privacy framework needs rebuilding. Klonick argues that no banner at all would be preferable to the current fiction of consent.
The broken light switch has been in the wall for twenty years. It is time to rewire it.