EU cookie banner rules are changing. Will your site still need one?

On 21 October 2026, EU governments agreed their position on the Digital Omnibus, the package that rewrites parts of the GDPR and the cookie rules. Europe does want fewer cookie banners: the text lets a website skip the consent request for a short list of purposes, including counting its own visits. If you run a small business website with Google Analytics and a Meta Pixel, the question is whether your cookie banner can go. With the pixel, it stays. What the reform changes is how much has to sit behind it, and you can only answer that with a list of the tags on your site.

TL;DR: The EU Council agreed on 21 October 2026 to let websites skip cookie consent for a few purposes, such as their own aggregated visit counting, and to make refusing a single click. Nothing applies yet, and lawyers expect nothing before 2027. Any site running an ad pixel keeps its cookie banner. Sort your tags by purpose now.

What did EU governments agree about cookie banners?

The Council of the EU's position keeps cookie consent as the rule and adds exemptions. Under the text, a website can store or read information on a visitor's device without asking for six purposes only:

• sending the communication itself;
• a service the visitor explicitly asked for, such as a basket, a login or a language setting;
• first-party audience measurement: counting visits to your own site into anonymous, aggregated figures, done by you or by a supplier working for you;
• audience measurement by media companies under the European Media Freedom Act;
• keeping the service or the device secure;
• measuring the display and performance of contextual advertising, meaning ads matched to the page rather than to the person.

The text also sets rules for the banner. Visitors must be able to refuse "with a single-click button or equivalent means", and after a refusal a site may not ask again for the same purpose for at least four months. The Commission had proposed six.

The Commission's November 2025 proposal also let people set their choice once in the browser and obliged sites to respect it. The Council cut that obligation from its draft in June 2026, and it stayed out of the position agreed in October. A Reddit post shared in two EU subreddits on the day of the vote put it bluntly: "The EU had a plan to kill cookie banners."

When do the new cookie rules apply?

Today, none of it is law. The Council is one of three EU institutions involved: the European Parliament still has to adopt its own position, then Parliament, Council and Commission negotiate a final text in talks known as trilogue. Heuking, a German law firm, expects nothing to enter into force before 2027.

Because the cookie rules stay in the ePrivacy Directive, each EU country will then have to write them into its own law, and the draft's own dates for that step don't yet agree with each other. Until the final text is published and applied, the current rules hold: analytics and advertising cookies need consent. A banner with an Accept button and no way to refuse on the same screen already counts as an infringement for a large majority of national regulators, according to the European Data Protection Board's 2023 cookie banner taskforce report.

Removing a banner now on the strength of a Council press release would leave a site in breach of the law that still applies.

Does Google Analytics still need a cookie banner?

Google Analytics still needs consent today, and with its data-sharing settings switched on it would still need it under the Council's text. The exemption covers measurement only where the data collected "are not processed for another purpose, shared with third parties or combined with data from third parties".

Google Analytics has four data-sharing settings in the account's Admin area, and two of them matter here. With "Google products & services" switched on, Google can use your site's data to improve its own products, including Google Ads, and acts as an independent controller of that data. "Modeling contributions & business insights" pools your data with other sites for industry benchmarks. Both are uses for another purpose. Google's help page says that with every setting off, the data is used only to provide and maintain Analytics.

Switching those settings off is the first step toward exempt counting. Whether that will be enough is something the final text and the regulators reading it will decide, and an account linked to Google Ads, or with Google signals switched on to tie visits to signed-in Google accounts for ads, is plainly on the advertising side.

Which other tags would still need consent?

Anything used to track a person for advertising still needs consent under the Council's text: ad pixels, remarketing tags (which show ads to people who visited your site), cross-site tracking, and data fed into automated ad buying. None of those fits the six purposes.

That gives most sites three groups:

• Never needed consent: session and basket cookies, logins, language choice, security checks, and the working parts of a booking engine a visitor uses to book.
• May leave the banner once the rules apply: your own aggregated visit counting, if the tool keeps the data to that purpose.
• Stays behind the banner: the Meta Pixel, Google Ads remarketing, any tag that follows a visitor to show them ads elsewhere, and any analytics or ad tags a booking engine or chat widget adds to your page on its own account.

If your site has only the first two groups, the banner could go once the new rules apply. If it has one tag from the third, the banner stays, and the useful question becomes whether your counting can run outside it.

What happens to our own cookie banner?

We ran sharphaw.com through the same sort, and our banner stays. The site loads four tags: Google Analytics; Google Tag Manager, a container that loads other scripts; PostHog, a product analytics tool that Tag Manager injects; and the Meta Pixel. None of them loads until a visitor presses Accept, and a visitor who presses Decline never downloads any of them. The Meta Pixel alone keeps the banner, because it exists to measure and target ads.

Two of the new rules we already meet. Accept and Decline sit side by side on the first screen of the banner, one click each. A choice is stored for 180 days, so a visitor who declines is not asked again for six months, longer than the four-month minimum, and we ask earlier only when the cookie policy changes because a tracker was added, since a new tracker is a new purpose to ask about. The Council's text allows an early request in that case.

The weak spot is that our banner has one switch for everything. Analytics and marketing share a single Accept, so every visitor who declines also disappears from our traffic reports. Neither of our two analytics tools runs in an exempt setup today. To use the new rules we would keep one, configure it for aggregated counting with every sharing setting off, run it for every visitor, and leave only the pixel waiting for consent. We have not made that change yet, and it is the first one we would make on any site we look after, before anyone touches the banner's design.

What should you do about your cookie banner now?

Keep your cookie banner, and use the time before the rules apply to make it describe your site accurately.

1. List every tag. Open your site, your tag manager and any plugin settings, and write down each script that sets a cookie or sends data out: analytics, pixels, chat widgets, embedded videos, booking widgets.
2. Give each tag one purpose. Necessary, security, your own measurement, contextual ad measurement, or advertising that follows the person. If a tag's supplier can't tell you what it does with the data, treat it as advertising.
3. Open your analytics data-sharing settings and switch off anything that sends your visitors' data to the provider's other products.
4. Check that refusing takes one click on the first screen of the banner. Regulators already expect it, so fix it now.
5. Make sure a refusal is remembered, with the date, so you do not ask again on every visit. That record is what the four-month rule will check.

The mistake to avoid

The tempting reading of the headlines is that cookie banners are on their way out, so there is no point fixing yours. The Council's text points the other way. Banners stay on every site that tracks visitors for ads, and they get stricter rules about refusing and asking again. The sites that gain are the ones that split their tags by purpose, so their own counting can run for everyone once the law allows it, and only the ad tags wait for a yes.

If your tag list turns out longer than you expected, that clean-up is part of the upkeep our Conversion-First Websites service covers. You can see how we build sites in our concept builds, read the plans and fees, or tell us about your site.