A coalition of 19 civil society organisations, businesses and academics published an open letter on 10 September 2026 asking European Union institutions to put back into the Digital Omnibus the article that would force websites and apps to obey an automated privacy signal sent from a browser or an operating system. The provision, Article 88b, was removed from the Council's negotiating text in June. The letter names the Irish presidency, two parliamentary co-rapporteurs and two members of the European Commission, and it asks each of them for something specific.

In Short

Nineteen consumer and digital rights groups wrote to EU decision makers asking them to save a rule that would let a browser tell every website, automatically, whether tracking is allowed. If it survives, most cookie pop-ups disappear and the consent decision moves from the page to the device. If it does not, the banner stays, and so does every measurement and consent-rate problem attached to it.

What the letter asks for

The document carries the subject line "Joint call to replace cookie banners with automated signals" and cites the Commission text as COM(2025) 837 final. It is addressed to Members of Parliament, to the co-rapporteurs MEP Kaljurand and MEP Salla, to Permanent Representatives, to Ambassador Aingeal O'Donoghue, and to Executive Vice President Virkkunen and Commissioner McGrath.

Four distinct requests follow. According to the letter, the coalition calls on the Irish presidency to re-insert Article 88b into its next compromise text and to restart discussion among Member States. It calls on Member States that have expressed doubts to reconsider. It calls on MEPs of all political groups, and on the two co-rapporteurs in particular, to broker a solution from the amendments already tabled in the parliamentary committees. And it calls on the Commission to defend the measure and to treat it as a political priority within the wider package.

The framing is unusual for a civil society intervention on the Digital Omnibus. The coalition does not defend the package. It attacks it. According to the letter, Article 88b is the only "simplification" measure in a set of mainly business-oriented and protection-reducing provisions that would actually benefit people. The campaign website repeats the disclaimer in a footnote, stating that most other parts of the reform are problematic and would weaken people's rights.

The coalition operates under the name "Kill the cookie banner" and maintains a site at killthecookiebanner.eu. According to noyb, which distributed the letter to media on 10 September at 07:00 Central European Time, the group currently numbers 19 organisations, businesses and academics.

Who signed

The signature block on the letter carries nineteen logos. The European Consumer Organisation, Check My Ads, the Civil Liberties Union for Europe, European Digital Rights, the Electronic Frontier Foundation, Enforce, noyb and Stichting Data Bescherming Nederland appear first. A second group follows: the AI Accountability Lab, ApTI, a digital humanism research centre, the Spanish consumer federation CECU, Data Rights, EKO, Forbrukerradet, Homo Digitalis, Kobler, the Sustainable Computing Lab and Que Choisir Ensemble.

The campaign website presents the same names in two tiers, separating organisations leading the initiative from those supporting it, and it carries an open invitation for further organisations to join. The count is therefore a snapshot rather than a fixed roster, and noyb's own wording, "currently 19", acknowledges as much.

The mechanism under dispute

Article 88b would insert into the General Data Protection Regulation an obligation for controllers to accept consent, or refusal of consent, transmitted automatically rather than collected through an on-page interface. PPC Land covered the provision in November 2025, including the six-month transition period and the exemption originally drafted for news media and press publishers.

The technical family is not new. According to the letter, technical concepts for privacy signals were already developed in the 2000s, and what has been missing in Europe is a legal framework and a standard rather than an implementation. Global Privacy Control, the signal the letter names directly, is a single-value HTTP request header that is legally binding in several United States jurisdictions. A peer-reviewed study published in May 2026 found that the signal could reduce but not eliminate European consent banners without legislative clarification, precisely because Article 5(3) of the ePrivacy Directive attaches to device storage regardless of whether data is later sold.

The letter also points to Advanced Data Protection Control, described in a footnote as developed by the Vienna University of Economics together with civil society groups including noyb. According to the coalition, ADPC goes further than an opt-out: it allows a user to opt in to specific purposes and specific controllers, which is the property that would let most banners disappear rather than merely defaulting to refusal. The noyb media update adds a second European implementation, navigator.consent, without further technical description.

That distinction matters commercially. An opt-out-only signal removes inventory from the addressable pool. A signal capable of carrying granular permission can restore it, provided the permission is legally valid consent. According to the annex, consent expressed through a signal would have to satisfy every requirement of Article 4(11) GDPR, and signals would have to allow choices to be expressed per controller and per purpose, so that a local newspaper and a large platform can receive different answers.

Six conditions in the annex

The letter attaches a one-page annex setting out what the coalition believes Article 88b must contain. The list reads as a direct response to the technical objections raised against the provision over the past year.

First, consent by signal must meet the Article 4(11) standard, with per-controller and per-purpose granularity.

Second, anyone accessing information in terminal equipment must respect a legally valid signal. According to the annex, a signal expressing refusal, withdrawal or objection should prevent the corresponding access or processing and take precedence over any later consent request covering the same processing, unless the user actively changes the setting.

Third, dominant firms must not control the plumbing. The annex names gatekeepers under the Digital Markets Act, and Google specifically in relation to browsers, as actors that should not be able to design or manage signals in a way that entrenches market power. Dominant browsers and mobile operating systems would instead be required to facilitate transmission, a duty the annex compares to California's Opt Me Out Act, AB 566.

Fourth, the legal meaning, scope and effect of signals must be fixed in Union law rather than delegated. Technical standards would be confined to interoperability and implementation, and would not be permitted to redefine or weaken rights. The annex asks that civil society organisations be invited into the standardisation process.

Fifth, refusal must persist. According to the annex, signals expressing refusal, withdrawal or objection should remain effective until the user changes them, and providers should not circumvent them through repeated consent requests, interface design, changes in terminology or other technical means. Users should not face degraded access or functionality merely for having sent one.

Sixth, browsers, operating systems, applications and independent user agents must be able to transmit signals without gatekeeper interference and without additional tracking attached.

Point five is the operational heart of the document for anyone running a consent management platform. A persistent, precedence-taking refusal signal would end the practice of re-prompting a visitor on every session, which is currently one of the mechanisms by which aggregate acceptance rates are sustained.

How the file reached this point

The European Commission published the Digital Omnibus on 19 November 2025 as a consolidation of the GDPR, the ePrivacy Directive, the Data Act and several cybersecurity instruments. PPC Land reported at the time on the broader GDPR amendments benefiting AI developers and on the changes to legitimate interest, personal data and breach thresholds. The Netherlands filed formal concerns in December 2025, noting a phase-in of two years for the first two paragraphs of Article 88b and four years for paragraph six.

The European Data Protection Board and the European Data Protection Supervisor adopted a joint opinion on 10 February 2026. That document rejected much of the package while strongly supporting the automated signal concept, and it regretted the absence of a full impact assessment.

Industry moved against the article in parallel. Alliance Digitale, the French trade body representing 300 member organisations and acting as the French arm of IAB, FEDMA and GDMA, published a 17-recommendation position paper on 21 May 2026 that called for Article 88b to be deleted entirely, on the grounds that interpreting browser-level signals would demand deep adaptation of existing tracking, consent and monetisation infrastructure.

On 18 June 2026 the Council removed the article from its compromise text. PPC Land's coverage of that decision set out the lobbying record, the role Google played, and the revenue estimates circulating in Brussels at the time, derived by consultants from Apple's App Tracking Transparency rollout as a proxy. Germany, France and Poland were identified by noyb as Member States that pushed for removal. The exemption for media service providers vanished along with the article it sat inside.

The September letter is the response to that removal, and it is addressed at the only two bodies that can reverse it: the Council presidency, now held by Ireland, and the Parliament, which has still not adopted a position.

Quantifying the claim

The campaign rests on a gap between what people accept and what they want. According to the campaign website, current banner design produces acceptance in up to 90 per cent of cases while only around 3 per cent of people actually want to be tracked online. Neither the website nor the letter cites the underlying study for those two figures, and the number at the lower end has been stated elsewhere by noyb as a range rather than a point estimate.

The time claim is looser still. According to noyb, automated signals would save Europeans hundreds of millions of hours currently spent on consent banners every year. No methodology accompanies the figure in the material distributed to media.

Cláudio Teixeira, Head of Digital Policy at the European Consumer Organisation, said: "Automated signals is the only proposal from the Commission's Digital Omnibus aimed at actually simplifying the life of consumers."

Itxaso Dominguez de Olazabal, Policy Advisor at European Digital Rights, said: "ePrivacy and the GDPR already protect people, but the industry has turned consent banners into a maze of clicks."

Ursula Pachl, Head of Policy at noyb, said: "There is no valid justification to drop the Commission's proposal for Article 88b and to uphold the current cookie banner disaster."

The "kill switch" argument

One passage in the letter reads as a direct rebuttal rather than an appeal. According to the coalition, some stakeholders have deliberately characterised Article 88b as a "kill switch", a reading it describes as incorrect and at odds with what the Commission proposed. The counter-argument offered is that the mechanism permits consent as well as refusal in advance, which keeps users out of reach of dark patterns in banner interfaces while reducing repetitive prompting.

The distinction is not rhetorical. A signal that can only say no functions as a permanent global opt-out, and the ad-funded web would lose addressable reach in proportion to adoption. A signal that can also say yes, per controller and per purpose, changes the interface through which permission is collected without necessarily changing how much permission exists. Which of the two Article 88b would produce depends on the standard, and the standard does not yet exist.

The coalition's own material contains a small inconsistency on this point. The campaign website states that a user could set preferences once and never see another banner. The media update distributed the same day states that a user would very rarely see another banner. The second formulation is the accurate one under the annex as drafted, because per-purpose granularity implies that some requests would still surface.

What it changes for advertising operations

For advertisers and publishers, the immediate consequence of the June removal is that nothing changes. The banner stays. The consent management platform stays. The Transparency and Consent Framework string stays. Every failure mode documented over the past two years stays with them, including the case PPC Land examined in its guide to European consent changes, in which a client's Google Ads conversions fell 90 per cent overnight because a banner was collecting choices without transmitting them.

Enforcement pressure on the existing model has not eased while the legislative file has stalled. The European Data Protection Board issued a binding decision in July 2026 that reopened a dismissed noyb cookie complaint in Belgium, confirming that a representative organisation operating at scale does not thereby lose standing. noyb filed a complaint in Austria on 30 July 2026 over a banner naming 1,741 partners, calculating that reading every partner policy would take 172 hours. A joint complaint with the Norwegian Consumer Council against Schibsted's pay-or-okay implementation was filed in June 2026.

The strategic question for media buyers sits in the timing. Article 88b, if restored in the form the annex describes, would take two years to apply to websites and four years to apply to browsers and operating systems. That is slower than the enforcement cycle currently running against banner design, and slower than the commercial decisions being made now about first-party data architecture and server-side measurement. A provision that is still contested in trilogue and would not bite until 2028 at the earliest is not a near-term planning variable. What it does establish is the direction of travel: the point at which consent is expressed moves from the page to the device, and the party that controls the device gains bargaining power over the party that controls the page.

That is also why the annex spends a full paragraph on gatekeeper conduct. The coalition is asking for a rule that shifts the consent decision to the browser while simultaneously asking that the browser vendors not be allowed to shape it. Whether those two requests can be satisfied by the same text is the question the European Parliament now has to answer.

Timeline

Summary

Who: A coalition of 19 civil society organisations, businesses and academics operating as "Kill the cookie banner", including the European Consumer Organisation, European Digital Rights, noyb, the Electronic Frontier Foundation, Check My Ads and the Civil Liberties Union for Europe. The letter is addressed to Ambassador Aingeal O'Donoghue for the Irish Council presidency, to co-rapporteurs MEP Kaljurand and MEP Salla, to Members of Parliament and Permanent Representatives, and to Executive Vice President Virkkunen and Commissioner McGrath at the European Commission.

What: A joint open letter and technical annex calling for Article 88b of the Digital Omnibus, COM(2025) 837 final, to be re-inserted and improved. The provision would oblige controllers to respect automated privacy signals transmitted from browsers, operating systems and other user agents. The annex sets six conditions, covering Article 4(11) consent validity, per-controller and per-purpose granularity, precedence of refusal over later consent requests, limits on gatekeeper control of the signal layer, a Union-law definition of legal effect ahead of standardisation, and persistence of refusal without degraded service.

When: The letter was published on 10 September 2026 and distributed to media at 07:00 that day. It follows the Commission proposal of 19 November 2025, the EDPB and EDPS joint opinion of 10 February 2026, and the Council's removal of Article 88b from its compromise text on 18 June 2026.

Where: Brussels, addressed to the European Parliament, the Council of the European Union under the Irish presidency, and the European Commission, with effect across the 27 Member States.

Why: According to the coalition, the mechanism is the only measure in the Digital Omnibus that delivers simplification for people rather than for businesses, and its removal from the Council text leaves European users with a consent-banner model the campaign describes as broken by design. For the advertising industry, the provision determines whether the point of consent moves from the page to the device, and whether browser and operating system vendors gain control over the signal that decides how much inventory remains addressable.