Cookie banners in 2026: who exactly is consenting?

Last Thursday I counted. Twenty-three cookie banners between morning coffee and the end of lunch. Nineteen of them had an "Accept all" button rendered in a cheerful primary colour. Four had a "Reject all" button styled as a grey hyperlink buried under a fold-out panel that required three clicks and a loading spinner to reach. One — the website of a well-known British supermarket — had no reject button at all. The only options were "Accept all" and "Manage preferences", where "Manage preferences" opened a second page with 147 individual toggles.

None of this is new. All of it is illegal under current UK law. And yet here we are, at the end of 2026, clicking through cookie banners with the same tired resignation we clicked through them in 2019, 2020, 2021 and every year since.

What the law actually says

The UK Information Commissioner's Office has, for years, been plain about this. Consent must be freely given, specific, informed and unambiguous. A "Reject all" option must be as easy to click as "Accept all". Nudges toward acceptance are not valid consent. The ICO's guide to cookies and similar technologies spells this out in paragraphs that would take a reasonable web team an afternoon to implement correctly.

In November 2023 the ICO wrote to the UK's top 100 most-visited websites warning them that non-compliant banners would be enforced against. Three years on, by my informal lunchtime audit, perhaps a third of those sites are now compliant. The rest have refined the dark pattern: the reject button is a shade lighter, the accept button pulses gently, the "legitimate interest" tab is pre-ticked. The UK government's own guidance on PECR and GDPR has not materially shifted on this point in those years.

The industry's favourite euphemism

"Legitimate interest" is the phrase that does most of the carrying. In a well-designed consent flow it is the escape hatch: the lawful basis a site falls back to for processing a narrow slice of data that genuinely cannot work on consent alone — fraud detection, basic security logging, essential functionality.

In practice, "legitimate interest" has mutated into a second consent model that runs in parallel to the one you were shown. You click "Reject all". A tracker fires anyway, under the vendor's claim that targeted advertising profiling is a "legitimate interest" of theirs — one weighed, according to the vendor, against your rights and found to come out ahead.

The whole model is built on the premise that most users will not know this is happening, and the premise is correct.

Reader, open the second tab of any Transparency and Consent Framework banner (IAB Europe runs the spec; most of the industry uses it). Count the number of vendors listed. On a mid-sized British news website last week I counted 1,847 named "vendor partners". Scroll the list: data brokers you have never heard of, ad networks whose business model is still explicitly profiling you by location and behaviour, analytics firms registered in the Cayman Islands. The TCF was ruled unlawful in its current form by the Belgian Data Protection Authority in 2022; three years on it still underpins most British commercial sites.

The small act of resistance that does not work

You clicked "Reject all". You felt, briefly, as if you had done something. You will have noticed that the same site asks you to do it again tomorrow. This is also not an accident. Consent is in theory remembered via a cookie — ironically — which means the site needs to set a cookie to remember that you did not want cookies. Many sites "forget" that consent cookie within 24 hours and present the banner again. Many more use session-only consent, which resets each time you clear your browser.

I started keeping a small text file. On every site I visit, I log the time I clicked "Reject all" and the time the same banner appeared again. The shortest interval: 18 minutes. The longest: six weeks. The median is under three days. Over three months the average British user clicks away perhaps 400 cookie banners, of which maybe 60 to 100 are repeat appearances on sites they have already said no to. If a shop worked like this — asking you at every door whether you wanted to come in — Trading Standards would have shut it down by the second month.

The browser-level answer that nobody wants to talk about

The clean technical solution has existed since 2019. The Global Privacy Control header is a one-line HTTP flag your browser can send with every request, communicating a blanket preference: do not sell my data, do not profile me. California and Colorado have both written GPC into state law as a binding signal. The GPC project page has the technical detail.

Most British sites ignore it. There is no UK law requiring recognition, and the industry has a comfortable self-interest in preferring the per-site banner model — because the banner model lets you accept, and the universal signal does not. The ICO could, if it chose, state that GPC constitutes a valid objection under UK GDPR; it has not yet. Meanwhile Brave, Firefox, DuckDuckGo and the Privacy Badger extension all send GPC by default. If you use one of those browsers you are quietly broadcasting your objection to every site you visit, and most sites are quietly ignoring it.

Who still believes the banner means anything

Nobody in the ad-tech industry. Nobody at the ICO. Nobody who has read the ICO's own guidance. Possibly a few remaining members of the European Commission. Certainly you, briefly, each time you click "Accept all" to make the box go away so you can read the recipe.

The genuinely infuriating part is not that the banners exist. It is that they exist in bad faith, enforced weakly, and kept in place by a mutual understanding between the industry and the regulator that the cost of compliance is higher than the reputational cost of continued non-compliance. The occasional fine — published on the ICO's enforcement page — makes for reasonable headlines, but the fines are set at a level industry treats as a routine business expense.

What I would like, modestly

I would like a Reject button the same size and colour as the Accept button. I would like my rejection to persist for twelve months, not three days. I would like "legitimate interest" to mean what the law says it means, not a second-chance consent model. I would like my Global Privacy Control header to count as a valid objection under UK GDPR without a Supreme Court ruling. I would like to read a recipe without first processing 1,847 vendor relationships.

I would like, in short, for the cookie banner to be finished. And I would like the industry to stop pretending that the current arrangement is anything other than a dark-pattern buffet dressed up as a privacy menu.

Fail that, and in 2027 I will be counting again, and the number will be higher, and the Accept button will pulse brighter, and the Reject button will have moved yet another click further away. That is a prediction I would like very much to be wrong about. On current evidence, it is not.