GDPR Article 88b · Policy & Law

ADPC is the rights-first implementation path for Article 88b.

Proposed GDPR Article 88b would move Europe beyond repetitive consent interfaces by enabling automated and machine-readable choices. ADPC is the strongest current candidate for implementing that vision in a way faithful to EU law.

Legislative progress
COM(2025) 837
Digital Omnibus Proposal
Published
Joint Opinion 2/2026
EDPB / EDPS Position
Adopted
ST-15698-2025
Council Working Party
Received
Art. 88b
Legal basis
GDPR
Framework
Article 88b

What proposed Article 88b
would change.

Article 88b would require controllers’ online interfaces to allow data subjects to give consent, decline consent requests and exercise the right to object through automated and machine-readable means. It would also require controllers to respect those choices once relevant standards are available.

This is more than cookie reform. It addresses a deeper execution gap: rights exist in law, but they are not sufficiently embedded in digital architecture. Without a user-side communication layer, consent and objection remain dependent on interfaces controlled by the same actors seeking data access.

Rights
GDPR + ePrivacy
Standards
Art. 88b mandate
Implementation
ADPC protocol

Article 88b creates a legal pathway from rights, to standards, to interoperable implementation. ADPC gives that pathway a concrete starting point.

Why ADPC Fits

Why ADPC fits Article 88b
better than binary signals.

The EU framework requires prior, specific and informed consent, as well as easy refusal, withdrawal and objection. A single global opt-out flag cannot carry that full legal structure. ADPC can.

Rights-first by design

ADPC allows general and specific choices, domain-specific interaction, purpose-sensitive requests, and withdrawal of earlier consent. It encodes EU legal grammar, not advertising-market convenience.

Purpose-sensitive by architecture

ADPC can communicate specific consent decisions, withdrawal of specific or all prior consent, and objections where legally relevant, covering the full spectrum of GDPR rights communication.

Opt-in compatible by law

ADPC integrates with user-side software that can remember and revise decisions. It supports consent as well as refusal, withdrawal and objection, matching the full grammar of EU data-protection law.

Policy Benefits

What the EU gains from
an ADPC-like standard.

A rights-first, machine-readable standard creates value across the full ecosystem: citizens, businesses, regulators and digital markets.

Stronger practical rights

Rights that are embedded in digital architecture are rights that can actually be exercised. ADPC makes consent, refusal, withdrawal and objection operational, not theoretical.

Less consent fatigue

Preferences set once, applied everywhere. Fewer manipulative interface loops. People spend less cognitive effort on privacy decisions, without sacrificing control.

Legal certainty

A common standard reduces ambiguity for controllers and CMPs. Compliance decisions are clearer, enforcement is more consistent, and legal risk is reduced across the board.

Lower compliance costs

Duplicated consent infrastructure is replaced by a shared layer. SMEs and startups benefit most: the compliance burden shrinks when the solution is standardised.

Reusable compliance layer

The same standard extends across websites, digital identity, data spaces, IoT, mixed reality and AI-mediated services. One framework, many environments.

EU digital sovereignty

The technical grammar of rights expression should reflect European law and values. An EU-designed standard prevents the adoption of frameworks built for different legal environments.

Learning from the Past

The right lesson from DNT and GPC.

Do Not Track showed that a technical signal without legal force is not enough. Global Privacy Control shows that legally recognised signals can matter, but also that a binary opt-out mechanism reflects a different legal environment.

Europe should learn from both without importing the wrong model. Article 88b needs a European, law-first, opt-in-compatible implementation. ADPC is built for that role.

ADPC: Law-first vs DNT: No legal force vs GPC: Binary opt-out only
Implementation Principles

Adopt and improve.

Must not create consent by default

Must include all relevant actors, not only first-party websites

Must extend beyond classical browsers to all software classes

Must avoid broad exceptions that recreate consent fatigue

Must include clear enforcement powers

Must be maintained as a living standard that evolves with technology and case law

Make Article 88b operational.

A strong Article 88b needs a strong standard. ADPC offers a concrete starting point: publicly specified, legally aligned, interoperable and extensible beyond today’s web.