ADPC in action.

Brussels Eyes Browser-Based Privacy Controls as Cookie Banners Face Legal Scrutiny

By E. Vandermeer • 6 min read

European regulators are examining whether browser-level privacy signals could replace the cookie consent banners that have frustrated users and compliance officers alike since 2018. The push follows a wave of enforcement actions targeting deceptive consent interfaces, with several data protection authorities issuing fines against dark patterns that nudge users toward accepting tracking.

The Advanced Data Protection Control specification, developed by researchers at noyb and Vienna University of Economics and Business, proposes a machine-readable format for communicating privacy preferences. A supporting browser extension or built-in browser feature would transmit the user’s standing choices as an HTTP header, eliminating the need for per-site pop-ups.

Proponents argue the approach aligns with the GDPR’s requirement for freely given, specific, and informed consent. Critics from the advertising industry contend that bundled browser-level choices cannot capture the granularity required by consent frameworks that distinguish between dozens of processing purposes. The debate is shaping the agenda for the upcoming revision of the ePrivacy Regulation.

Standardisation bodies are moving cautiously. The W3C’s Privacy Interest Group has noted that any browser-based signal must be resistant to publisher overrides and must give users a clear mental model of what their choice covers. Several browser vendors have expressed interest but stopped short of commitments, citing interoperability questions with existing consent management platform infrastructure.