Proposal: consent and objection via machine-readable browser signals (new Article 88b GDPR)

What it is about

Controllers would have to ensure their online interfaces accept consent, refusal and objection (Article 21(2)) through automated, machine-readable means, and must respect those choices. Media service providers are exempt when providing a media service. The Commission would request European standardisation organisations to draft standards; conformity with a harmonised standard gives a presumption of compliance. The obligation for controllers would apply 24 months after entry into force; web browser providers that are not SMEs would have to offer the technical means after 48 months. On 8 June 2026 Coreper gave guidance for further work specifically on this centralised consent signal for cookies and on the absence of an impact assessment for it.

What this means in practice

If adopted, your website or app would have to read and honour browser signals within two years of entry into force, and could not ignore a browser-level refusal. Your consent management tool would need updating. Media service providers are exempt. This element is still under discussion in the Council, so the final text may differ.

The GDPR articles concerned

• Article 7: Conditions for consent
• Article 21: Right to object
• Article 88: Processing in the context of employment