Is a cookie banner still required in 2026?

It depends on what your site writes to or reads from the visitor’s device. The rule in force on 1 September 2026 is still Article 5(3) of the ePrivacy Directive 2002/58/EC: consent is required as soon as a site accesses the device for a purpose that is not strictly necessary for the service the user asked for. A site that loads advertising pixels falls inside that scope. A site whose audience measurement never touches the device has no analytics cookie to get accepted, but still has to check every other tool it loads. This page sets out dated facts; it does not replace your own legal analysis.

No, and it has not been adopted. The Digital Omnibus is a draft regulation put forward by the European Commission on 19 November 2025 under reference COM(2025) 837. On 1 September 2026 it is still under negotiation and produces no legal effect. Article 88b, the provision that would have made browser-level consent signals binding, was in fact dropped from the Council position of 18 June 2026: only the European Parliament could bring it back. No text in force abolishes cookie banners today.

Still under negotiation. The Council of the European Union has not reached a qualified majority: the Cypriot presidency withdrew its compromise text before handing over to the Irish presidency on 1 July 2026. The European Parliament has not settled its position. In the most optimistic scenario, adoption would come at the end of 2026 and application in 2027 at the earliest. Until then the text can still change substantially, as the deletion of Article 88b showed.

It is not a legal obligation, it is a Google requirement. Since early March 2024, visitors from the European Economic Area whose consent choice is not passed to Google are excluded from the audiences its advertising products use. Consent Mode v2 adds two parameters, ad_user_data and ad_personalization, introduced in November 2023 under the Digital Markets Act, alongside analytics_storage and ad_storage. If your site uses no Google advertising or measurement product, the question does not arise for you.

Shopify itself sets cookies that its own cookie policy lists under Reporting and Analytics, including _shopify_y, with a one-year lifetime. Those are subject to consent in the European Union, and they are set whatever measurement tool you add on top: switching analytics does not remove that line. Shopify provides a built-in consent banner and a Customer Privacy API to record the visitor’s choice. So the answer is yes, and it is not up to you.

No: the European Commission withdrew it. The withdrawal appears in the Commission work programme 2025, COM(2025) 45 final of 11 February 2025, at entry 29 of its annex of withdrawals, under reference COM(2017) 10 final / 2017/0003 (COD). The stated reason is that no agreement was expected from the co-legislators and that the proposal had become outdated, after eight years of deadlock. The ePrivacy Directive 2002/58/EC and its national transpositions remain in force: the 2002 text is still the one that applies.

If your site only loads Snorklee, there is no analytics cookie to get accepted: to count a visit, Snorklee neither writes to nor reads from the device, no cookie, no localStorage, no sessionStorage. The only possible write is an opt-out flag, snorklee_optout, which the visitor switches on themselves. But Snorklee removes one reason for a banner, not all of them: every other tool on your page keeps its own obligations. So the answer depends on the whole page, never on the measurement tool alone.

Yes. In two decisions of 1 September 2025, the French regulator CNIL fined Google LLC and Google Ireland Limited 325 million euros, and Infinite Styles Services Co. Limited, Shein’s Irish subsidiary, 150 million euros. At Google, refusing advertising trackers during account creation was harder than accepting them, and nothing said that access to the services was conditional on that placement. At Shein, advertising trackers were dropped before any consent, and refusing had no effect.

No: that deadline is Indian, not European. It comes from India’s Digital Personal Data Protection Act, the DPDP Act, and its implementing rules: an entity that wants to operate as a Consent Manager must register with the Data Protection Board of India before 13 November 2026. No European Union text creates an official register of Consent Managers, not the GDPR, not the ePrivacy Directive, not the Digital Omnibus proposal. Mixing the two means preparing a European site for an obligation that does not apply to it.