The cookie banner that cannot be closed, the mandatory registration before purchasing, the pixel that tracks each email opening. These navigational friction points will soon be gone.
European digital is indeed entering a seemingly paradoxical cycle, but fundamentally coherent: simplifying the regulatory mille-feuille to regain competitiveness, while toughening the fight against practices deemed manipulative. In other words, less administrative redundancies, more requirements on the way in which companies design the user experience.
This cycle is not an additional constraint. This may be the first time that regulation has forced companies to do what they should have done a long time ago: earn trust rather than circumvent it.
The Digital Omnibus, simplifying to better demand
Presented at the end of 2025, the Digital Omnibus embodies the simplification aspect. The text promises at least €5 billion in administrative savings for businesses by 2029; provided it comes into force fairly quickly. Negotiations are still ongoing and the schedule may change, so all the more reason to prepare now.
The most visible change concerns consent to trackers. The project migrates the rules on cookies from the ePrivacy regime to the GDPR, thus unifying the applicable framework and strengthening user rights. Consent remains the principle, but the text lists “exemption” cases where access to the site is possible without prior consent (transmission of a communication, explicitly requested service, aggregated audience measurement, etc.).
To reduce fatigue linked to consent, the text relies on the mechanism of “browser signals”. That is to say the possibility for the user to express their preferences once and for all, directly in their browser. This signal is then automatically transmitted to all visited sites… and thus, no need to re-decide with each new banner. The text also provides that accepting or refusing must be done in a single click, and that after a refusal, no new request can be made within six months. For companies, the message is clear: performance can no longer be based on repeated negotiation at each visit. We must build on solid and durable foundations that combine CMP and browser signals.
Supervise the training of AI models, without slowing down innovation
The text also addresses AI with its “Digital Omnibus on AI”, which answers a concrete question: can a company use personal data to train its AI models? The answer is yes, but under certain conditions. The legal framework of “legitimate interest” can justify these uses, with certain strict guarantees. The text cites in particular the need to implement privacy protection techniques, as well as work to prevent the risks of “regurgitation” (i.e. the fact that a model restores training data word for word) and to anticipate data leaks. However, sensitive data may still remain residually in a model. The obligation is therefore not to achieve a perfect result, but to do everything possible to minimize this risk and prevent this data from being accessible to the public.
This subject is finally part of a broader debate, already lively among data protection authorities: how to precisely define what personal data is in the era of AI? And which corpus is precisely concerned by these protection rules? These questions are already the subject of heated discussions between data protection authorities across Europe.
The Digital Fairness Act (DFA) brings the interface into compliance
At the heart of the DFA, “dark patterns”. Behind these deceptive online interfaces, the question posed is more fundamental: to what extent can a company use human psychology as commercial leverage? Europe provides a response in principle.
Expected for the end of 2026, the DFA will extend to the entire market what the Digital Services Act reserved for large platforms: the ban on dark pattern interfaces and addictive design, but also unprecedented supervision of influencer marketing and unfair personalization. The diagnosis is also economic… The Commission estimates the financial damage linked to problematic online practices at €7.9 billion (2022 data).
The requirement to create an account to place an order is a concrete example of a dark pattern. And on this specific subject, it was not the DFA which launched the debate, but the European Data Protection Committee (EDPS). The latter’s Recommendations 2/2025, adopted at the end of 2025, are clear: forcing a user to create a permanent account for a one-off purchase violates the GDPR and the famous principle of minimization. The classic argument “it is necessary for the execution of the service” no longer holds. “Guest” mode may be entirely sufficient, and should therefore become the default choice.
If a site complies in substance, but hides the button [Continuer sans créer de compte] or harasses the user with pop-ups to encourage them to register, it is then at this precise moment that the DFA will take over, sanctioning these interface practices as dark patterns. The brands that will do best are those that give real reasons to register (order tracking, after-sales service, benefits), rather than forcing their hand to collect data.
Tracking pixels in emails in the CNIL’s viewfinder
More operational, and often underestimated, the subject of tracking pixels in emails nevertheless deserves particular attention. In France, the latest recommendations from the CNIL on the subject recall that these pixels are tracers in a personal space (messaging) and recommend obtaining consent upon collection of the e-mail address. For CRM teams, this involves reviewing both the way of collecting email/pixel consent and above all rethinking the performance indicators of emailing campaigns: exit the opening rate as a single compass, make way for more reliable metrics such as clicks, conversion or churn.
Compliance is not (just) a cost center, it is now becoming a marketing discipline in its own right. The companies that emerge from this will not be those that have managed their compliance best. They will be those who understand that trust is, ultimately, the only marketing asset that the legislator cannot devalue.
