Why cookie banners are bad (and how Omit dismisses them)
On this page
The average internet user clicks “Accept All” on a cookie banner about 47 times a day. That’s 17,000 times a year, mostly without reading anything. We tap through them so reflexively that we’d sign up for a kidney donation if it appeared in the same blue button.
This is not what the law was supposed to do.
What the GDPR actually requires
The General Data Protection Regulation, passed in 2016 and enforced from 2018, says roughly:
- If you collect personal data from an EU resident, you need a legal basis.
- One legal basis is “consent.”
- Consent has to be specific, informed, freely given, and as easy to withdraw as to give.
The law does not say show a pop-up on every visit. It says get consent if you’re relying on consent. There’s a critical distinction there that the ad-tech industry skipped right past.
How we ended up with banners on every site
Most websites in 2017-2018 didn’t actually need consent under GDPR for the cookies they were using. A “remember my login” cookie is necessary for the service. A shopping cart cookie is necessary for the service. A first-party preferences cookie is necessary for the service. None of these need consent.
But sites also wanted to keep loading Google Analytics, Facebook Pixel, and a dozen ad-tech vendors. Those needed consent. Rather than separate the necessary from the optional, the consent management platform industry built a one-size-fits-all pop-up that asks for everything at once.
Then they made the “Accept All” button big and green, and the “Reject All” button small or hidden behind “manage preferences.” In about 60% of audited cases, the consent banner pre-checks the boxes anyway, in flagrant violation of the law. Regulators have fined a handful of egregious offenders. Most enforcement action is symbolic.
The actual cost
The GDPR was a privacy law that, in practice, mostly produced a click-fatigue tax. Three actual outcomes:
- Privacy didn’t improve much. Users tap “Accept” without reading. Tracking continues; users are technically “informed.”
- The web got slower and uglier. Banners are heavy JavaScript bundles. They block content. They re-appear because the consent cookie expires.
- Big platforms benefited. Cookie banners hurt small sites worst. Google’s and Meta’s direct relationships with users let them get consent more cleanly.
How to opt out of cookie banners (at scale)
You can’t fix the law from your browser, but you can fix the symptom: install a blocker that hides cookie banners, sets the “Reject All” cookie when one is available, and blocks the underlying tracking scripts so the consent doesn’t matter.
Omit ships this on by default. The cookie-notice rule set is bundled with the standard install — when you visit a new site, the banner is hidden as soon as the page loads, and the third-party trackers are blocked at the network layer regardless of what the banner would have asked.
For users who want a stricter setup, Omit also supports the Global Privacy Control signal, which is a programmatic “Do Not Track” header that some sites actually respect.
The rest of the iceberg
Cookie banners are a UX symptom of a larger problem: the web’s revenue model is glued to surveillance advertising, and law tries to constrain surveillance advertising without changing the revenue model. Until publishers find an alternative — micropayments, better subscription tools, public funding for journalism — the surveillance keeps trying to find a way through.
Until then, blockers are the duct tape. Install Omit and stop seeing banners. We’ll keep adding rules as new consent platforms appear.