The signal nobody will listen to

The “data” package of the Digital Omnibus is still being negotiated. One of the Commission’s proposals was a new Article 88b GDPR: automated signals, set once in the browser or device, through which a person expresses consent or objection without answering every banner. The Council deleted it. On 13 August Germany’s federal data protection commissioner urged the co-legislators to “revisit the issue”.

It will pass as a technical detail. I think it was the most interesting point of the whole reform.

The liturgy of the banner

The cookie banner is the perfect symbol of what in Habeas Mentem I call the liturgy of consent: a gesture repeated dozens of times a day, producing legal proof and no real choice. We know how it is designed. The accept button is big and coloured. The reject one sits on a second layer. Every time, we start again.

The automated signal reversed this logic. Instead of asking people to defend themselves every time, it let them decide once, calmly, and be represented by a rule. It is the same principle law has used for centuries: the power of attorney, the mandate, the proxy.

Why it was removed

I do not know the official reasons in detail. The predictable ones I do: impact on advertising, technical standards, fear that signals become a default “no”. Serious concerns for those who live on data. But they reveal an asymmetry. The current system works because being asked every time is tiring. Fatigue is the business model.

The Habeas Mentem Charter has an article written for this: “Leaving costs as much as entering. Withdrawing costs as much as consenting.” And another: “The time needed to decide is part of the decision, and may not be taken away by design.” The automated signal was the simplest way to honour both.

The international comparison

In California, Global Privacy Control is already recognised as a valid opt-out request under the CCPA. Not perfect, but it exists and is enforced. Europe, which invented the GDPR, risks ending up with a weaker tool for expressing a simple choice.

And there is a deeper paradox. The same negotiation, according to a leaked draft reported by CDT, opens the door to processing personal data to develop systems on existing legal bases, with much reduced safeguards. Machines will be able to talk to machines to use our data. We will not be able to use a machine to say no.

What to do, even without a law

There is no need to wait for the legislator. Anyone designing a service can already:

1. honour browser signals voluntarily and say so;
2. make rejecting equal to accepting: same layer, same prominence, same number of clicks;
3. remember the choice for a reasonable time instead of asking at every visit;
4. measure how long it takes to reject, and publish it.

Whoever does this first does not lose data. They gain something rarer: proof that their users’ choices are real.