Segment 1 — The Cold Open

Segment 2 — The Good Intention

The GDPR grew out of more than a decade of European concern about online tracking. Lawmakers in the European Parliament and the European Commission had watched advertising networks build detailed profiles across sites without users realizing the extent of the collection. Earlier rules in the 2002 ePrivacy Directive had required consent for cookies but left the method of obtaining it vague. By 2016, when the final GDPR text was agreed, regulators believed that mandating clear, affirmative consent would shift power back to individuals and force companies to be more transparent. The approach reflected a long-standing European view that data protection is a fundamental right rather than purely a consumer issue. Officials expected websites to offer simple choices and users to engage with those choices thoughtfully.

Segment 3 — The Implementation

The regulation took effect on 25 May 2018. Overnight, sites serving European users added consent interfaces to avoid fines that could reach 4 percent of global turnover. Many companies adopted off-the-shelf banner scripts from vendors such as OneTrust and Cookiebot because building compliant systems quickly was difficult. Early audits by regulators in France and Germany found that some banners made refusal noticeably harder than acceptance, yet most sites still displayed some form of notice. Proponents pointed to increased awareness of data practices and a wave of privacy policy updates. A smaller group of privacy advocates warned that the sheer volume of notices would overwhelm users and that the technical definition of consent was already being stretched.

Segment 4 — The Unintended Consequences

Within months it became clear that the banners were being treated as obstacles rather than decision points. Studies conducted in 2019 and 2020 showed that the large majority of users clicked “accept” within seconds, often on the first or second visit to a site. The interfaces frequently presented “accept all” as the most prominent button while burying granular controls behind additional clicks. This design pattern arose because publishers needed to maintain advertising revenue and because the regulation did not specify exact visual requirements. The result was banner fatigue: users learned to dismiss the notices automatically, reducing the likelihood they would ever examine what data was being collected. A second-order effect appeared in the legal landscape. Regulators issued guidance and occasional fines, yet enforcement remained uneven across member states, leaving companies uncertain which banner designs would survive scrutiny. Some sites began experimenting with “consent or pay” walls, requiring payment for an ad-free, non-tracked experience. This practice, still under active review by data-protection authorities, created a new tension between privacy and access. Over time the cumulative effect was a widespread sense that consent had become a procedural checkbox rather than an informed choice, undercutting the very goal the GDPR had set out to achieve.

Segment 5 — The Aftermath

European regulators have continued to refine expectations through updated guidance and court rulings, yet the banners remain in place. A few national authorities have pushed for simpler “reject all” options at the same prominence as “accept all,” and some browsers now offer broader controls that can override site-level banners. At the same time, the ePrivacy Regulation, intended to replace the older cookie rules, has been delayed for years. The current state is therefore one of incremental adjustment rather than wholesale replacement: the notices are still ubiquitous, but their legal and technical surroundings keep shifting.

Segment 6 — The Lesson

Complex consent requirements can be difficult to translate into interfaces that people will actually use. When the cost of genuine choice is high for both users and publishers, workarounds tend to appear that satisfy the letter of the rule while avoiding its spirit. Systems that rely on repeated individual decisions also risk training people to ignore the very signals meant to protect them. The experience invites a practical question for any future privacy or consumer-protection rule: how will ordinary users encounter this obligation on a typical Tuesday, and what will they actually do?

💬 Reply to this email — Patrick reads every one.

Share: X · LinkedIn · WhatsApp

Forwarded this email? Subscribe here — it's free.