道Dojo · · 4 min read
Cookie banners are staying. So at least make them fair
Brussels is still arguing about the end of cookie banners, and a court in Vienna says rejecting must be as prominent as accepting. What that means for your website.
The samurai only wanted to check the bakery's opening hours. In full gauntlets he unticked 214 partners, one by one. By the time he was done, it had shut.
If you were hoping cookie banners would disappear soon, keep waiting. Brussels is still debating, the banners are staying. And a court in Vienna has just explained what really matters about them: not the wording, but the colour of the buttons.
Brussels: still open
The so-called Digital Omnibus would move the cookie rules into the GDPR and allow consent via a browser signal. Set it once, never see a banner again. Sounds nice, but it is not coming soon. According to a status report by Acompli dated 24 September 2026, the data part is still at first reading, Parliament is sitting on more than 1,750 amendments and the Council has no negotiating mandate. Nobody expects agreement before the end of 2026.
On top of that, the Council has deleted the browser-signal article (88b) from its text. On 10 September, 19 organisations, businesses and academics asked for it to be put back in an open letter published by noyb. The outcome is open.
For your website that means: the current rules apply. The GDPR, and in Germany § 25 TDDDG. Postponing your banner overhaul until "the EU is done" means planning around a date that does not exist.
Vienna: equal means equal
More useful in practice is a ruling by the Austrian Federal Administrative Court from April 2026 (W171 2303402-1/7E), summarised by Dr. Datenschutz. It concerned the banner of the Austrian public broadcaster ORF. "Accept all cookies" was white on blue. "Only necessary cookies" and "Cookie preferences" sat next to it in blue on white, noticeably less prominent. Nothing on the site worked without clicking the banner.
The court's view: with that design you cannot tell whether people consent or simply take the path of least resistance. So the consent is not valid. An appeal has been allowed, so this is not the final word. The direction is clear, though, and it will surprise nobody who has tried to dismiss a banner on a phone.
Our view: this is not legal hair-splitting, it is plain interface design. A banner where one option glows and the other hides is not a question, it is an instruction. And it is the first thing visitors see of you.
What a fair banner looks like
- First layer: "Accept all" and "Reject all" side by side, same size, same colour, same contrast, same typeface.
- No detours: rejecting must not hide behind "Settings" or "Learn more".
- Plain language: what is measured, by whom, and why. One sentence per purpose is enough.
- Fewer tools: every script you do not need is one line less in the banner. The shortest banner is the one that never has to appear.
An audit note can read like this: "Reject": 11 pixels, light grey on white, below the body copy. Visible to anyone who goes looking for it, such as a court in Vienna.
That is why, when we build websites, the banner is part of the design, not a job for the week before launch.
This week's drill
Open your website on your phone in a private window and take a screenshot of the banner. Then check three things:
- Is "Reject" on the first layer, just as large and prominent as "Accept"?
- After rejecting, does the page really stop loading trackers? On a desktop, the network tab in the developer tools will show you.
- Which tools in the banner do you actually still use? Anything nobody has looked at for a year goes.
So the samurai finds the opening hours before closing time.
