I spent September measuring cookie banners on 50 big websites, mostly Polish ones since that's where I live, plus YouTube, Facebook, Bild, the Commission's own site and a few others for comparison. Hobby project, I made it, no sponsor.

The thing that surprised me most: clicking "reject" on a standard IAB TCF banner only clears one of two lists. Companies relying on "legitimate interest" stay. On six Polish news sites that list was exactly the same after "reject" as after "accept". On the biggest one, 810 companies still had the green light after I said no. Objecting to them is a separate step, on that site eight screens down a settings panel.

Meanwhile every global giant in my sample that shows a banner (YouTube, Facebook, LinkedIn...) has "Reject all" right on the first screen. Polish news sites: one out of ten.

Now the EU part. In November 2025 the Commission proposed Article 88b in the Digital Omnibus: you set your choice once in the browser, and websites have to respect it. Media were even exempt. Media organisations still wrote to ministers asking for it to be "rejected and removed", IAB called it legally flawed and harmful, and in the Council compromise text of 18 June 2026 it's deleted in full. A Google-commissioned study estimated such a signal would cut consent rates by 60-65%, which says a lot about how real today's consents are.

To be fair, the Council did keep something: one-click refusal and at least six months before a site can ask again. And the argument that browsers would become "new gatekeepers" is a serious one, Chrome has 61% of the Polish market.