Cookie consent banners are consent theater

Every site in 2026 greets you with a cookie popup. After a decade of GDPR we've landed on a system where "Accept All" is a giant colored button, "Manage Preferences" opens a nested modal with hundreds of toggles pre-set to ON, and rejecting everything takes 4-6 clicks. Sometimes more.

The consent management industry — OneTrust, Cookiebot, TrustArc — exists to convert a legal requirement into a UX dark pattern. Their pitch to clients is basically "minimize consent friction," which translates to "make saying no as annoying as possible." Some of these platforms charge per-domain pricing specifically for the "optimized consent flow" tier. The optimization is against the user.

The IAB Transparency and Consent Framework made things worse. TCF v2 lists over a thousand vendor entries. Nobody is meaningfully consenting to data sharing with 1,200 ad-tech companies through a popup they see for under a second. The framework creates a legal record of "consent" that no human actually gave. It exists so the supply chain can point at a checkbox when regulators come asking.

Browsers could've fixed this at the protocol level. DNT (Do Not Track) died because sites simply ignored it — there was no enforcement mechanism. GPC (Global Privacy Control) has legal backing in California and Colorado but adoption is still thin. The W3C couldn't converge on a universal signal partly because ad industry representatives sat on the working group.

So we're stuck with the worst outcome: a billion cookie popups training users to click "accept" reflexively. The consent records hold up in court but represent zero informed decision-making. The banners are annoying enough that people dismiss them instantly, which is exactly what the companies deploying them want.

What gets me most — the banners themselves often drop tracking cookies before you interact. The consent layer is itself unconsented surveillance. A few enforcement actions have caught this (the French CNIL has been active here), but it's still widespread.

The fix isn't better banners. It's either browsers shipping a mandatory, enforceable default signal — like GPC but universal — or regulators finally ruling that "consent" obtained through dark-patterned modals isn't valid consent. Until one of those happens, the popup is theater.