Affiliates program
Login
Online consent is being redrawn this year. In Brussels, the Digital Omnibus has reopened the question of its architecture, in search of an answer to consent fatigue, a problem that has been building for years as standardized interfaces were repeated site after site with no thought for the user experience.
In Bonn, the Bundeskartellamt has just closed four years of proceedings over the way Apple governs advertising consent inside mobile apps. Between them, these two cases will decide who owns the relationship between organizations and their users.
With the final quarter of 2026 fast approaching, we set out the position we are taking on both fronts and what it commits Axeptio to next. We have also pulled together our main publications since January (client stories, product releases and regulatory analysis), which give the background needed to follow what is at stake in Europe right now.
Why the CMP's Next Move is Toward the End User
The European Commission has put consent fatigue on the reform agenda, and the Digital Omnibus proposes to answer it with a single signal, expressed once and for all at browser level. We set out in June why that answer creates more problems than it solves: a blanket preference defined outside any context no longer meets the GDPR's specificity requirements, the European CMP Association expects consent rates to fall by as much as 80%, and handing the infrastructure of consent to four browser vendors concentrates power in exactly the place the DMA is trying to contain it. There is another route, and it is the one we are arguing for: interoperability, through a browser API that lets CMPs and consent assistants talk to one another, so that users stop facing banner after banner without giving up a contextual, granular choice.
Arguing for that route takes our industry well beyond its current remit. CMPs can fairly be seen as opportunists, riding a piece of regulation and stepping back from their responsibilities the moment users push back. That stance cannot hold much longer. The CMP is the only mechanism with a direct line to the end user, across hundreds of thousands of websites and apps.
Two developments make the shift necessary. The first is the rise of agentic AI: people now hand agents the tasks they used to carry out themselves, disclosing along the way, in the course of a conversation, personal data no form could ever have collected. The second is the growing number of data breaches and the wider cybersecurity risk. The latest case in point came on August 14, when France's public finances directorate (DGFiP) disclosed that illegitimate access obtained in June and July had allowed the extraction of data on 678,000 individuals and businesses, including taxable income and withholding tax rates. The incident has nothing to do with consent management, but it is a reminder that no organization, not even the tax authority, is out of reach.
This is precisely what a consent assistant is for. Taste, the extension we make freely available to the public, deals with consent interfaces on the user's behalf, applies their preferences site by site, keeps a local history of their choices and lets them revisit any of them whenever they want. Granting consent and withdrawing it are both part of what a CMP is for, and a trusted third party should be equipping users for both, without taking sides.
"It is the natural evolution of the CMP to become a consumer product, in a world that is increasingly agentic, exposed to a new kind of conversational data shared with AI and to a great many breaches." Romain Bessuges-Meusy, CEO and co-founder, Axeptio
Axeptio was built around a product, operates today as a service, and is working toward a third stage: assurance, a CMP that stands more firmly alongside its clients. That ambition matters at the very moment when generative AI can produce a consent interface in two prompts. What it cannot produce, as we wrote in March, is legal certainty, an up-to-date vendor registry, close tracking of regulatory change and of standards such as the TCF and Google's Consent Mode, a seat and a voice in the discussions where those standards are decided, and expert teams to build an immersive brand experience inside the CMP, the kind we opened up to video a few months ago.
What Germany's Apple Ruling Changes for In-App Consent
On August 17, the Bundeskartellamt (Germany's federal competition authority) closed the case it had opened in 2022 against Apple's App Tracking Transparency Framework, attaching a handful of conditions to the commitments the company had offered. The authority took issue with the imbalance between the prompt Apple applies to its own services and the one it imposes on third-party apps: wording, design and choice architecture nudged users toward acceptance on one side and away from it on the other. Apple has undertaken to bring the two into line, to remove discouraging elements, and, above all, to let app publishers combine its own prompt with those required under data protection law. It has four months to implement the changes, which will be tested with publishers before rollout.
The decision sends a signal to Big Tech: designing consent collection in-house exposes them to enforcement, whereas handing it to those who do it for a living does not.
"We see it less as a win against the tech giants than as an invitation to work together. A CMP has one property no player whose revenue depends on advertising can claim: it is paid the same whether the answer is yes or no. That economic neutrality is what makes its advice worth listening to, including when the advice is to drop a dark pattern that would have added a few points of opt-in." Romain Bessuges-Meusy, CEO and co-founder, AxeptioBundeskartellamt president Andreas Mundt put it in much the same terms: the aim is not to push consent rates as high as they will go, but to let users decide freely, either way.
"Apple assumed, wrongly, that one size would fit all. In practice it leaves companies with no room to speak in their own voice, when the design of a consent interface does more to shape user behavior than the act of collection itself." Romain Bessuges-Meusy, CEO and co-founder, Axeptio
This is the ground Axeptio is moving onto this fall. A dedicated framework for the in-app consent journey, covering the full set of prompts a user meets on first opening an app, is due in the second half of the year. More on that in the coming weeks.
Where Six Months of Repositioning Have Taken Us
These moves build on six months in which our offering has broadened and we have taken our place in the forums where European regulation is written. Our visual identity followed suit. The new art direction unveiled in June borrows the language of stage design: Axeptio steps back so that the brand can take center stage, in the CMP as much as anywhere else.
Act I. On Stage: What Our Clients Do With the Consent Moment
TUI France designed its banner as a welcome message, the digital extension of the hospitality found across its 1,200 travel agencies, then used it to carry a video announcing the launch of its mobile app: a 78% consent rate and more than 10,000 app downloads.
E-commerce applies the same thinking to a more familiar calendar, the one set by seasonal sales, Black Friday and the rest. The white paper we co-authored with Agence123 walks through six implementations and the trade-offs that take consent rates as high as 85%.
In Quebec, across the 199 cultural venue websites managed by Tuxedo (roughly 40% of the province's live entertainment ticketing), the strongest results come from organizations that maintain an ongoing relationship with their audience and whose banner has been configured with care and genuine personalization. Théâtre du Bic reaches 63.5% opt-in, in a sector that usually sits fifteen points below the all-sector average.
Consent management, though, is not confined to cookies. At Clementine.fr, where acceptance of a contractual document has to be evidenced to the standard expected in accounting, Terms records agreement to amendments, terms of use and terms of sale, and gives legal teams full control over the lifecycle of those documents.
Act II. Backstage: the Product Work Behind the Numbers
Measuring those results depends on analytics that have come a long way this year. The new analytics dashboards now separate opt-in from opt-out views, distinguish refusals expressed in the CMP from objections signaled through Global Privacy Control, and use Country Groups and Targeted Areas to compare performance from one regulatory framework to another, Quebec to California.
Spotting a gap in performance still does not tell you what to change in your banner, which is where native A/B testing comes in: by serving two versions of a banner to comparable audiences at the same time, it isolates the impact of a change in design, tone or display mode, where comparing across time mixed in seasonality, live campaigns and traffic swings.
These habits can be taught, which is the purpose of Axeptio Academy, launched in May with an open track, a premium track built with our agency clients and a certificate at the end.
Act III. Speaking up: Where We Stand on the Future of Consent
Our breakdown of the three competing architectures sets out in detail what a centralized browser-level signal would change, legally, economically and geopolitically, and what interoperability makes possible instead. These are concepts worth mastering to follow the political and economic decisions being taken right now in the European Commission.
The presidency of the European CMP Association, handed to Axeptio in June by Didomi, iubenda and Usercentrics, gives us a seat from which to argue that position before the European institutions.
The coming months will set further precedents: Apple must have revised its consent screens by the end of the year, and European discussions on the Digital Omnibus continue. To keep track of those deadlines, our newsletter remains the best place to start.
