Consent Agents Are Coming: How to Keep Them Interoperable With the Ad Tech Ecosystem and Still Deliver Opt-In

On November 5, 2026, the IAB Tech Lab International Summit in London was dedicated to the agentic web. Axeptio co-founder and CEO Romain Bessuges-Meusy used this session to analyze what happens to consent when the visitor is an AI agent.

AI agents already browse on users' behalf, and consent interfaces were not designed for them. Between browsers, regulators and the ad tech ecosystem, the question is who will define how these agents speak to CMPs.

Why Every Consent Signal So Far Has Failed

Romain opened with a history the industry tends to forget. For nearly thirty years, successive initiatives have tried to centralize consent, moving the user's choice out of each individual site and into a single signal carried by the browser, the operating system or an intermediary.

Read in sequence, these initiatives keep running into the same questions. Romain framed them as five riddles that any automated consent mechanism has to solve at the same time:

1. How to reconcile consent automation with specificity?
2. How to say yes confidently on behalf of a user?
3. How to avoid saying no everywhere?
4. How to get the publishers' buy-in?
5. How to get the browser providers' buy-in?

Each initiative answered some of them and stumbled on others.

Do Not Track was technically trivial, a single HTTP header, and stalled on industry buy-in.

App Tracking Transparency showed what happens when a gatekeeper designs the consent prompt for an entire ecosystem: in August 2026, Germany’s competition authority closed its case against Apple only after Apple committed to align the prompt shown for its own services with the one imposed on third-party apps.

ADPC delivered specificity, but it was designed without the browsers that would have carried it or the publishers that would have had to honour it, and no law ever made it binding. It remained a prototype. The lesson Romain drew is structural: a consent signal holds only if those who must honour it have a hand in designing it.

Article 88b of the Digital Omnibus shows the question is still open. The Council's October 2026 mandate contains no browser signal, but the Parliament has not yet decided. Meanwhile, a new player has entered the game.

What AI Agents Do When They Face a Cookie Banner

That player is the AI agent. Earlier this month, we conducted a live test. Asked to read an article on a news site, Claude in Chrome ran into a cookie wall offering a choice between accepting 135 advertising partners and subscribing. It declined the cookies, reasoned that accepting them would probably only unlock the free part it had already read, and handed the decision back to the user.

Axeptio then ran the same exercise across five consent interfaces and three AI agents.

Three conclusions follow from these results.

First, an AI agent treats consent as an obstacle to its task. When content is reachable without consent, all three agents take the cheapest route: they ignore the banner or refuse. On a second-layer interface, they go as far as opening the settings to refuse.

Second, the outcome depends on the agent's vendor. On the same cookie wall, for the same user, two agents refuse and one accepts. For agentic traffic, a site's consent rate is therefore set by the product decisions of a handful of AI companies, outside any consent framework the ecosystem controls.

Third, none of these outcomes clearly reflects the user's will. A refusal issued by an agent expresses no preference the user stated. An acceptance is weaker still: the GDPR defines consent as a specific, informed and unambiguous indication of the data subject's wishes, and an agent accepting 135 partners to finish a task can hardly meet that standard. In both directions, the CMP records a decision nobody made.

This is why we have now to distinguish two kinds of agents. An AI agent browses to complete a task, and consent is in its way. Now, we can imagine a second kind of agent, a consent agent that applies the preferences its user has set, and consent is its task.

A consent agent the ecosystem can rely on

Under the GDPR, the data controller relies on a CMP, acting as its processor, to collect the data subject's choices. When the data subject delegates browsing to an AI, that chain loses its last link: nothing connects the CMP to the AI acting on the user's behalf. A consent agent restores it, provided it works with the CMP in good faith and answers to the data subject.

Who occupies that position will shape the next decade of consent. If a browser-level signal of the kind proposed in Article 88b returns, the role could fall to Chrome, Safari, a privacy NGO or even an ad blocker. History suggests that each would set the defaults according to its own interests, and the parties expected to honour them would have no say.

navigator.consent is the ECMPA's answer to that question.

Its trust model relies on transparency. Any CMP or consent agent can register, with no DRM-like trust gates. Every decision is attributable to a user, a purpose and a moment, and a dedicated DevTools panel exposes what each party has declared, along with the consent history. Trust builds over time from a record anyone can inspect, which is what allows a publisher to rely on an acceptance issued by an agent.

The API is also built for the ad tech stack publishers already run. It works alongside the TCF, since a TC String maps directly to the methods a CMP uses to declare its vendors and purposes, and it remains compatible with GPP and Google Consent Mode.

For users, this is the answer to consent fatigue. A consent assistant that speaks navigator.consent can respond to every CMP that implements it, applying its user’s preferences vendor by vendor and purpose by purpose, so the banners that interrupt each visit no longer need to appear. Several consent assistants already support the specification, starting with Taste, developed by Axeptio, alongside Consenter, Rewarded Interest, SuperAgent and Privacy Badger. Users who prefer to decide site by site lose nothing: when no assistant is installed, the CMP shows its banner and collects choices exactly as it does today.

The end state reverses the chain that AI agents broke. Tomorrow, the user's consent agent steers the AI agent, the user's preferences travel through the browser to the CMP, and valid consent reaches the revenue line again. This only works if the standard is respected by CMPs and websites alike, so that AI agents decide on consent with the user's preferences in hand.

“Thirty years of consent signals have taught us that a standard nobody implements protects nobody, and a standard written by a single player serves that player first. AI agents are already making consent decisions on our sites. navigator.consent gives users, CMPs, companies, publishers, adtech technologies and AI agents a common language. A user who sets their preferences once in a consent assistant like Taste will see them respected on every site, whether they browse themselves or let an AI agent do it for them.”

Romain Bessuges-Meusy - Co-founder and CEO of Axeptio

The navigator.consent RFC is in draft for public technical review.