There’s a lot going on right now. And even though it’s already March, the timing remains good: the pace of announcements is accelerating, particularly in France. The idea of the morning was to sort out what is certain<\/strong>, what is almost certain<\/strong> and what remains probable<\/strong> for 2026, with a clear guideline: to reconcile compliance<\/strong> and performance<\/strong>. <\/p>\n On the program: regulatory framework, benchmark on consent performance and overview of Privacy & Performance trends for 2026.<\/p>\n The first “certain” topic: cross-device (or “cross-terminal”, in the words of the CNIL). The starting point is simple: to combat consent fatigue, the authority is paving the way for a single consent<\/strong> that can be reused on several terminals… but on one central condition<\/strong>: remain within an authenticated universe<\/strong>. <\/p>\n The recommendations specify that the cross-device must be :<\/p>\n In concrete terms: if a user consents in a logged-in app, this consent can then be applied when he or she connects to the web.<\/p>\n The “sticking point” raised during the session: managing contradictions<\/strong>. Typically, a user can make a choice while not logged in… and then log in. Which version takes precedence? The CNIL tends to consider that consent in a logged-in environment prevails<\/strong>. <\/p>\n Another highlight: when a user arrives at a new interface<\/strong>, a callback<\/strong> mechanism is recommended to indicate that choices have already been made and can be modified.<\/p>\n Finally, Didomi would like to emphasize a point of context: these recommendations were triggered by exchanges with the CNIL concerning a customer case.<\/p>\n The second “almost certain” topic: e-mail tracking. A topic that has been discussed for years, and which is now approaching a more explicit framework. <\/p>\n The heart of the message: “marketing” consent (to receive communications) is not enough<\/strong> if you use pixels (or any other tracking mechanism) in your emails. Specific consent<\/strong> is required. <\/p>\n What the CNIL emphasizes in the exchanges:<\/p>\n In terms of implementation, two cases stand out:<\/p>\n An important point discussed was the possibility (mentioned) of obtaining this “pixel” consent via the CMP, which is a step towards a CMP that would progressively centralize more consents.<\/p>\n Third topic: proof of consent in marketing. The message is clear: whatever the channel, you need to be able to prove consent on an individual basis<\/strong>. <\/p>\n We’re talking about :<\/p>\n The point to remember: the CNIL wants to move quickly (first half of 2026), with the idea that, in essence, the obligations already existed and that there is therefore no need for a formal “adaptation period”.<\/p>\n Finally, the session focuses on an often underestimated subject: the withdrawal of consent<\/strong>. It has to be as simple as granting it… and above all, it has to be able to propagate through a chain of vendors, which is not always trivial. <\/p>\n Didomi then looks back at the EU Digital Omnibus, presented as an attempt at modernization, with the stated aim of simplifying compliance and boosting the competitiveness of companies in Europe.<\/p>\n Three key points emerged from the discussions:<\/p>\n One possibility under discussion is to introduce a logic whereby, depending on the data controller, pseudonymized data may not be considered “personal” if the actor is unable to re-identify it. This approach is highly controversial and could be withdrawn. <\/p>\n Today, we can find ourselves having to ask for ePrivacy consent to deposit a cookie, when the processing behind it is based on legitimate interest. The Omnibus opens up the idea of aligning the legal basis of the cookie with that of the processing, which could radically change certain practices. <\/p>\n This is the most “structuring” idea: consent given at browser level, applied to the entire browsing experience. The aim is to reduce consent fatigue, but the implications are far-reaching (including in terms of competitiveness). A sector-specific exemption for news media has been mooted. <\/p>\n On the timeline: a lot of uncertainty, lobbying, and an application horizon of 2028-2030 with compliance deadlines.<\/p>\n The benchmark seeks to make the duality of “compliance + performance” legible. Three metrics are highlighted: <\/p>\n Overall, data remains stable across Europe, but the “weather” reveals a trend: Western Europe is falling, Eastern Europe is holding up better.<\/p>\n In France: a 2-point<\/strong> drop between 2024 and 2025 has been cited as a “structural” trend for several years, probably linked to overexposure to banners and consent fatigue.<\/p>\n Rates remain close between devices, with a few nuances:<\/p>\n The dominant format remains the pop-up<\/strong>, with a very high adoption rate (78.5%). The header format has a higher consent rate, but very little adoption, which makes it impossible to draw any operational conclusions. Message: keep your pop-ups<\/strong>. <\/p>\n Regulatory differences between countries influence the mechanics that can be used. As a reminder, certain options (e.g. crosses) exist in Italy but not in France. <\/p>\n In terms of performance, one lesson stands out: “continuing without accepting” is presented as an option that performs well in the ecosystem observed.<\/p>\n Third lesson: granularity remains marginal:<\/p>\n In other words, the majority of choices remain “high-level”.<\/p>\n Two signals:<\/p>\n A CNIL topic, a user topic, and a business topic. The proposed approach: solicit less, but better. <\/p>\n Axes cited :<\/p>\n The corollary: recognizing the user becomes central, especially if individualized proof becomes the norm.<\/p>\n The idea is to build a unified privacy profile: CMP, preferences, marketing consents, CRM… and trace origin and compliance via a consent lineage<\/strong> logic.<\/p>\n One use case cited: CRM to media, with the prospect of linking a choice of consent to media activation.<\/p>\n Interesting angle: reversing the perspective. Server-side is not just a “response” to constraints, it’s also an opportunity to regain control of governance and rebuild data assets, while improving performance. <\/p>\n Didomi mentions its server-side dynamics via AddingWell, and the interest of better understanding where personal data is located along the way.<\/p>\n Finally, AI, with a paradox: low confidence, high adoption.<\/p>\n The thinking goes further: what if the user experience changed radically with agents? In an agent-to-agent world, “transaction privacy” could become richer than today’s binary choice, with scope for inventing new forms of exchange. <\/p>\n 2026 is shaping up to be a pivotal year:<\/p>\n Many uncertainties. But also, clearly, concrete projects to be started right away. <\/p>\n At Optimal Ways<\/strong>, we provide you with highly operational support for :<\/p>\n On March 3, 2026, Didomi held its traditional start-of-year “Breakfast”, devoted to the major topics to be anticipated for 2026, at its Paris premises on Boulevard S\u00e9bastopol, in the 2\u1d49 arrondissement, a stone’s throw from the picturesque Sentier district. The morning session was led by Romain Gauthier (CEO), Thomas Adhumeau (Chief Privacy Officer) and Kevin […]<\/p>\n","protected":false},"author":7,"featured_media":14116,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[42],"tags":[],"class_list":["post-14117","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-new-things"],"yoast_head":"\n<\/div>\n<\/div>
\ud83d\udcdc Regulatory framework: what lies ahead?<\/h2>\n
\u2705 Cross-device consent (CNIL recommendations – January 2026)<\/h3>\n
\n
\ud83d\udce7 Tracking pixels in emailing (recommendation expected March\/April 2026)<\/h3>\n
\n
\n
\ud83e\uddfe Proof of consent in marketing (public consultation 2026)<\/h3>\n
\n
<\/div>\n<\/div>
\ud83c\uddea\ud83c\uddfa EU Digital Omnibus: towards RGPD & ePrivacy modernization<\/h2>\n
1\ufe0f\u20e3 Definition of personal data<\/h3>\n
2\ufe0f\u20e3 Reconciliation RGPD \/ ePrivacy<\/h3>\n
3\ufe0f\u20e3 Browser consent<\/h3>\n
<\/div>\n<\/div>
\ud83d\udcca Benchmark Didomi: what do the data say?<\/h2>\n
\n
\ud83d\udcc8 Europe: overall stability, but visible fatigue<\/h3>\n
\ud83d\udcf1 Performance by device<\/h3>\n
\n
\ud83e\ude9f Banner formats<\/h3>\n
\u274c Refusal options<\/h3>\n
\ud83d\udd0e Granular interaction<\/h3>\n
\n
\ud83d\udccc Standards<\/h3>\n
\n
<\/div>\n<\/div>
\ud83d\udd2e Panorama 2026: 4 data privacy trends<\/h2>\n
1\ufe0f\u20e3 Consent fatigue<\/h3>\n
\n
2\ufe0f\u20e3 Orchestrating consent<\/h3>\n
3\ufe0f\u20e3 Server-side tagging<\/h3>\n
4\ufe0f\u20e3 AI & Privacy<\/h3>\n
\ud83e\udde9 To sum up<\/h2>\n
\n
\n