How a 23-year-old invented something innocent, and how a trillion-dollar industry turned it into the most annoying thing on the internet.
At some point in the last decade, you clicked "Accept All" on a cookie banner without reading it. Probably this morning. Maybe seventeen times this morning. You did it because the alternative — clicking through three menus to tell a website you'd prefer it not sell your browsing habits to seventeen data brokers — was designed to be painful. That was not an accident. But we're getting ahead of ourselves.
To understand how the cookie banner became the most disliked UI element on the internet, you have to go back to a shopping cart problem in 1994, a European Parliament directive written in 2002, and about thirty years of people optimizing for the wrong thing.
Here's what actually happened.
Lou Montulli was employee number nine at Netscape. He was twenty-three years old and had already built one of the first web browsers. In the summer of 1994, his team faced a problem: the web had no memory. Every time a server received a request from a browser, it had no idea if it had ever spoken to that browser before. This made shopping carts essentially impossible — add something to your cart, load the next page, the server had already forgotten you existed.
The obvious solution — giving every browser a permanent unique ID — was one Montulli explicitly rejected. He worried it would enable tracking across every website a person visited. So he designed something more careful: a small file that a website could store on your browser, but that only worked for that website. Not globally. Not shared. Site-specific, like a coat-check ticket.
He named it a cookie, after a computing concept called a "magic cookie" — a token passed between programs. The first cookie ever set in the wild checked whether a visitor to Netscape.com had been there before. It was, by any measure, completely harmless.
Montulli's privacy instinct was right. His design was sound. What he couldn't control was how the technology would be used by people who had different goals.
Cookies spread through browsers quietly. Internet Explorer adopted them in 1995. By 1996, most websites used them, and most users had never heard of them. The Financial Times ran an article that year revealing cookies existed at all — it caused something of a panic.
The panic faded. The cookies stayed.
Ad networks figured out something Montulli hadn't intended: if the same advertising company served ads on thousands of different websites, their cookie appeared on all of them. That made their cookie effectively cross-site. Not because of how the cookie was designed, but because of who controlled it. Montulli's privacy-preserving design had been turned inside out.
DoubleClick — founded in 1996 — built a business on exactly this. By controlling the ad pixels on thousands of sites, they could build detailed profiles of individual users' browsing habits across the entire web. No consent. No disclosure. No one asking if that was okay.
By the early 2000s, the EU had been watching the tracking economy grow for years. In 2002, the European Parliament passed the ePrivacy Directive — a piece of legislation requiring websites to get consent before placing cookies on a user's device. The intent was genuinely good. The execution was complicated.
Directives aren't laws. They're instructions to member states to write laws. Each country implemented the directive differently, with different thresholds, different enforcement bodies, and wildly different levels of interest in actually enforcing it. The UK did something. Germany did something else. Several countries mostly didn't bother.
The directive was amended in 2009 to be more explicit about consent requirements. For most of the web, this produced exactly one thing: a thin strip at the bottom of websites saying "This site uses cookies. By continuing to use this site, you agree." Continuing to scroll counted as consent. The ad industry sighed with relief and continued exactly as before.
The General Data Protection Regulation passed in 2016 and became enforceable on May 25, 2018. It had teeth. Fines up to 4% of global annual revenue. A serious definition of consent — "freely given, specific, informed and unambiguous." Reject had to be as easy as accept. You couldn't pre-tick boxes. You couldn't make consent a condition of access to a service.
The thin cookie bar was now clearly illegal. Overnight, an entire industry was born to replace it.
Consent Management Platforms — CMPs — sprang up everywhere. OneTrust was founded in 2016 and raised hundreds of millions of dollars. Cookiebot, Osano, and dozens of others rushed in. The banners got bigger. They got more complex. They got designed by compliance lawyers and implemented by developers who'd never read the GDPR and were just trying to not get fired.
The banners that emerged were masterpieces of legal compliance and UX manipulation simultaneously. Accept was big, green, and one click. Reject was buried in a settings panel labeled "Manage preferences" that required navigating three screens and individually toggling seventeen sliders. Technically compliant. Functionally dishonest.
Max Schrems — Austrian privacy activist and the person most responsible for two major EU-US data transfer frameworks being struck down — founded NOYB (None of Your Business) in 2017. By the early 2020s, NOYB was filing hundreds of complaints about dark patterns across European websites. The complaints were specific, well-documented, and mostly correct.
Regulators began to move. The French CNIL fined Google €150 million and Facebook €60 million in 2022 for making it harder to refuse cookies than to accept them. The Spanish DPA sanctioned companies for loading cookies before users responded to the banner at all. The Italian Garante went after multiple large publishers.
The pattern throughout: enforcement moved slowly, the industry adapted quickly, and users were trained to click Accept All reflexively because the alternative was designed to be painful. A 2017 study found that only 3% of users would voluntarily accept cross-site tracking if they understood what they were agreeing to. The consent banner's real job was to never let them understand.
Thirty years after Lou Montulli's shopping cart solution, the average website greets a new visitor with a modal that:
Meanwhile, the actual question — what does this site do with your data, in plain English— remains unanswered. It's in the privacy policy. Nobody reads the privacy policy.
Montulli, in his Reddit AMA, was asked if he had regrets about what tracking built on his cookies became. He noted that cookies were designed to explicitly avoid tracking. He's not wrong. The technology was fine. What happened to it was a choice made by an industry that realized users' attention was worth money, and that it was easier to confuse them than to ask honestly.
Free for Vanta customers.