The banner is shrinking.
We sell what remains.
Where privacy law is heading through 2028, what it does to Velo's USPs, and the six new ones it opens. Every regulatory claim in this deck survived adversarial verification against primary sources.
Both ends are vacating our ground.
The consent market is a barbell. Nobody owns the middle, where agencies live.
Repricing upward
OneTrust hikes at renewal and moves upmarket. Didomi rolls up Sourcepoint and Addingwell under private equity. The small end is being pushed out the door.
signal · renewal shockPer domain stacking
Cookiebot doubled its base tier in Aug 2025 and kept pricing that multiplies by every client site. The migration wave it triggered is documented and still moving.
signal · price hike refugeesAgencies, 5 to 200 sites
They need consent wired into Consent Mode v2, server side tagging and GA4 across a whole portfolio — not another banner license per domain. That is Velo's ground.
wedge · flat portfolio pricingCookie law is being rewritten inside the GDPR.
First party aggregated audience measurement, run by the site solely for its own use, stops needing consent. Analytics only sites lose the legal trigger for a banner entirely.
Refusing must take one click of equal effort, and after a refusal the site may not ask again for six months. Remembering that refusal must itself be trackingless — no unique identifiers.
The Commission proposed machine readable consent set once in the browser. The Council deleted it in June 2026, reportedly after Google lobbying. It returns only if Parliament restores it in trilogue.
Non personal data, media sites and third party analytics keep the banner through 2028. Regulators formally support the cookie track — it is the likeliest part of the package to survive intact.
is what invalid consent design costs — inside a flow that already had a banner.
CNIL fined Google €325M on 1 Sep 2025 because the consent it collected did not hold up: users nudged, conditions undisclosed. The banner existed; its design was the violation.
Every recent US signal fine — Sephora, then the California, Colorado and Connecticut sweep — punished a broken configuration, not a missing banner.
California puts a user set opt out signal in every browser by 1 Jan 2027. Honoring it, and proving you honored it, becomes table stakes for US traffic.
Nobody gets fined for lacking a banner anymore. They get fined for consent that does not hold up under inspection — which is an engineering problem, not a legal template.
They sell banner seats.
We sell what the banner protects.
When the law shrinks the banner, incumbent revenue shrinks with it. Velo makes money on recovered signals, proof and infrastructure — the parts that keep growing. That conflict of interest cannot be copied.
The only CMP whose business model improves as banners get smaller. Incumbents must defend the banner. We get to obsolete it.
Every existing USP survives. Most get stronger.
Six USPs the law just opened.
Omnibus ready by design
One click refusal + six month trackingless memory. Nobody ships it; retrofitting 2M+ legacy banners is brutal.
Bannerless analytics
Consent free first party aggregated measurement. Incumbents cannot lead without cannibalizing banner seats.
Signal honoring receipts
GPC binding in the US now; a signal in every browser by Jan 2027. Nobody sells proof of honoring.
Audit grade consent proof
CNIL fines invalid design, not missing banners. Nobody productizes it below enterprise.
Adaptive jurisdiction engine
The three diverge hardest through 2028. Enterprise only today — manual, quote based.
Agent facing consent
AI agents never render a banner. Usercentrics claims it in positioning; built an enterprise gateway instead.
Ranked by strategic fit times build cost on the stack we already run. N1 and N2 belong in the MVP window; N6 starts as content, not code.
Two of these belong in the MVP window.
Omnibus ready by design
Cheap to build while the banner is still being built; expensive for incumbents to retrofit across millions of live deployments. The launch headline writes itself: already compliant with the rules arriving in 2027.
cost · small — banner still in buildBannerless analytics
A first party, instantly aggregated measurement mode that maps onto the server side and edge masking stack we already run. If the final wording stays as narrow as regulators want, GA4 as commonly deployed will not qualify — our compliant mode becomes the upgrade path we sell against it.
kicker · GA4 may not qualify — we wouldThree things the law is taking away.
On analytics only sites the whitelist removes the legal trigger. A CMP that is only a banner is a melting asset — which is the incumbents' problem, not ours.
Asymmetric flows and nagging become illegal under Art 88a(4). Our consent rate testing optimizes within equal effort designs only — anything else turns into a liability we can point at in competitors.
Media sites keep their banners and their certified CMPs. That niche stays incumbent held. Skipping it in the MVP was right and stays right.
Four things can move this plan.
Timing works for us: adoption late 2026 at the earliest, Art 88a applying about six months later. The compliance confusion window lands exactly in Velo's first two commercial years.
Ship 2027's rules
in the 2026 MVP.
Refusal memory into the banner spec
Decide with Leon: the anonymous six month refusal cap goes into the MVP banner now, while the banner is still being built. Small build, launch headline.
Spec the bannerless mode
One page spec for first party aggregated measurement on the existing edge stack. No build commitment until pilots pass the gate — but the spec sharpens every sales conversation.