Where privacy law is heading through 2028, what it does to Velo's USPs, and the six new ones it opens. Every regulatory claim in this deck survived adversarial verification against primary sources.
The consent market is a barbell. Nobody owns the middle, where agencies live.
OneTrust hikes at renewal and moves upmarket. Didomi rolls up Sourcepoint and Addingwell under private equity. The small end is being pushed out the door.
Cookiebot doubled its base tier in Aug 2025 and kept pricing that multiplies by every client site. The migration wave it triggered is documented and still moving.
They need consent wired into Consent Mode v2, server side tagging and GA4 across a whole portfolio — not another banner license per domain. That is Velo's ground.
The standalone ePrivacy Regulation was withdrawn in Oct 2025. What replaces it changes what a CMP is for.
First party aggregated audience measurement, run by the site solely for its own use, stops needing consent. Analytics only sites lose the legal trigger for a banner entirely.
Refusing must take one click of equal effort, and after a refusal the site may not ask again for six months. Remembering that refusal must itself be trackingless — no unique identifiers.
The Commission proposed machine readable consent set once in the browser. The Council deleted it in June 2026, reportedly after Google lobbying. It returns only if Parliament restores it in trilogue.
Non personal data, media sites and third party analytics keep the banner through 2028. Regulators formally support the cookie track — it is the likeliest part of the package to survive intact.
Nobody gets fined for lacking a banner anymore. They get fined for consent that does not hold up under inspection — which is an engineering problem, not a legal template.
When the law shrinks the banner, incumbent revenue shrinks with it. Velo makes money on recovered signals, proof and infrastructure — the parts that keep growing. That conflict of interest cannot be copied.
The only CMP whose business model improves as banners get smaller. Incumbents must defend the banner. We get to obsolete it.
| # | USP | Verdict | Why |
|---|---|---|---|
| U1 | Revenue recovery positioning | Strengthened | Value migrates from rendering banners to engineering signals — the exact thing we sell |
| U2 | Flat portfolio pricing | Unchanged | Regulation does not touch it; Cookiebot renewal math still does the selling |
| U3 | Tracking native edge stack | Strengthened | The edge becomes the natural enforcement point for signals and refusal memory |
| U4 | Accept and reject parity | Becomes law | What we ship by conviction turns mandatory; incumbents must dismantle asymmetric flows |
| U5 | No TCF in the MVP | Validated | Publisher tooling stays an incumbent niche our advertiser ICP does not need |
| U6 | Honest scan · 72h setup · proof | Unchanged | Feeds straight into the new consent quality USP below |
Full analysis with sources: knowledge/velo/research/regulatory‑future‑usp‑strategy‑2026‑07.md
| # | USP | Regulatory driver | Open ground |
|---|---|---|---|
| N1 | Omnibus ready by design | Art 88a(4): one click refusal + six month trackingless memory | Nobody ships it; retrofitting 2M+ legacy banners is brutal |
| N2 | Bannerless analytics | Art 88a(3): consent free first party aggregated measurement | Incumbents cannot lead without cannibalizing banner seats |
| N3 | Signal honoring receipts | GPC binding in the US now; a signal in every browser by Jan 2027 | Nobody sells proof of honoring |
| N4 | Audit grade consent proof | CNIL fines invalid design, not missing banners | Nobody productizes it below enterprise |
| N5 | Adaptive jurisdiction engine | EU, UK and US diverge hardest through 2028 | Enterprise only today — manual, quote based |
| N6 | Agent facing consent | AI agents never render a banner | Usercentrics claims it in positioning; built an enterprise gateway instead |
Ranked by strategic fit times build cost on the stack we already run. N1 and N2 belong in the MVP window; N6 starts as content, not code.
One click refusal of equal effort, plus a refusal memory that is itself trackingless — an anonymous frequency cap with no unique identifiers, the exact shape noyb and the EDPB endorse. Cheap to build while the banner is still being built; expensive for incumbents to retrofit across millions of live deployments. The launch headline writes itself: already compliant with the rules arriving in 2027.
A first party, instantly aggregated measurement mode that legally needs no consent under the whitelist. It maps onto the server side and edge masking stack we already run. And if the final wording stays as narrow as regulators want, GA4 as commonly deployed will not qualify — which makes our compliant mode the upgrade path we sell against it.
On analytics only sites the whitelist removes the legal trigger. A CMP that is only a banner is a melting asset — which is the incumbents' problem, not ours.
Asymmetric flows and nagging become illegal under Art 88a(4). Our consent rate testing optimizes within equal effort designs only — anything else turns into a liability we can point at in competitors.
Media sites keep their banners and their certified CMPs. That niche stays incumbent held. Skipping it in the MVP was right and stays right.
| Item | The question | Horizon |
|---|---|---|
| 88b | Does Parliament restore browser signals in trilogue? | H2 2026 |
| 88a(3) | Does hosted third party analytics ever qualify for the whitelist? Decides how big bannerless analytics gets | trilogue |
| Hannover | Does the GTM consent perimeter harden on appeal? It touches our server side architecture directly | re research before citing |
| Unverified | Consent or pay, Privacy Sandbox, UK divergence — no verified claims this pass | next research pass |
Timing works for us: adoption late 2026 at the earliest, Art 88a applying about six months later. The compliance confusion window lands exactly in Velo's first two commercial years.
Decide with Leon: the anonymous six month refusal cap goes into the MVP banner now, while the banner is still being built. Small build, launch headline.
One page spec for first party aggregated measurement on the existing edge stack. No build commitment until pilots pass the gate — but the spec sharpens every sales conversation.
knowledge/velo/research/regulatory‑future‑usp‑strategy‑2026‑07.md · a product of Amplio Data®