Limitations on online tracking are object of a regulatory debate that has shifted to the use of default rules to enhance privacy. The European Union implemented this idea with the Cookies Directive. The Directive aims to change the default system for tracking and move to an opt-in system in which data subjects must agree to it beforehand. This article evaluates the Directive’s implementation across Member States and studies the cases of the Netherlands and the UK. It then draws from the behavioural economics literature on default rules to evaluate these regulations and to consider whether it is possible to implement the policy in a way that avoids some of the problems they faced.