Four major European telecom groups, joined in France by Orange, SFR, Bouygues and now Free, track millions of users through Utiq, an advertising system built on phone lines rather than cookies. Over 70 million identifiers have already been created across Europe. A “reject” option exists. In practice, protecting yourself is more complicated than it looks, and that matters for any independent hospitality business running a website.
In this article:
- The observation
- Utiq is not as clean as it sounds
- The “reject” button exists, but its effectiveness has limits
- Why it matters for independent hospitality businesses
- Three concrete actions to implement this week
- Our take at BMAX
- Sources
- Want a clearer view of your digital presence?
The observation
Third-party cookies are dying, slowly but surely. Browsers block them more aggressively every year, GDPR made consent harder to collect, and ad networks have spent years looking for a replacement that keeps cross-site tracking alive.
Utiq is one of the most advanced answers to that problem. It is a joint venture founded by four major European telecom operators, with several national carriers, including Orange, SFR, Bouygues Telecom and now Free in France, now participating. Unlike a cookie, Utiq works at the network level: when a visitor consents on a partner site, their carrier generates a pseudonymous identifier tied to that phone line, mobile or fixed. This identifier then follows the person across sites, across devices, and even in private browsing mode. It now works over 4G, 5G and home Wi-Fi alike.
As of February 2026, Utiq reported 36 partner operators, 330 publishers and over 70 million identifiers created across its markets, including 40 million in France alone.
Utiq is not as clean as it sounds
Utiq presents itself as a more privacy-respectful alternative to third-party cookies, built around centralized, simplified consent. On paper, that argument holds up. In practice, several experts and independent studies point to real limits.
First, unlike a cookie, a Utiq identifier cannot be cleared by wiping your browser or opening a private window. It lives at the network level, not on your device. As one cybersecurity expert told Cybernews, “a cookie is something you can delete, while a network-level identity is something that follows you.” A preprint study from the Universitat Politècnica de Catalunya goes further, arguing the Utiq token may be more intrusive than a regular cookie precisely because it never resets the same way.
Second, that same study analyzed the 100,000 most visited websites using Utiq and found that all of them layered additional tracking methods on top, notably font and canvas fingerprinting. In other words, sites are not replacing their older tracking tools with Utiq. They are adding it to what was already there.
Third, a Utiq identifier covers an entire connection, not just the person who clicked “Accept.” On a shared line, whether at home or at a small business, one person’s consent can effectively cover everyone on that connection.
The “reject” button exists, but its effectiveness has limits
This is the real question hospitality operators and their guests are asking: since there is a reject option, is that enough to be protected?
In theory, yes. Utiq states that no request is triggered if a user clicks “Reject,” and that a deletion request through its centralized ConsentHub portal removes the data within 24 hours. In practice, several obstacles significantly reduce that effectiveness.
The first obstacle is technical: Utiq integrates with sites using a technique called CNAME cloaking, which makes its requests look like they come from the site itself. As a result, common blocking tools such as uBlock Origin do not reliably detect Utiq, since its domain does not always show up in visible requests.
The second obstacle is access: revoking consent already given through consenthub.utiq.com requires connecting directly through your carrier network, with VPNs and ad blockers temporarily disabled. Most users have never heard of this step, and awareness of the portal itself is the biggest barrier of all.
The third obstacle is scope: revocation is tied to each connection separately. Someone browsing on mobile and on home Wi-Fi has to repeat the process on every line.
A fourth, more subtle obstacle: clicking “Accept” just once on a new site after revoking consent can be enough to create a fresh, valid consent that overrides the earlier revocation.
And even assuming a flawless opt-out from Utiq itself, that does nothing to stop the other tracking techniques, fingerprinting in particular, running in parallel on most partner sites, as the study above shows.
The reject button is not a fake. It works, strictly speaking, for Utiq itself. But using it effectively requires an active, technical, repeated effort, far from the “one click and you are done” most people expect. And it offers no protection against the other tracking tools running on the same site.
Why it matters for independent hospitality businesses
This might sound like a topic reserved for large ad networks. For a hotel, campsite or guesthouse relying on international bookings, it is closer to home than it looks.
First, if your website runs advertising pixels or works with partners (Meta, Google Ads, international booking platforms), you are indirectly connected to how those partners collect and cross-reference visitor data, Utiq and its companion tracking techniques included. Your consent banner should reflect what actually happens on your site, not just the “classic” cookies.
Second, the slow disappearance of third-party cookies is reshaping how online campaigns reach their audience. Properties that still rely on broad, loosely targeted advertising will likely see acquisition costs shift.
Third, digital trust is becoming a real commercial argument, especially for independent properties competing against large OTAs. A guest who feels a small hotel or campsite is transparent about the tools it uses, not just compliant on paper, is more likely to book direct.
Three concrete actions to implement this week
- Audit your consent banner (CMP). Make sure it actually lists every partner dropping trackers on your site, not just Google Analytics. If you are not sure what is really running on your website, a short digital audit can clarify this in one evening.
- Strengthen your first-party data. Newsletter subscribers, direct bookings, guest accounts, Google reviews: this is data you collect yourself, with explicit consent, independent of any third party or complicated revocation process.
- Be transparent, without the jargon. One clear sentence in your privacy policy beats a GDPR page nobody reads. If you personally hold a line with a Utiq partner carrier, revocation happens at consenthub.utiq.com, over that carrier’s own connection, with blockers temporarily off.
Our take at BMAX
This is not a call to treat Utiq as an absolute threat, nor as some flawless compliance fix. It keeps part of its promise (the reject option and deletion request both work, on paper), but its real-world effectiveness depends on a level of vigilance most people do not have the time or inclination to maintain. For an independent hotel or campsite, the real advantage has not changed: a direct relationship with guests, built on visuals that make people want to book, and a digital presence you actually understand and control, rather than tracking tools whose real protections are still debated by the experts studying them.
BMAX is a French digital and audiovisual agency based in Provence, working with independent hospitality businesses across the region.
Sources
- Is the Utiq consent service better for privacy than third-party cookies?, Cybernews
- Utiq: Orange, SFR, Bouygues et Free vous pistent maintenant, Webologie
- European telecoms launch Utiq tracking system to replace cookies
Want a clearer view of your digital presence?
Let’s talk for 30 minutes about what is actually running on your website, and how to strengthen direct bookings without relying on third-party tracking.
