Digital omnibus: what the Council's text changes for cookie banners

The digital omnibus is the EU proposal that would rewrite parts of the GDPR and the ePrivacy cookie rule in one go. On 21 October 2026 the Council of the EU agreed its position on it. That text keeps consent as the rule for cookies. It adds a short list of purposes that would need no consent, makes refusal a one-click job, and stops a site asking again for at least four months after a no. None of it is law. Parliament hasn’t voted, and countries would get two years after adoption to bring it in. So today’s EU cookie law still applies to your banner.

I’ve read the Council’s mandate, the Commission’s original proposal and Parliament’s file. Below: what the omnibus is, what the Council agreed, what it would change on a cookie banner, what the Council threw out, the GDPR parts that touch a website, the timeline, and what to do with your banner now.

What the digital omnibus is

The European Commission published the proposal on 19 November 2025 as COM(2025) 837, under the file number 2025/0360(COD). It’s one regulation that amends a stack of others: the GDPR, the ePrivacy Directive, the Data Act, the NIS2 cyber rules and more, and repeals a few, such as the platform-to-business regulation. It belongs to what the Council calls the “Omnibus VII” package. That package had a second proposal on AI, and the Council’s press release notes For the latter AI-related part, the legislative act was adopted on 29 June 2026.

The Council (the member states) and the European Parliament each settle their own version, then negotiate one text. The Commission’s proposal is only the starting point.

What the Council agreed on 21 October 2026

The member states’ permanent representatives, meeting as Coreper, agreed the Council’s negotiating mandate on 21 October 2026. The text went out the next day as Council document 14756/26, and the Council updated its press release with it. The document shows every change against the Commission’s text: additions in bold, deletions struck through. That matters, because a lot of what the Commission wrote is struck through.

On cookies, the press release is short. The Council mandate maintains the rules on cookies and other kinds of online tracking technologies under the e-privacy directive. It adds purposes where consent wouldn’t be needed, thus reducing the number of cookie banners when navigating online.

Reducing, not removing. Keep that word in mind when someone tells you banners are going away.

The Irish presidency now waits for Parliament. Ireland’s minister of state for European affairs, Thomas Byrne, said the Council is ready to engage in negotiations with the European Parliament as soon as it has established its position.

The ePrivacy directive and your cookie banner: what would change

Today the cookie rule is Article 5(3) of the ePrivacy Directive: storing or reading anything on a visitor’s device needs consent, with two exceptions: carrying a communication, and what’s strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. Analytics, ads, chat widgets and video embeds all need a yes.

The Council would replace that paragraph. Consent stays the default: storing or reading on a device is only allowed when that person has given his or her consent, judged by the GDPR’s standard of consent. Then comes a list of six purposes that wouldn’t need consent, each only where the storage is solely related to and strictly necessary for it. In plain words:

1. Sending the communication. Same as today.
2. A service the visitor asked for, “including its functionality”. The basket, the login, the language they picked.
3. Audience counting. Anonymous, aggregated figures on how your service is used, run by you or by someone on your behalf, where the data isn’t used for anything else, shared with third parties or combined with third-party data.
4. Media audience measurement under the European Media Freedom Act, pseudonymised after collection and not tracking the visitor outside the service measured.
5. Security. Keeping the service or the visitor’s device technically secure.
6. Measuring contextual ads. Counting how an ad based only on the page in front of the visitor, or a single search, was displayed and how it performed. No personal data, no profiling, nothing about what the visitor did before, after or on other sites.

Then the banner itself. Under the Council’s text, a visitor shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means. If they say yes, you can’t ask again for the same purpose while that consent holds. If they say no, you can’t ask again for the same purpose for a period of at least four months.

	Today (ePrivacy Directive)	Commission proposal (Nov 2025)	Council text (Oct 2026)
Where the cookie rule lives	ePrivacy Directive, Article 5(3)	GDPR, new Article 88a, where personal data is involved	ePrivacy Directive, rewritten Article 5(3)
Purposes with no consent	Transmission, and what’s strictly necessary for a requested service	Four: transmission, requested service, own audience measurement, security	Six: the Commission’s four, reworded, plus media audience measurement and contextual ad measurement
Refusing	Not written in the law; regulators read it in	Single click or equivalent	Single click or equivalent
Asking again after a no	Not written in the law	Not for at least six months	Not for at least four months
Browser signals	No	Sites must honour them (Article 88b)	Struck out

What does that mean for a banner? Two things.

A “reject all” on the first layer would stop being regulator guidance and become written law. In 2023 the European Data Protection Board’s cookie banner taskforce found that a vast majority of authorities treated a banner with no reject option on any layer as falling short of valid consent. A few said they couldn’t, because Article 5(3) doesn’t spell out a reject option. The Council’s text would spell it out.

And some analytics might leave the banner, but only if it ticks every box in purpose 3. Anonymous, aggregated, used for nothing else, not shared, not mixed with anyone else’s data. A tool that follows a visitor around or feeds an ad network wouldn’t fit. Would the analytics tools most small sites run today fit? I can’t tell you yet. It turns on how each one is set up, and on wording that could still move in the talks. If you want to know which of your cookies are which, the guide to types of website cookies is the place to start.

What the Council dropped: browser signals and Article 88a

The Commission had a bigger plan. It wanted cookies that involve personal data to move out of the ePrivacy Directive and into the GDPR as a new Article 88a. Its own version of the ePrivacy rule would then simply stop applying where the visitor is a person and personal data is processed.

Next to it sat Article 88b. Sites would have had to accept a yes or a no sent automatically, as a machine-readable signal from the visitor’s browser or settings, and respect it. Browser makers that aren’t SMEs would have had to build that in. Media service providers were exempt.

In the Council’s mandate, both articles are struck through from the first line to the last, on pages 143 and 144. So the Council’s version has no browser-signal duty at all, and cookies stay in the directive.

Parliament hasn’t said where it stands. Its committees could put browser signals back, or not. I won’t guess. What I can say is that a tool sold as “omnibus-ready” for browser signals is selling readiness for a rule that, right now, only one of the two lawmakers wants.

GDPR changes 2026: the parts that touch a website

First the honest line: nothing in the GDPR has changed because of the omnibus. Not yet. Here’s what the Council’s text would do to the parts a website owner meets.

The definition of personal data stays

The Commission had proposed adding sentences to Article 4(1) saying information isn’t personal data for an entity that can’t identify the person. Some reports said the Council kept that. It didn’t. In the mandate, those sentences are struck through on page 131, and the press release says the mandate maintains the current definition of personal data.

A new rule on pseudonymised data

The Council adds an Article 25a instead. Its second paragraph reads: Pseudonymised data shall not be considered personal data for third party if that third party is unable to identify the natural person to whom the data relates. It then says that if that data goes on to someone who can identify the person, it’s personal data again, and that it always stays personal data for a processor working for you. So the “it depends who holds it” idea survives, but only for pseudonymised data, not in the main definition. There’s more on that idea in our case file on pseudonymised data.

Breach reports

Today the GDPR asks for a report to the authority within 72 hours where feasible. The Commission proposed reporting only breaches likely to result in a high risk, within 96 hours. The Council backs that.

Privacy notices

The Council’s text would drop the duty to give a notice where there are reasonable grounds to believe the person already knows who you are and why you’re processing their data, and the processing isn’t likely to be high risk. It wouldn’t cover complex processing, large amounts of data or sensitive data. The press release calls these specific low risk circumstances in relation to information obligations. I wouldn’t count on a site that runs ads being one of them.

Digital omnibus timeline: what happens next

Parliament is behind the Council. Its Legislative Observatory file shows a joint committee of ITRE (industry) and LIBE (civil liberties), with two co-rapporteurs appointed on 25 February 2026: Aura Salla (EPP) and Marina Kaljurand (S&D). IMCO and JURI give opinions. The status reads “Awaiting committee decision”.

Date	What happened	Who
19 November 2025	Proposal published, COM(2025) 837	Commission
19 January 2026	Sent to Parliament’s committees	Parliament
25 February 2026	Co-rapporteurs appointed	Parliament
22 June 2026	Draft report, PE786.818	Parliament
29 June 2026	The separate AI omnibus adopted	Council and Parliament
27 July 2026	Amendments tabled in committee	Parliament
21 October 2026	Negotiating mandate agreed in Coreper	Council
22 October 2026	Mandate published, document 14756/26	Council
Not scheduled	Committee vote, then plenary	Parliament
After that	Trilogue: the three institutions negotiate one text	All three

After a deal, the cookie part wouldn’t switch on overnight. The Council’s text gives member states 24 months after the regulation is adopted to pass and publish their national rules, and has the rules apply from that same point. It would also hand enforcement of the cookie rule to each country’s GDPR authority. The three institutions’ “One Europe, One Market” roadmap aims to finish all the simplification packages by the end of 2027, per the Council. Add two years to that.

This isn’t the first try at new cookie rules, by the way. A separate ePrivacy Regulation proposed in 2017 never got through, and the Commission withdrew it in its work programme of 12 February 2025.

If you’re about to change something on the strength of any of this, check with someone who advises you on EU law. A proposal can look very different by the time it’s adopted.

What to do with your banner now

Most of what the Council’s text would write down, regulators already ask for. So the to-do list is today’s list.

1. Nothing optional before a choice. Analytics, ad pixels, video embeds and chat widgets wait for a yes.
2. Reject next to accept, on the first layer. Same size, same effort. The examples in cookie banner examples show how others lay it out.
3. A no that actually stops the tags. A button that closes the banner but leaves the scripts running isn’t a refusal.
4. Don’t ask again on every page or every visit. Store the no and respect it.
5. Keep a list of what each cookie is for. If the consent-free purposes become law, that list is how you’d show your audience counting fits purpose 3, and that everything else is behind the banner.
6. Don’t take the banner down because of a proposal. The rule that applies to you today is the old Article 5(3), read the way the EDPB’s taskforce read it.

Check your banner from a phone

You don’t need a tool for this. A phone and five minutes.

1. Open your site in a private window, so no earlier choice is stored.
2. Don’t touch the banner. Tap the padlock or site information icon and open the cookies or site data list. Anything from an analytics or ad domain here loaded before a choice.
3. Look at the first layer of the banner. Is there a reject button, and is it as big and as easy to reach as accept?
4. Tap reject. Reload. Open the list again. It shouldn’t have grown.
5. Now try it in your normal browser. Tap reject, open two more pages, then close the tab and come back tomorrow. If the banner is back on every page or every visit, your no isn’t being remembered.
6. Open your cookie policy. Does every cookie have a purpose next to it?

There’s a longer walk-through in how to check website cookies, and the GDPR compliance checklist covers the rest.

Peeky reads the public pages of your site, and consent is only one part of it: he runs more than ten checks for each jurisdiction, such as the EU, UK and US. For the banner, the checks are EU-01 for trackers that load before consent, EU-02 for tracking that carries on after “reject all”, and EU-03 for a reject that’s harder to reach than accept. He notes what he saw for each.

Questions people ask

What is the digital omnibus?

It's a European Commission proposal from 19 November 2025, COM(2025) 837, that would amend the GDPR, the ePrivacy Directive's cookie rule, the Data Act and the rules on incident reporting in one regulation. It's still a proposal. The Council agreed its negotiating position on 21 October 2026, and Parliament hasn't adopted its own yet.

Will cookie banners disappear under the digital omnibus?

Not under the Council's text. It keeps consent as the rule for storing or reading anything on a device and adds six narrow purposes that would need no consent. The Council says that would mean fewer banners, not none. Advertising and tracking across sites would still need a yes, and refusing would have to take one click.

When will the digital omnibus apply?

There's no date yet. Parliament's committees are still working on their report, then the Council and Parliament have to agree a final text. For cookies, the Council's mandate gives member states 24 months after adoption to write the new rule into national law and start applying it. Until then today's rules apply.

What is the difference between the ePrivacy directive and the GDPR?

The GDPR covers personal data, whatever the technology. The ePrivacy Directive's Article 5(3) covers storing or reading anything on a person's device, personal data or not, which is why it's the cookie rule. A planned ePrivacy Regulation from 2017 was withdrawn in 2025. The Commission wanted to move cookies into the GDPR. The Council's text keeps them in the directive.

What GDPR changes are coming in 2026?

None from the omnibus so far. It's still being negotiated. The Council's position keeps the current definition of personal data, adds a rule on pseudonymised data, would give 96 hours instead of 72 to report a breach and only for high-risk ones, and would ease privacy-notice duties in some low-risk cases.