On this page
Fewer consent requests, one day. Not yet.
The Digital Omnibus on cookies moved a step on 21 October 2026, when the Council of the EU agreed its position on the package the European Commission proposed on 19 November 2025 to simplify the EU's digital rules. Member states want more purposes that need no consent, such as audience measurement and device security. Cookie rules stay in the ePrivacy Directive instead of moving into the GDPR as the Commission proposed, and the GDPR definition of personal data stays as it is.
It is not law. The European Parliament has no position yet, and then Parliament, Council and Commission must agree. Until then today's rules apply in every member state, with national regulators such as Belgium's reading them strictly.
- Where cookie rules sitToday, in strict member statesIn the ePrivacy Directive, transposed per countryCouncil position (not law)Stay in the ePrivacy Directive
- Audience measurement cookiesToday, in strict member statesConsent needed, first-party tooCouncil position (not law)On the list of purposes without consent
- Cookies for device securityToday, in strict member statesOnly under the narrow exemptionCouncil position (not law)On the list of purposes without consent
- What personal data isToday, in strict member statesGDPR definitionCouncil position (not law)Stays the same
- Deadline to report a breachToday, in strict member states72 hoursCouncil position (not law)Longer, the Commission proposed 96 hours
- Where you report an incidentToday, in strict member statesA separate channel per ruleCouncil position (not law)One national entry point per member state
Advertising cookies, such as a Meta pixel, need consent in both columns. Until there is a law, the left column applies.
Where the Commission and the Council part ways
The Council does not follow the Commission everywhere. On three points it chose another road, and those points are what Parliament will negotiate:
| Point | Commission proposal, November 2025 | Council position, October 2026 |
|---|---|---|
| Where cookie rules go | Into the GDPR, a new Article 88a | Stay in the ePrivacy Directive, with a longer list of purposes without consent |
| What personal data is | Refine the definition | Keep today's definition, add a provision on pseudonymisation |
| Where incidents are reported | One entry point at EU level | A national entry point per member state, plus an EU information point |
On the breach itself they agree: the deadline should be longer. The Commission also proposed that a breach be reported only when it is likely to pose a high risk to people. Europe's data protection authorities had already found the cookie exemptions in the proposal broader than today's rules. What your data processing agreement says about breaches keeps applying for now. France already exempts some audience measurement under conditions; see CNIL cookie rules.
Parliament has the next move
Two Parliament committees handle the file together, ITRE (industry) and LIBE (civil liberties), with Aura Salla and Marina Kaljurand as rapporteurs. A draft report has been on the table since June 2026 and amendments were tabled in July, but the committees have not voted yet. Only after a committee vote and a plenary vote can trilogue start. The three institutions agreed in April 2026 to conclude all simplification packages by the end of 2027. For a cookie banner that means: do not count on a new rule in 2027, let alone one that already applies.
From proposal to a rule that applies
- Parliament's positionITRE and LIBE vote on their text, then the plenary.
- TrilogueParliament, Council and Commission negotiate a joint text.
- Adoption and publicationBoth institutions approve the deal, and it appears in the Official Journal.
- ApplicationThe rule applies only after the transition period in the text. Until then the current one does.
Building for the strictest regulator
Today's cookie rules are national versions of the ePrivacy Directive, read by national regulators, and they differ in detail. A French publisher, a German web shop and a Belgian service firm can face different readings of the same banner. Belgium's data protection authority is among the strict ones: a reject button on the first layer, as visible as "accept all"; no colours, sizes or placement that push towards yes; no cookie wall; consent also for analytics cookies on your own domain, where some regulators elsewhere accept an exemption; a choice remembered for six months as reasonable in principle; and withdrawing as easy as agreeing. If you sell into several EU countries, build one banner to the strictest reading and keep it configurable per cookie type. Whether you need a banner at all is answered in do I need a cookie banner, and what goes in the privacy statement in do I need a privacy policy.
Your banner, read the way a strict regulator reads it
- A reject button on the first layer, as visible as accept all.
- No cookies, analytics included, before the visitor chooses.
- No cookie wall: the site works after a refusal too.
- A short, honest explanation per cookie type, and a link to your privacy policy.
- An easy way to change the choice later, such as a footer link.
Cookieless measurement works today
Measurement that sets no cookies and stores no personal data falls outside the consent question, omnibus or not. For Business Centrum we built such measurement on AWS, with a Lambda and a database, counting visits and sources without a cookie. You see what comes in without an analytics banner. Campaigns tagged with a UTM code in the link show their source without storing anything on the visitor's device.
Ads stay tied to the banner
Advertising cookies are not on the Council's list. A Meta pixel, remarketing and Google Ads conversion tracking keep needing consent, even if the Council gets its way. How Google treats a visitor who refuses is in the Consent Mode change in Google Analytics; how Meta counts conversions after a click, in Meta's new click attribution. A shop that lives on ads gains most from a question visitors understand, and therefore answer with yes more often.
The same package covers AI and incidents
The Digital Omnibus is wider than cookies. Its AI part is already law: the Council adopted it on 29 June 2026 and it delayed the high-risk rules, read the EU AI Act delay. The data protection and incident part is still on the table. If you run software or a platform, follow it together with the Cyber Resilience Act reporting duty and, if you serve Belgian customers, the NIS2 deadline in Belgium.