The cookie banner – that you (perhaps) click on at every (first) visit to a website – could soon change. The Council of the EU has already approved its negotiating position on the draft Digital Omnibus package, which is intended, amongst other things, to simplify the rules for cookies and similar technologies. In addition to the exceptions to the requirement for consent, it anticipates that, following a refusal, the provider may not request consent for the same purpose again until at least four months have elapsed. In this article, we will focus on the proposed changes to the rules on cookies and their impact on online service providers.
Why change the rules on cookies
Cookie consent banners (sometimes also bars) have become a common feature of virtually every website. In the explanatory memorandum to the draft Digital Omnibus, the European Commission itself refers to “consent fatigue” as an issue for which a legislative solution has long been awaited. Users come across banners everywhere, yet the information provided about the purposes of data processing is often not sufficiently comprehensible. At the same time, online service providers have long been grappling with a dual regulatory regime arising from the Directive on privacy and electronic communications (“ePrivacy Directive”) and the General Data Protection Regulation (“GDPR”), which leads to legal uncertainty regarding the appropriate legal basis for processing, increases compliance costs and, in some cases, also means that supervision of both frameworks is carried out by different national authorities.
The European Commission aims to address this fragmentation through the Digital Omnibus initiative, which, amongst other things, amends the ePrivacy Directive. Article 5(3) of the ePrivacy Directive currently forms the basis for the rules governing the storage of information on the user’s terminal device and access to such information: as a general rule, consent is required for this, with the exception of technical storage necessary for the transmission of a communication or the provision of a service explicitly requested by the user. This applies in particular to cookies, SDKs (third-party software libraries in mobile apps, e.g. for analytics or targeted advertising) and pixels.
The default rule remains unchanged: consent will generally still be required. However, the Digital Omnibus is intended to expand and clarify the circumstances in which consent will not be required, for example, the storage of or access to information necessary solely for the creation of anonymous aggregated data on the usage of an online service (e.g. the total number of visits to a website), subject to the conditions described below.
Articles 88a and 88b of the GDPR were left out
The Commission had originally proposed adding new Articles 88a and 88b to the GDPR, which would regulate the storage of information on users’ end devices and access to such information directly within the GDPR, rather than under the existing provisions of the ePrivacy Directive. Furthermore, Article 88b was intended to introduce an obligation to allow consent to be given or withheld automatically, typically via browser settings.
In its negotiating position, adopted on 21 October 2026, the Council builds on the compromise proposal from September and still does not expect the proposed Articles 88a and 88b to be added in the GDPR. Under its proposal, the rules on cookies would therefore remain in the ePrivacy Directive, and the proposed obligation under Article 88b to take browser settings into account would not be introduced.
The rules thus remain in the ePrivacy Directive. Specific exceptions to the requirement for consent are to be set out directly in Article 5(3) of the ePrivacy Directive. Online service providers will therefore primarily assess the question of whether cookies or similar technologies may be used without consent under the ePrivacy Directive; the GDPR will also apply in parallel where personal data is processed.
The Council’s approved negotiating position provides that consent will not be required where the storage of information on the user’s terminal equipment or access to such information relates exclusively to one of the following purposes and is strictly necessary to achieve that purpose:
- transmission of electronic communications, for example, the retention of data necessary for the delivery of an email or message;
- the provision of a service, including its functionality, that the user has expressly requested, such as remembering the contents of a shopping cart in an online shop or the website’s language settings;
- the creation of anonymous, aggregated information on the use of an online service for the purpose of measuring its audience figures, provided that this is carried out by the service provider or a third party acting on its behalf, and provided that the data collected is not further processed for any other purpose, shared with third parties or combined with data from third parties, for example the total number of visits to the site;
- audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083 (European Media Freedom Act), provided that personal data are pseudonymised after collection, are not processed for any other purpose, the measurement does not involve tracking user activity outside the service or media content being measured, and information shared with third parties other than those acting on behalf of or jointly with the provider does not contain personal data, for example, measuring the readership of articles on a news website;
- maintaining or restoring the technical security of the resources strictly necessary for the provision of the service requested by the user, or the technical security of the terminal equipment used to provide such a service, for example, installing a security update;
- measurement of ad impressions and performance based solely on the content displayed to the user during a single visit to a page or in response to a single search query, provided that such measurement does not involve profiling or linking to the user’s past or future activity, and the data is pseudonymised after collection and is not further processed for any other purpose, such as verifying how many times a particular advert format was displayed alongside a specific article.
Apart from these six exceptions, the user’s consent is still required for the storage of or access to information. If the user refuses to give consent, the proposal provides that it will not be possible to circumvent their decision by repeatedly requesting the same consent, and expressly stipulates that a new request for the same purpose should not be submitted by the online service provider until at least four months have elapsed (instead of four months previously proposed).
Analytics without consent – yes, but only where data is genuinely restricted
For many online service providers, the most significant option may be the ability to use, without consent, tools to generate anonymous aggregated data on the use of the online service. However, it is the actual processing configuration that is decisive: the result must be anonymous, aggregated information (e.g. “5,000 page views today”), not an analysis of individual users’ behaviour.
An even stricter regime is set to apply to the measurement of impressions and performance of so-called contextual advertising – that is, advertising placed solely on the basis of the content the user is currently viewing. Without consent, it would be possible to measure advertising based solely on the content the user is currently viewing, for example, during a single visit to the page or a single search query. The condition is that the data must be pseudonymised, must not be processed for any other purpose, must not be linked to the user’s past or future activity, and must not be used for profiling or for programmatic advertising.
Pseudonymisation is not the same as anonymisation. Pseudonymised data may still constitute personal data if it can be linked to a specific individual using additional information. An exemption from the requirement for consent to the use of cookies therefore does not automatically relieve online service providers of their obligations under the GDPR, in particular the obligation to provide transparent information about processing, to ensure appropriate security measures, and to have a legal basis for the processing of personal data.
How to prepare
The Digital Omnibus still has a long way to go before it becomes an applicable piece of legislation.
In preparation for changes, it is advisable to check the status and identify the cookies, pixels and SDKs used by the online service provider, including tools deployed by marketing or media suppliers. For each tool, it is then necessary to check three things: whether it links identifiers across visits, websites or devices; whether it creates advertising segments; and whether the online service provider using the tool utilises the data for its own purposes.
Online service providers should, first and foremost, clarify where each tool fits in: whether it relates to basic traffic measurement or to further use of data obtained from the measurement, such as behavioural and programmatic advertising. The Digital Omnibus, in fact, simplifies matters only for the first group. In the case of the second group, the user’s consent will generally continue to be required.
What will happen next?
As of 21 October 2026, the Council has an approved mandate to negotiate with the European Parliament and the Commission in a trilogue. The final text, including the exemptions from the consent requirement, may still be subject to change during the negotiations. Furthermore, the proposed draft anticipates that Member States will amend the rules on cookies in their national legislation within 24 months of the adoption of the Regulation and will begin to apply them from that date.
For the time being, therefore, the Digital Omnibus is not a reason to disable the cookie banner. However, it is a good reason to review once again which cookies and similar technologies an online service provider uses, for what purposes, and whether – in view of the announced changes – they will allow the use of the service to be measured without identifying or tracking individual users, or, conversely, whether they are used to profile users or link their activity across different services.
