Cookies: what the European omnibus would change for your banner

On 21 October 2026, EU member states agreed their negotiating position on the European digital omnibus. It lengthens the list of trackers that can be used without consent, audience measurement included, moves the deadline for reporting a personal data breach from 72 to 96 hours, and drops the browser-level refusal signal the Commission had proposed.

So the good news for your cookie banner is real, but it is not for now. This is only the Council’s position: the European Parliament has not yet adopted its own, negotiations have not started, and the final text can still shift on the most contested points. In the meantime, the law in force has not changed by a single line. Here is what is on the table, what is no longer on it, and what is reasonable to do today.

What happened on 21 October

The European Commission presented its digital simplification package on 19 November 2025. It touches the GDPR, the ePrivacy directive, the Data Act and incident reporting all at once. Its overview page sets out the scope.

On 21 October 2026, the member states’ representatives adopted the mandate that will serve as the Council’s position in negotiations with Parliament. The Council press release summarises the logic, and the mandate itself, document 14756/26, gives the exact wording. That wording is what we read for this article, rather than the summaries going around.

One point is worth settling straight away, because many headlines get it wrong: nothing has been voted. A negotiating mandate is neither a law nor an agreement. It is the position governments will defend when they face the members of Parliament.

The purposes that would no longer require consent

For a website publisher, the heart of the matter is the rewriting of article 5(3) of the ePrivacy directive, the one requiring consent before reading from or writing to a user’s device. The mandate writes a closed list of exempt purposes into it. Four deserve your attention.

• First-party audience measurement. Producing anonymous aggregated statistics about the use of an online service, provided it is carried out by the provider of the service the user requested, or by a third party on that provider’s behalf, and that the data is neither used for another purpose, nor shared with third parties, nor combined with third-party data.
• Media audience measurement. The one provided for in article 24 of the European Media Freedom Act, subject to pseudonymisation after collection, with no tracking of the user’s activity outside the service, and no personal data shared with third parties.
• Technical security. Maintaining or restoring the technical security of the means strictly necessary to provide the service the user requested, or the technical security of the terminal used.
• Contextual advertising measurement. Measuring the display and performance of advertising based on context, provided the data is pseudonymised after collection as a security measure, is not used for profiling or programmatic advertising, and the measurement does not cover the user’s past or future activity, including across sites, apps or services.

The drafting is tight, and deliberately so. The text explicitly closes the door on cross-site matching, profiling and resale. In other words, tools that reuse your data for their own account would stay outside the exemption, exactly as they do today.

The browser signal is dropped

This is the heaviest concession, and it went almost unnoticed. The Commission wanted to take tracker rules out of the ePrivacy directive and write them into the GDPR, with two new features: a one-click refusal and, above all, an automated, machine-readable signal through which the browser would express the user’s choice once and for all.

The Council removes that mechanism and sends the rules back to where they sit today, in the ePrivacy directive. Banners therefore survive, simply with fewer cases where they are mandatory. For publishers, that is a gain. For users, the one measure that would genuinely have ended consent fatigue disappears from the text.

Two safeguards remain on the user side. Refusing must stay possible in an easy and intelligible manner, through a single-click button or equivalent means. And after a refusal, consent for the same purpose cannot be requested again for at least four months. If you ask again on every visit, that point concerns you directly.

Data breaches: 72 hours would become 96

The mandate amends article 33 of the GDPR. The deadline for notifying a personal data breach to the supervisory authority would move from 72 to 96 hours after becoming aware of it, with the same adjustment for EU institutions towards the European Data Protection Supervisor.

The trigger threshold moves too: only breaches likely to result in a high risk to rights and freedoms would be notified to the authority, the others staying in the internal register. The European Data Protection Board would publish a common template and lists of cases presumed to be high risk or not.

Twenty-four hours more sounds like little. In practice, it is the difference between a rushed Sunday-evening notification and a documented one. But the key point does not change: the clock starts when you become aware of the breach, which assumes you can detect it. That is the same conclusion we reached about securing applications, and it runs through the Cyber Resilience Act and NIS 2 alike: a reporting obligation without detection capability protects nothing.

Worth noting too, the single EU reporting desk the Commission had imagined has been reduced by the Council to national entry points, with an information point at EU level.

Who would supervise all this

The mandate provides that member states designate the GDPR supervisory authority to supervise and enforce the rules under article 5(3). In France, that would confirm the CNIL in a role it already plays in practice on trackers. A useful clarification, since the legal basis today sits in the ePrivacy directive rather than the GDPR.

The AI part, less commented and more structural

While attention goes to banners, the mandate deals with a subject that commits companies building AI products far more. It introduces a provision on processing personal data in the context of developing and operating an artificial intelligence system or model.

The principle the Council retained: such processing may rest on the legitimate interest of the controller or a third party, within the meaning of article 6(1)(f) of the GDPR. The usual exception remains: that interest gives way to the interests or fundamental rights and freedoms of the data subject, and the text expressly mentions the case where that person is a child. The balancing test, the right to object and the safeguards all stay mandatory, so this is no blank cheque.

The mandate also adds accommodations for the special categories of article 9, in particular where such data ends up residually in a training set without being sought, and for one-to-one biometric verification where the data stays under the person’s control. If you train or run a model on data from your users, this is the part of the package to watch closely, rather than the cookies. It complements what we wrote about the AI Act, which governs the system’s compliance where the omnibus governs the legal basis for the data.

Three points that can still move

A negotiating mandate is not a final text, and some subjects are known friction points with Parliament. Three are worth following.

The place of cookies, first. The Council brought the rules back into the ePrivacy directive where the Commission wanted them moved into the GDPR. That architectural choice decides the real timetable: a regulation applies directly, a directive has to be transposed by each member state. If Parliament reopens that point, the date of application changes.

Pseudonymisation next, meaning the question of when pseudonymised data stops being personal data. The Council keeps the current definition of personal data and handles the subject separately, providing for an opinion from the European Data Protection Board. The final drafting will have very concrete consequences for audience analytics and for training datasets.

Legitimate interest for AI, finally, probably the most debated provision in the package. Data protection authorities have already voiced reservations about the overall balance of the text. This is where the gap between the Council’s position and Parliament’s is likely to be widest.

Why you should not change your banner today

The timetable is the part most articles skip, and it is precisely the part that drives your decision.

The European Parliament must first adopt its own position. The committee vote is expected in early 2027. Then come negotiations between the three institutions, which will focus on exactly the most contested points, the place of cookies among them. The final text will be published in the Official Journal, enter into force a few days later, but several of its provisions will only apply after a further delay. The privacy part goes through a directive that member states will have to transpose, with a twenty-four month deadline after adoption set out in the mandate.

Practical conclusion: removing a banner today on the grounds that Europe is about to relax the rules would mean applying a text that does not exist. The GDPR and the ePrivacy directive apply in their current versions, 72-hour deadline included.

What you can do right now instead

Here is the point the news cycle hides: for audience measurement, the exemption did not wait for the omnibus. It already exists in French law, under article 82 of the Data Protection Act, and the CNIL publishes its criteria. A purpose strictly limited to audience measurement, for the sole account of the publisher, anonymous statistics, no cross-matching, no tracking across sites.

In other words, many sites could already do without a banner for their audience measurement, provided they change tools. That is exactly the subject we covered in our comparison of Google Analytics alternatives: what blocks you is not the law, it is choosing a tool that reuses the data for its own account.

Three useful actions, then, none of which depends on how the negotiations end. First, inventory your trackers purpose by purpose, and check which already fall under an exemption. Second, check that refusing is as easy as accepting, and that you do not ask for consent again on every visit: both are already required today, and the future text tightens them rather than relaxing them. Third, document your choices, as with the rest of your GDPR compliance.

If the omnibus is adopted in the spirit of the mandate, this inventory work is exactly what will let you remove banners safely. So it is never wasted.

What we take away from it

The Council has taken a position favourable to publishers: more purposes exempt from consent, first-party audience measurement and technical security among them, and twenty-four more hours to notify a data breach. It has, on the other hand, given up the browser signal, the one measure that would really have reduced the number of banners shown.

None of this is applicable. Parliament has to take a view, the trilogue is still to come, and transposition will take months more. So treat headlines announcing the end of cookie banners with caution.

What is actionable today is the French exemption for audience measurement, and an honest banner where refusing costs one click just like accepting. We handle these trade-offs on our sovereign applications projects, audience measurement included. If you want to know which trackers on your site could already do without consent, let’s talk.