On October 21, 2026, EU governments agreed their negotiating position on the Digital Omnibus, a package that would widen the cases where cookie consent is not needed and simplify parts of the GDPR. It is not law yet. Businesses serving EU customers, wherever they are based, should keep their current consent setup until a final text is agreed.
For anyone who has wrestled with consent banners, this is the most concrete sign so far that EU cookie rules may loosen. But the detail and the timing are still open.
Key takeaways
- On October 21, 2026 the Council of the EU agreed its negotiating position on the Digital Omnibus, covering the GDPR, cookie rules and incident reporting.
- The Council wants more cases where cookie consent is not needed, including cookies used to supply a service, measure audiences or protect a user's device.
- It keeps the GDPR's definition of personal data, supports a longer breach notification deadline and wants simpler information duties in low-risk situations.
- Nothing changes yet: the European Parliament still has to adopt its position, then both sides must agree a final text, so keep your current consent setup.
What happened
The Council of the EU's press release of October 21, 2026 says member states agreed a mandate to simplify data protection, privacy and cyber incident reporting rules. The Digital Omnibus was proposed by the European Commission as part of a wider push to cut red tape. The Council's position is the starting point for negotiations with the European Parliament.
Cookies and tracking
According to the Council, the ePrivacy Directive stays as the framework for cookies and similar technologies. The mandate clarifies and expands the cases where consent is not required, including cookies used to:
- supply a service the user asked for,
- measure audiences, and
- protect the user's device.
The Council says this could reduce the number of consent banners people see.
GDPR changes
| Area | Council position |
|---|---|
| Definition of personal data | Kept as it is |
| Pseudonymization | A new provision to clarify when a person counts as identifiable |
| Data subject requests | Simplifications for "manifestly unfounded or excessive requests" |
| Information duties | Simplified in certain low-risk situations |
| Breach notification | Supports a longer deadline (the exact period is not given in the release) |
| High-risk processing | A single EU-level list of high-risk processing categories and common templates |
| Scientific research | A principles-based definition and targeted exemptions |
| Sensitive data and AI | Safeguards added to a proposed exception for biometric verification and AI development |
Incident reporting
The Commission had proposed a single EU-wide entry point for reporting cyber and data incidents. The Council instead favors "a national entry point in each member state", plus an EU-level information point.
What happens next
Ireland, which holds the Council presidency, can start talks with the Parliament once the Parliament agrees its own position. Thomas Byrne, Ireland's Minister of State, said: "The Council is ready to engage in negotiations with the European Parliament as soon as it has established its position." The Council says the EU aims to complete its simplification packages by the end of 2027.
Who this affects
- Any website with EU visitors or customers. The GDPR can apply to businesses outside the EU that offer goods or services to people in the EU, so US, Canadian and Australian sites selling into Europe should follow this too.
- Marketing and analytics teams, since audience measurement is one of the proposed consent exemptions.
- UK businesses. The UK is outside the EU and has its own rules. It has already made changes through the Data (Use and Access) Act 2025, covered in our post on UK cookie consent changes. UK firms that sell into the EU must follow both regimes.
- Small firms handling data requests, who may benefit from clearer rules on excessive requests.
What to do now
Nothing in the Council's mandate is in force, and the final text could look different after negotiations. A sensible approach:
- Keep your current consent banner. Do not drop consent for analytics or anything else on the strength of a negotiating position.
- Audit what your site sets. List every cookie and tag, what it does and who it shares data with. You will need this whatever the final rules say. Our guide to secure cookie flags also helps tidy up how cookies are set.
- Separate measurement from advertising. The Council's list of exemptions covers audience measurement, not advertising. Configuring analytics separately from ad tags now makes a future change easier.
- Review breach readiness. Know who decides whether a breach is reportable and how quickly you can act, under today's deadlines. Basic security hygiene matters: check your site with our free SSL checker and security headers checker.
- Watch for the Parliament's position. That is the next milestone, and the point where the likely final shape becomes clearer.
For UK businesses, our post on ICO cookie enforcement explains what the UK regulator is currently checking. If keeping track of cookie and tag changes across several sites is a recurring headache, Make It Flow can help you automate the audit; get in touch.
FAQ
What is the EU Digital Omnibus?
It is a European Commission proposal to simplify several EU digital laws, including the GDPR, the ePrivacy cookie rules and cyber incident reporting. On October 21, 2026 the Council of the EU agreed its negotiating position. The European Parliament must also agree its position before a final law can be negotiated.
Will cookie banners disappear in the EU?
Not entirely, and not yet. The Council wants more cases where consent is not needed, such as cookies that supply a requested service, measure audiences or protect a device. Advertising and profiling are not among the exemptions the Council lists. Current rules apply until a final law takes effect.
Do the changes apply to US or UK businesses?
The GDPR can apply to businesses outside the EU that offer goods or services to people in the EU or monitor their behavior. So any final changes would matter to those businesses for their EU customers. The UK has separate rules, updated by the Data (Use and Access) Act 2025.
Has the GDPR breach notification deadline changed?
No. The Council supports a longer deadline, but its press release does not give the new period, and nothing has been agreed with the European Parliament. Until a final law is adopted and in force, the existing GDPR deadline still applies.
When will the Digital Omnibus become law?
There is no fixed date. The Parliament must first adopt its position, then negotiate a final text with the Council. The Council says the EU aims to complete its simplification packages by the end of 2027. Changes would then need to take effect, possibly with transition periods.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
