Digital Omnibus and cookies: status October 2026

The short answer

Nothing has changed yet. The Digital Omnibus is a proposal, and the cookie rules in force are the same as last year: Article 5(3) of the ePrivacy Directive and the national laws that implement it, such as § 25 TDDDG in Germany. If your site needs consent for analytics or advertising today, it still does.

What has changed is the direction. The Commission proposed in November 2025 to move consent for cookies that touch personal data into a new Article 88a of the GDPR. In the Council texts of spring 2026 that Article 88a is gone, and the rules stay in Article 5(3) of the ePrivacy Directive in revised form. Two ideas survived both versions: a refusal with one click, and no asking again for six months after a refusal. Many articles still describe the Commission text as if it were the final word. It is not.

What the Commission proposed in November 2025

The Commission published the Digital Omnibus on 19 November 2025. The part on data protection and privacy is proposal COM(2025) 837. For cookies it proposed a split.

Personal data under the GDPR. Storing or reading information on a device that involves personal data would be governed by a new Article 88a GDPR. Article 5(3) of the ePrivacy Directive would only cover the rest.
New consent exemptions. Article 88a would allow device access without consent for transmitting a communication, for a service the user explicitly requested, for aggregated audience measurement carried out by the site for its own use, and for maintaining or restoring security.
One click to refuse. Article 88a(4)(a) would require that refusal is possible with a single-click button or equivalent means.
Six months of quiet. Under Article 88a(4)(c), a site could not ask again for the same purpose for at least six months after a refusal.
Browser signals. A new Article 88b would require sites to respect automated, machine-readable consent and refusal signals, and would oblige browser providers that are not SMEs to offer them.

What the Council changed in 2026

Council negotiations are not public in full, so this section relies on documents registered by national parliaments and on reporting by people who have read the compromise texts.

The Cypriot Presidency circulated several compromise texts in the first half of 2026, the most recent reported one on 21 May (Council document 9547/26). According to an analysis by Mikołaj Barczentewicz published on 11 June 2026, that text changes the cookie part in five ways.

Article 88a is gone. Device access stays governed by Article 5(3) of the ePrivacy Directive, in revised form. Years of guidance on Article 5(3), including the EDPB Guidelines 2/2023 that cover tracking pixels and URL parameters, remain the starting point.
Audience measurement by a processor. The analytics exemption also covers measurement carried out by a third party on the site's behalf, but only if the data stays anonymous and aggregated and is neither combined with other data nor shared.
One-click refusal and six months. Both remain, together with a 24-month transition period.
Browser signals. The signal provision is renumbered as Article 88a and now covers operating system providers as well as browsers.
Enforcement. National data protection authorities would enforce the ePrivacy cookie rules.

A Council document dated 21 June 2026 and titled as a mandate for negotiations with the European Parliament is registered as 10729/26. Even so, the Irish Presidency, which took over on 1 July, circulated new compromise wording on cookies on 3 September 2026. As reported by Agence Europe, it broadens the cases in which cookies can be used without consent, notably for contextual advertising, with safeguards that exclude tracking and data retention, and requires that audience measurement data is pseudonymised immediately after collection and anonymised before it is shared. Our reading: the cookie rules are not settled inside the Council either.

	Commission, November 2025	Council texts, 2026
Where the rules live	New Art. 88a GDPR for personal data, Art. 5(3) ePrivacy for the rest	Art. 5(3) ePrivacy, revised
Analytics without consent	Aggregated measurement by the site for its own use	Also by a processor, if anonymous, aggregated, not combined, not shared
Contextual advertising	Not exempt	Dropped in May, back in the Irish text of September with safeguards
Refuse with one click	Yes	Yes
No re-ask for six months	Yes	Yes
Browser signals	Art. 88b, browsers	Renumbered Art. 88a, browsers and operating systems
Transition	Not reported	24 months

Based on the sources listed below. Council texts are compromise drafts and can still change.

Timeline and what comes next

19 November 2025: Commission proposal.
February 2026: joint opinion of the EDPB and the EDPS on the proposal.
21 May 2026: Cypriot Presidency compromise, Council document 9547/26.
21 June 2026: Council document 10729/26, mandate for negotiations, for Coreper on 26 June.
3 September 2026: Irish Presidency compromise wording on cookies, discussed in a Council working party on 11 September.
Parliament: the ITRE and LIBE committees work on draft reports, with Aurora Salla and Marina Kaljurand as rapporteurs.

The stated aim is a deal between Council and Parliament by the end of 2026. Observers expect adoption to slip into 2027. If the 24-month transition from the Council texts survives, the new cookie rules would apply roughly two years after the regulation enters into force. Realistically, the rules you comply with today will apply until at least 2028.

Will cookie banners disappear?

No. That is the conclusion of most legal analyses of the proposal, and the Council texts do not change it. Consent for advertising, cross-site tracking and most third-party tools stays. Information duties and the right to withdraw consent still need a visible place on the page. What may change is the size of the banner's job.

Simple analytics may no longer need consent. If you only measure audiences in aggregate, a final exemption could take that out of the banner. Until it is law, it does not.
The banner gets stricter where it stays. A one-click refusal and a six-month pause become written law instead of regulator guidance. France's CNIL already enforces refusal on the first layer, see our post on Reject all on the first layer.
Browser signals are the long-term change. If browsers and operating systems have to send consent signals that sites must respect, many banners would be answered before they appear. The technical standards for that do not exist yet.

What to do now

Keep consent for analytics. Do not remove your banner for analytics on the strength of the proposed exemption. It is not law, and its conditions differ between versions.
Offer refusal on the first layer. Every version of the reform requires it, and regulators already expect it.
Respect a refusal for six months. The CNIL already recommends this. CookieCrumbs stores the refusal and does not show the banner again for a period you set, six months by default, unless your purposes change.
Keep proof of consent. Article 7(1) GDPR is untouched by the Omnibus. Our post on proof of consent covers what a record should contain.
Check what loads before consent. In Germany, the Federal Court of Justice hears a case on 8 October 2026 about whether tracking vendors are liable themselves when their code sets cookies without consent. The free scan lists the third-party requests on your homepage.

FAQ

Is the Digital Omnibus law yet?

No. As of 5 October 2026 the part on data protection and cookies is still being negotiated in the Council and the European Parliament. Adoption is expected in 2027 at the earliest.

Was Article 88a GDPR deleted?

In the Council compromise texts of 2026, the Commission's Article 88a on device access was deleted and the cookie rules stay in Article 5(3) of the ePrivacy Directive. The number 88a was reused for the provision on browser signals. The Parliament's position is not yet final.

Will I still need a cookie banner?

Yes, for anything that is not strictly necessary, such as advertising, cross-site tracking and most third-party tools. Aggregated analytics may become exempt under conditions that are still being negotiated.

When would the new rules apply?

The Council texts include a 24-month transition period. Counting from adoption in 2027, the new cookie rules would apply around 2029. Until then the current rules apply.

Does the six-month rule mean I cannot show my banner again?

After a refusal you could not ask again for the same purpose for six months. You can still show a link or icon that lets visitors change their choice at any time, which the GDPR requires anyway.

Does the Omnibus change anything for the UK?

No. The UK has its own rules under PECR, changed by the Data (Use and Access) Act 2025. See our post on UK cookie rules after 5 February 2026.

Sources

Written by the CookieCrumbs team, published 5 October 2026. This is a living post; we update it when the Council or Parliament moves. Facts carry their dates; if one has moved on, tell us and we will correct it. This is not legal advice.

keep reading

See what loads on your site before consent

The free scan reads your homepage and lists the third-party requests. No account, nothing stored.

Run a free scan Start free

Digital Omnibus and cookies: where the EU cookie reform stands in October 2026