Digital Omnibus and cookies: what’s coming

Eleven months after it was unveiled, the “data and privacy” part of the Digital Omnibus is still under discussion. We sort out what already applies, what has broad agreement and what is still open.

Status update as of 5 November 2026. This article will be updated.

1. Nothing changes for now. Current cookie rules still apply, and the CNIL is still issuing fines.
2. Member States have set their position, Parliament has not. The Council adopted its negotiating mandate on 21 October. The European Parliament will not vote on its position before early 2027.
3. The end of cookie banners is off the table. The text would have let users set their choice once and for all in their browser, but this option was dropped during negotiations, at least for now.
4. The most likely change: a refusal will hold for several months. After a “no”, a site could not ask again for four months under the Council mandate, versus six in the Commission proposal (Parliament has not yet decided). The first time the banner is shown would therefore become decisive.
5. An opening: measuring without asking for user consent. This would be possible for measuring traffic on your own site, and possibly for the performance of contextual ads.
6. What you can do right now: separate your data flows. On one side, data used for measurement; on the other, data used for targeting or for feeding Google and Meta. This work pays off whatever the final version of the text.

On 19 November 2025, the European Commission unveiled the Digital Omnibus, a (big) legislative package. In the marketing press, one headline took hold within hours: the end of cookie banners.

Eleven months later, the banner is still here and the text has changed shape three times. Successive compromises from the Presidency of the Council of the European Union have removed browser-based consent signals, cut the waiting period before a refused consent can be requested again from six to four months, and added two exemptions. The vote, initially scheduled for 7 October, was postponed twice before Member States finally set their negotiating position on 21 October. That position will now be debated in Parliament, with a vote not expected before early 2027. Advertisers are left with their question: what can they adjust in their data collection right now?

Digital Omnibus: where does the text stand in October 2026?

The “data and privacy” part (procedure 2025/0360(COD)) follows the usual path of EU legislation: Commission proposal, Council position, Parliament position, then negotiation of a joint text in trilogue. The European Council is aiming for agreement on all the Omnibus texts by the end of 2026. Here is where things stand: browser consent signals disappeared with the June compromise, and cookies moved back into the ePrivacy Directive with the September one. Based on the Council mandate published on 22 October (doc. 14756/26), the gap between the initial proposal and the Member States’ position looks like this:

What advertisers already apply

Several measures presented as new in the Omnibus are already in force in France. Article 82 of the French Data Protection Act (loi Informatique et Libertés) requires prior consent for any tracker not covered by an exemption. The CNIL requires refusing to be as easy as accepting, and consent to be withdrawable at any time.

Audience measurement without consent also exists already. The CNIL allows it when five conditions are met: a purpose limited to measuring the site’s audience, exclusively on behalf of the publisher; anonymous statistics; no cross-referencing with other processing; no tracking across sites or apps; no reuse of the data by the tool provider.

This is the regime used as the benchmark for audits. In 2025, 21 of the 83 penalties issued by the CNIL concerned cookies and other trackers, for three recurring reasons: trackers set without consent, information too incomplete for consent to be valid, and refusal or withdrawal not respected. The fact that an exemption is under discussion in Brussels provides no legal basis today for changing practices. Nor do architecture choices. Moving to server-side, collecting on your own domain or doing without third-party cookies improves data quality and control over collection, but does not change the applicable regime, which depends on the purpose of the processing and its recipients.

One-click refusal, waiting period: the changes found in every version

Some provisions appear in the Commission proposal and in every compromise since. They therefore stand a good chance of making it into the final text, even if their parameters may still shift.

One-click refusal is already the rule for French sites. For an advertiser active in several markets, with banners configured country by country, a common EU rule would simplify setup.

The waiting period before asking again would have more visible effects. The CNIL already asks sites to record a refusal so users are not prompted on every visit, without setting a duration in law. The EU text would add a minimum. The Council mandate spells out the exceptions: a site may ask for consent again sooner if the purpose changes (new service, substantial change to the service), or if the cookie recording the refusal is no longer valid for reasons beyond the site’s control, typically because the user has deleted their cookies. So be careful: a refusal is not set in stone for four months. Alliance Digitale (the French professional association for digital marketing and data) is calling for this rule to be dropped, and it is still under discussion.

Take an e-retailer that shows its banner again at every session after a refusal, counting on some visitors eventually accepting. With a four-month waiting period, a visitor who refuses in October stays outside the consented scope until February. The consent rate achieved the first time the banner is shown then weighs much more heavily on the volume of data available.

The audience measurement exemption would finally take an EU-wide form, reducing differences in interpretation between national authorities for aggregated measurement.

Browser signals, contextual advertising, pseudonymisation: issues still ope

Three issues remain open that could significantly affect the volume of data that can be collected.

On browser signals, the Council mandate buries the mechanism. Nineteen organisations, including the EDPB, called for its reinstatement in September, without success. Parliament can still put it back in, and it will be one of the sticking points in the trilogues.

On the definition of personal data, the Council keeps the Commission’s key sentence: information is not personal for an entity that cannot identify the person. The Council also adds an article: pseudonymised data would not be personal for a third party unable to re-identify the person, but would remain so for a processor. In practice, a measurement provider or a clean room cannot rely on this text to requalify the data it processes. The EDPB still disputes this reasoning, and nothing is final.

Measurement, attribution, activation: three uses every version keeps apart

Between the Commission proposal and the latest compromise, many provisions have shifted. One distinction, however, has held steady: no version puts audience measurement, individual attribution and advertising activation under the same exemption.

Yet in many setups, these three uses start from the same point. A retailer fires a tag when an order is placed: the event feeds its analytics tool, goes to Meta via the Conversions API and is used to match the order to the customer profile in the CRM. As long as these flows stay linked, the measurement part falls under the regime of the most demanding use.

Separating flows by purpose remains useful whatever the outcome of the negotiations. If the measurement exemption is confirmed, the measurement flow will be ready to benefit from it. If the text changes again, mapping your purposes will help demonstrate compliance with the current regime.

What’s next?

Now that the Council has set its position, the ball is in Parliament’s court: an opinion from the Legal Affairs Committee (JURI) on 4–5 November, then a committee vote in early 2027. Trilogues can only start after that.

The surprise in the Council mandate is the application date: it removes the six-month period the Commission wanted and keeps the cookie rules in the ePrivacy Directive. Each Member State will have 24 months to transpose them. In practice, nothing would change for advertisers in the two years following final adoption. And application would happen country by country, as with the GDPR, adopted in 2016 and applicable from 2018.

To be continued.