EU countries have failed to agree a common position on the "Digital Omnibus". The vote did not take place. Ambassadors of the member states were due to discuss it on 11 October 2026, but the text was not debated and no new date has been set. The rules on cookies and personal data stay the same for now.
The "Digital Omnibus" is a European Commission package from 19 November 2025 that changes several laws at once, among them the General Data Protection Regulation (GDPR) and the ePrivacy Directive. The Council document runs to 163 pages and is dated 2 October 2026.
Cookies in the proposal and in the Council text
A cookie is a small file that a website saves on a device to recognise a visitor or track what they do. For most cookies, a site must ask for consent, and that consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes are not valid. That is why a banner appears when you open a site.
The Commission wants refusing to be as easy as agreeing, and wants sites not to ask the same question again for the next six months. Its proposal also says people should be able to set their preferences once in the browser or on the device, and sites would have to respect them. This is Article 88b.
The Council rejected the idea of a browser signal. According to the data protection group noyb, Germany, France and Poland pushed for this, citing fears for media advertising revenue. Google has warned governments that such a system would wreck advertising income in the EU, but the Commission and privacy advocates dispute this. The banners stay.
The Council text from October 2026 cuts the wait before a site can ask again for the same purpose after a refusal from six months to four. A site can ask sooner if the purpose is new, if the service has changed substantially, or if the refusal has been lost, for example when cookies are deleted.
The Council also adds a new case where consent is not needed: measuring the effect of contextual advertising, meaning ads based on the content of the page rather than the visitor's profile. The data must be pseudonymised and activity must not be tracked across sites. Consent would not be required for six purposes, including measuring a site's own audience and security.
Sources differ on where the rules will sit. Earlier market analyses say the Council keeps Article 88a, which moves cookies into the GDPR, while a newer review of the October text shows they stay in the old directive, in Article 5(3). Neither version is final.
Personal data and trade secrets
The most disputed change to the GDPR is the definition of personal data. Under the Commission's plan, information counts as personal only if whoever holds it can identify the person with means they reasonably have. The Council keeps this change. The European Data Protection Board and the European Data Protection Supervisor urge that it not be adopted. The Dutch data protection authority is also against it.
The package also covers legitimate interest as a basis for training artificial intelligence, with a right to object, and reporting a data breach only when the risk is high, within 96 hours instead of the current 72. The Board and the Supervisor welcome the higher threshold, while the Dutch authority wants to keep the current one.
The vote is held up by another dispute. On 7 October, Germany and France called for a delay because they think the Data Act's rules on trade secrets are not strong enough. Berlin wants data protected by trade secrets to be shared only under an "explicit agreement". The Irish presidency proposes that the data holder could refuse if it shows a "significant risk" of unlawful use. Germany also wants a "low-risk controllers" category, under which micro and small businesses would be exempt from many GDPR duties.
Talks and deadlines to the end of 2026
Without a Council mandate and a European Parliament position, three-way talks cannot start. Parliament has not yet adopted a position on Article 88b either.
If the text is adopted in its current form, the changes to the cookie rules would apply six months after publication, and countries would have 24 months to put them in place.
The European Council has asked for agreement on all outstanding "omnibus" packages by the end of 2026. The Irish presidency may hold new consultations with delegations.