Explainer
Nothing in this proposal creates new obligations yet. GDPR and ePrivacy rules remain in force while negotiations continue.
In 60 seconds
- The European Commission published its Digital Omnibus proposals on November 19, 2025.
- For cookies it proposed a single-click reject, a six-month pause before re-asking for consent, respect for browser and operating-system signals, and moving the rules into GDPR (Article 88a).
- The AI Omnibus was adopted by the Council on June 29, 2026; the Data Omnibus is still under negotiation.
- The Council's June 2026 working text removed the cookie-consent provisions. Today's rules apply.
Impact Layer
- What changed
- The Commission proposed changes to cookie consent in its Digital Omnibus; by mid-2026 the Council's working text had removed those provisions while the wider data package stayed in negotiation.
- Why it matters
- Marketers should not redesign consent flows around a proposal that is not law and may change, but they should expect pressure toward simpler consent and browser-level signals.
- Who is affected
- Marketing, analytics and legal teams that serve users in the EU, and consent-management and tag-management vendors.
- Martech stack area
- Analytics, Advertising, Data
- Stack impact
- No change required today. Keep consent records accurate and be ready to support a visible reject option and browser signals.
- Business impact
- Low No new legal obligation exists from this proposal. Seek legal advice for your own situation.
- Related technologies
- What to watch
- Final text of the Data Omnibus, whether cookie provisions return, and any national guidance on consent banners.
This is an explainer, not legal advice. Its aim is to separate what has been proposed from what is law. Today’s cookie and consent rules, which come from GDPR and the ePrivacy Directive, remain in force.
What the Commission proposed
On November 19, 2025, the European Commission published its Digital Omnibus proposals. For cookies and similar technologies they would:
- require a single-click option to reject;
- stop sites from asking again for six months after a person refuses;
- make sites respect preference signals from browsers and operating systems; and
- move the cookie rules into the GDPR, as a new Article 88a.
Where it stands
- The Council adopted the AI Omnibus on June 29, 2026.
- The Data Omnibus, which would carry the cookie rules, was still being negotiated in mid-2026.
- The Council’s June 2026 working text removed the cookie-consent provisions.
So the cookie changes are not part of the Council’s current text. They could still return in negotiations, but there is no new obligation to comply with today.
Editorial guidance
This is our view of sensible preparation, not a requirement.
- Do not rebuild your consent banner around the proposal. It may change.
- Check that a visitor can refuse as easily as they can accept; many regulators already expect this.
- Keep accurate records of when and how consent was given, so you can respond to any new rule quickly.
- Ask your consent and tag-management vendors how they would support browser-level signals.
- Take legal advice for your own markets. The Usercentrics explainer we cite is from a company that sells consent software, so it has a commercial interest.
Sources
- PPC Land: Cookie consent in Europe is changing: what marketers need to know (opens in a new tab)
Summary of the Commission proposal.
- Usercentrics: EU Digital Omnibus package (opens in a new tab)
Vendor explainer; Usercentrics sells consent-management software.