EU Council Agrees Its Digital Omnibus Position: GDPR Stays, Cookie Banner Overhaul Dropped

EU member state ambassadors approved the Council's negotiating position on the data-protection half of the Digital Omnibus on Wednesday 21 October. The most talked-about item in that package was a plan to make most cookie banners disappear from European websites. The Council deleted it.

The decision, set out in a Council press release published that evening and updated the next day with the mandate text, clears the way for negotiations with the European Parliament. Those talks cannot start until MEPs agree their own position, which they have not done.

For teams that build and run websites and apps for European users, the practical message is narrow but genuinely useful: nothing changes yet, the cookie banner stays, and the parts of the reform most likely to reach production code are the unglamorous ones — breach notification, incident reporting, and how personal data may be used to train AI models.

What the Digital Omnibus actually is

The Commission tabled the package on 19 November 2025 as COM(2025) 837, part of a simplification push it calls Omnibus VII. It is not one law but a bundle of amendments to laws that already exist: the GDPR, the ePrivacy Directive that governs cookies, the data-sharing rules built on the Data Act, and the regulation on platform-to-business relations, parts of which would be repealed.

It also creates a single route for reporting cybersecurity and data incidents, an idea that sounds technical and matters enormously in practice, because a mid-sized company can currently owe the same incident report to a data protection authority, a cyber agency and a sector regulator in three different formats.

The package was split in two. The AI-related half was adopted on 29 June 2026 as Regulation (EU) 2026/1744 and is already law. The half covering data protection, privacy and incident reporting is the one member states have now taken a position on.

The cookie plan that did not survive

The Commission's headline idea was elegant. Instead of every site asking every visitor for consent, users would set their preferences once in their browser, which would automatically transmit a privacy signal. Sites that respected the signal would not need to show a banner at all. Digital rights groups welcomed it as the only part of the package that offered real relief to ordinary users.

The Council's final compromise text removed that mechanism entirely. According to reporting by Rapporteur, some member states objected that no proper impact assessment had been carried out, and MEPs have asked the Parliament's own research service, EPRS, to produce one. That assessment is expected in the coming weeks.

What survives is a different approach: a longer list of cases where consent is not required at all, written into the ePrivacy Directive rather than moved into the GDPR. The Council's mandate names cookies that are necessary to provide a service, cookies used for audience measurement, and cookies needed to keep a user's device secure. It also proposes an exemption for cookies that measure the performance of context-based advertising.

That is a real reduction in consent requests for analytics and security tooling. It is not the end of the banner, and any consent management platform built around the assumption that browser signals are coming should be reconsidered rather than rewritten.

The GDPR definition of personal data stays where it is

The Commission had proposed changing Article 4(1) so that data would not automatically count as personal simply because it could, in principle, be used to identify someone. Member states pushed back from February onwards, supported by a joint opinion from the European Data Protection Board and the European Data Protection Supervisor, which argued the change would narrow a concept the EU Court of Justice has spent years clarifying.

The Council kept the current definition and added a new provision on pseudonymisation instead. In plain terms: pseudonymised data remains personal data, and the compliance work attached to it does not go away. Systems that lean on hashed identifiers, internal user keys or "anonymised" behavioural logs should be reviewed on the assumption that the stricter reading holds.

Where the Council did move on GDPR

Several changes the Council does support will land in engineering and legal workstreams rather than in user interfaces.

The mandate backs a longer deadline for notifying personal data breaches, a change the Commission proposed after years of complaints that 72 hours is unworkable when an incident is still being contained. It also supports a single EU-level list of processing operations considered high risk, which would replace the current patchwork of national lists, and common templates for the documentation organisations have to produce.

It introduces a principle-based definition of scientific research with targeted exemptions, so research organisations can process data under a simpler framework. It adds safeguards to the proposed derogation that would let organisations process sensitive data for biometric verification and in the development and operation of AI systems. And it asks for clarification of the lawful ground for processing personal data in AI development, with safeguards attached.

AI training data: clarity, but not the clarity everyone wanted

That last point is the one most product teams will care about, and it is also the easiest to misread. The Council text is not a general licence to train models on whatever data you hold. It is a set of safeguards around a narrow derogation for special categories of data, plus a request for clearer wording on lawful grounds.

Whether commercial model training can rest on legitimate interest, and how far the research exemption reaches into commercial products, are questions the final text will settle. The mandate moves in a direction that AI developers will find helpful and privacy regulators will watch closely. It does not settle them yet, and any internal policy written today should say so.

Worth separating from this file: the AI Act itself is already being amended by the regulation adopted in June, and the Commission's AI Office has begun enforcing against providers of general-purpose models. Those changes are live in a way the data package is not.

Incident reporting: national doors instead of one European one

The Commission wanted a single EU entry point where a company could file one incident report and have it shared with every authority that needed it. The Council replaced that with a national entry point in each member state, plus an EU-level information point and provisions aimed at a harmonised notification framework and cross-border notifications.

The ambition of "report once, share many" survives in principle. The single portal does not. For a company operating in five countries, the immediate read is that incident response runbooks should still assume more than one regulator, even if the forms eventually converge.

Data sharing and the trade secrets fight

The mandate consolidates the rules on data altruism and data intermediation services, which few organisations use and even fewer understand. More consequentially, it would let public sector bodies set different conditions and charge higher fees when very large enterprises, and especially companies designated as gatekeepers, reuse public sector data.

It also answers a concern that has stalled this file twice. Trade secrets would have to be disclosed only once the data holder and the user have taken all necessary measures to preserve confidentiality. That clause, aimed at protecting industrial know-how in critical sectors, was the compromise that finally unlocked agreement after earlier attempts failed, with Germany and France among the holdouts.

What happens next, and when it could matter

The Council presidency can now negotiate, but only once Parliament adopts its position. The co-rapporteurs, Aura Salla of the EPP for the industry committee and Marina Kaljurand of the Socialists for civil liberties, published a draft report in June 2026; the joint committee vote has not yet taken place, and the EPRS impact assessment is still to come.

Only after that do trilogues begin, followed by formal adoption and an application period. No application date exists yet, and anyone who tells you otherwise is guessing. A realistic estimate for obligations reaching production systems is 2027 at the earliest, and 2028 is not pessimistic.

For Norwegian organisations there is a second step. The GDPR applies in Norway through the EEA Agreement rather than through EU membership, so a regulation amending it has to be incorporated into the EEA Agreement before it binds Norwegian companies. That process usually follows, but it adds time.

What to do this quarter

Keep the consent banner. Review whether your cookie inventory is organised by purpose, because every exemption in the Council text is purpose-based, and a list of cookie names without stated purposes cannot be mapped to any of them.

Document the breach process you actually follow, including who decides whether to notify. A longer deadline helps; it does not remove the obligation or the need to reconstruct what happened.

Write down what you send to processors and AI vendors, and on what legal basis. This is precisely the area where the text is still moving, and the organisations that will adapt fastest are the ones that already know their own data flows.

Finally, watch Parliament rather than the Council. The EPRS assessment and the committee vote are the next real signals, and Parliament has been more sceptical of the simplification agenda than member states have.

The pattern worth noticing

Strip away the headlines and the Council did something consistent. It removed the consumer-facing simplification and kept the compliance-facing ones. Websites will still ask visitors for consent in most cases, but companies may get more time to report a breach, one EU-wide risk list instead of 27, and a clearer path for using data in AI work.

That is a genuine reduction in administrative friction. It is also much narrower than "Brussels simplifies the digital rulebook" suggests, and the gap between the two is where most of the practical work for development teams will sit over the next two years.