In short: Nothing changes for your website at the moment. In Austria, § 165(3) TKG still applies. The EU Commission proposed moving the cookie rules for personal data into the GDPR. According to its mandate of 21 October 2026, the Council keeps them in the ePrivacy Directive, widens the exemptions from consent and deletes browser signals. That does not abolish the banner: the Council text has no exemption for advertising pixels or retargeting either. Parliament has no position yet. As of November 2026.
What has the Council decided on cookies?
The Digital Omnibus is a package the Commission presented on 19 November 2025. The cookie rules are only a small part of it. On 21 October 2026 the Member States' permanent representatives agreed mandate 14756/26. This is the position the Council takes into negotiations with Parliament, and it is not law.
Art 88a and Art 88b, which were to be added to the GDPR, are deleted in full in the mandate. The rules stay in Art 5(3) of the ePrivacy Directive and are rewritten there. Consent for any storing or reading on the device remains the principle, with an exhaustive list of exemptions.
How do the Commission and the Council differ?
Most of all on the legal basis, on browser signals and on timing.
| Point | Commission (November 2025) | Council (October 2026) |
|---|---|---|
| Legal basis | Art 88a GDPR where personal data is involved, otherwise the ePrivacy Directive | Art 5(3) ePrivacy Directive throughout, transposed by Member States |
| Own audience measurement without consent | Aggregated data, by the controller, solely for its own use | Anonymous, aggregated data, also by a third party on the provider's behalf. No other purposes, no sharing, no combining with third-party data. |
| Other exemptions | Transmission, requested service, security | The same, plus audience measurement under Art 24 European Media Freedom Act and measurement of contextual advertising |
| Refusing | One click, no new request for at least 6 months | One click, no new request for at least 4 months |
| Browser signals | Art 88b: websites after 24 months, browsers after 48 months, media exempt | Deleted. Instead, a Commission report on privacy-enhancing technologies within 12 months. |
| Supervision | GDPR authorities, because the rule sits in the GDPR | Member States designate the GDPR authority for Art 5(3) as well |
| Applies from | Art 88a: 6 months after entry into force | 24 months after adoption |
The source for both columns is the mandate, which shows the Commission text as strikethrough next to the Council text.
What would this mean for analytics, advertising and embedded content?
Web analytics. The new exemption fits statistics that are anonymous and aggregated. Recital 44d expressly draws the line at combining them with analytics data from other websites. A service that also uses the data for its own purposes does not fit the wording. The text says nothing about individual products.
Advertising. The display and performance of advertising based only on the content currently shown could be measured without consent, provided no personal data is processed. Recital 44g mentions capping and advertising measurement cookies and rules out profiling and programmatic advertising. Retargeting and cross-site tracking stay subject to consent.
Embedded content. The list has no separate exemption for third-party videos or maps. According to recital 44c, the requested-service exemption covers language settings, shopping baskets and form-filling aids. These are generally free of consent already.
Why does the rejection rule matter so much?
Because it has a measurable effect on the decision. A study by MIT, Aarhus University and University College London shows in a field experiment with 40 participants that removing the opt-out from the first layer raises consent by 22 to 23 percentage points (source: Nouwens et al., “Dark Patterns after the GDPR”, CHI 2020). Research by Ruhr University Bochum and the University of Michigan with more than 80,000 users of a German website also finds that design has a large influence (source: Utz et al., “(Un)informed Consent”, ACM CCS 2019). Both papers are several years old and cover individual markets.
This is why the Commission and the Council both want one-click refusal. The Council text allows a new request within the four months only in exceptional cases, for example if the purpose changes or the user has deleted the cookies (recital 45). In Austria, the Federal Administrative Court already requires that rejecting is possible on equal terms on the first layer.
What should an SME do now?
Do not wait for the Omnibus. Under both texts it will be some time before a new rule applies, and the wording can still change in negotiations. As a rule, three things are enough:
- Check which technology really needs consent. The Cookie Banner Check takes a few minutes and names a banner-free replacement for each technology.
- Put the reject option on the first layer of the banner, if it is not there yet.
- Set up statistics that do not need access to the device, for example server-side. The consent requirement for the device then does not apply, neither today nor under either draft.
If you want to look at cookies in a wider context: the data protection roadmap for SMEs covers the other obligations, and Data Protection & Compliance explains where I can help.
What happens next?
It is now up to Parliament. The ITRE and LIBE committees are jointly responsible, and according to the Legislative Observatory procedure 2025/0360(COD) is still at “Awaiting committee decision”. According to the Council press release, negotiations start once Parliament has adopted its position. The outcome is open. This article will be updated once Parliament's position or an agreement is available.
Frequently asked questions about the Digital Omnibus and cookies
Is the EU abolishing cookie banners?
No, not even under the Council text. Consent stays necessary for anything outside the exemptions, and that usually means a banner. Nothing has been adopted yet in any case. As of November 2026.
Would Google Analytics then be allowed without a banner?
Today it is not: in Austria, Google Analytics needs consent according to the data protection authority. Whether it would fall under the Council text cannot be read from the text. The exemption requires anonymous, aggregated data that is not processed for other purposes, not shared and not combined with third-party data.
When would the new rules apply?
That is not settled. Parliament has no position yet, and negotiations with the Council follow. The Council text gives Member States 24 months from adoption to transpose, while the Commission proposal set six months from entry into force for Art 88a.
Do I have to change my website now?
Not because of the Omnibus. In Austria the yardstick remains § 165(3) TKG. If you already use technology that requires consent, check regardless whether you need it and whether rejecting is possible on equal terms on the first layer.
Sources used: Council of the EU, document 14756/26 of 22 October 2026 (mandate of 21 October 2026, Art 5 and recitals 44 to 46); Council press release of 21 October 2026; Legislative Observatory, procedure 2025/0360(COD), retrieved on 10 November 2026; § 165(3) TKG 2021 in the Austrian legal information system (in German). Scientific sources: Nouwens, Liccardi, Veale, Karger, Kagal, 10.1145/3313831.3376321; Utz, Degeling, Fahl, Schaub, Holz, 10.1145/3319535.3354212. This article was last updated in November 2026.
Note: This article is a practitioner's assessment of an ongoing legislative procedure and does not constitute legal advice for an individual case.