The EU ePrivacy Regulation will not happen. The European Commission announced on 11 February 2025 that it would withdraw the proposal, citing "no foreseeable agreement", and formally withdrew it on 6 October 2025, eight years after proposing it. Cookie consent in the EU is still governed by the 2002 ePrivacy Directive as each country transposed it. The Commission's Digital Omnibus proposal of November 2025 would move the cookie rule into the GDPR, but as of October 2026 it is still a proposal.
Eight years of stalled negotiations
The European Commission first proposed the ePrivacy Regulation on 10 January 2017 as a replacement for the ePrivacy Directive (Directive 2002/58/EC). The goal was to turn the Directive into a directly applicable Regulation that would sit alongside the GDPR and harmonise rules on electronic communications privacy, cookies, and direct marketing across all EU member states.
That upgrade never happened. The European Parliament adopted its negotiating mandate in October 2017, but the Council of the EU struggled to reach a common position, cycling through multiple presidency drafts in the years that followed. Member states disagreed on fundamental points - the scope of cookie consent exemptions, the treatment of metadata, and whether cookie walls should be permitted.
On 11 February 2025, the Commission's 2025 work programme listed the ePrivacy Regulation among the proposals it intended to withdraw, citing "no foreseeable agreement". The withdrawal took effect on 6 October 2025, according to the Legislative Observatory file 2017/0003(COD), which now records the procedure as withdrawn.
From the ePrivacy Regulation to the Digital Omnibus
Why the proposal failed
Three issues proved impossible to resolve.
First, the advertising industry and several member states pushed hard for broader consent exemptions. They argued that requiring opt-in consent for all non-essential cookies - the position of the European Parliament - would cripple digital advertising and harm media publishers who rely on programmatic revenue. The programmatic advertising ecosystem lobbied intensively against strict consent requirements.
Second, the metadata provisions split opinion. The original proposal treated communications metadata (location data, connection timestamps, device identifiers) with protections approaching those for content data. Telecom operators and law enforcement agencies resisted this, wanting broader access for security and investigative purposes.
Third, the cookie wall question remained unresolved. Could a publisher refuse access to users who declined tracking cookies, provided a reasonable alternative existed? The Parliament said no. Several Council drafts said yes, under conditions. No compromise held.
What stays in force: the ePrivacy Directive
With the Regulation withdrawn, the 2002 ePrivacy Directive (as amended in 2009) remains the governing law for cookie consent in the EU. Article 5(3) of the Directive still requires prior informed consent before storing or accessing information on a user's device, unless that storage is strictly necessary to transmit a communication or to provide a service the user has requested.
Each member state has transposed this Directive into national law differently, which leaves the fragmented picture the Regulation was meant to fix. French law (Article 82 of the Loi Informatique et Libertés, enforced by the CNIL) imposes specific requirements around consent mechanisms that differ in detail from Germany's TDDDG or Ireland's SI 336/2011.
For website owners, this means the practical rules depend on where your visitors are located, not just where your business is based. The guide to the Directive explains Article 5(3), its exemptions and how it is enforced.
The Digital Omnibus would move cookie rules into the GDPR
Rather than revive a standalone ePrivacy Regulation, the Commission took a different route. On 19 November 2025, it proposed the Digital Omnibus (COM(2025) 837), a package that would, among other things, fold the rule on storing and reading information on devices into the GDPR through a new Article 88a.
The European Parliament's summary of the proposal says it aims to reduce how often cookie banners appear and to let people give or refuse consent with one click and save their preferences centrally in their browser. As published, the proposed Article 88a would require a one-click refusal and respect for a refusal for at least six months, with exemptions for strictly necessary storage and some first-party audience measurement, and a proposed Article 88b would cover automated browser and device signals. The detail of both articles is in the guide to the Digital Omnibus and the GDPR changes.
Where the Digital Omnibus stands in October 2026
The Digital Omnibus is a Commission proposal, not law. It must be agreed by both the European Parliament and the Council of the EU before it can apply. As of October 2026, it is at committee stage in Parliament: the lead committees published a draft report on 22 June 2026 and amendments were tabled in July 2026, with no committee vote yet, according to the Legislative Observatory file 2025/0360(COD). On the Council side, a compromise text dated 18 June 2026 dropped the proposed Article 88b on browser signals.
Amendments are likely. The analytics exemption, the six-month rule and the browser-signal mechanism will all face scrutiny from industry groups, privacy advocates and member states. The EDPB and EDPS have already published a joint opinion supporting the simplification goals while raising concerns about weakening consent protections.
What you should do now
The current rules - the ePrivacy Directive as transposed nationally, enforced alongside the GDPR - remain the law until an Omnibus text is adopted and applies.
Practical steps worth taking now:
- Give accept and reject options equal prominence on your cookie banner: several DPAs already enforce this
- Audit your analytics setup to understand whether your tracking could qualify for a future first-party exemption
- Check whether your consent tool can detect browser-level opt-out signals such as Global Privacy Control
- Keep records of the consent choices visitors make, because enforcement continues regardless of legislative uncertainty
Questions about the ePrivacy Regulation
Is the ePrivacy Regulation still happening?
No. The European Commission announced the withdrawal of the ePrivacy Regulation proposal in February 2025 and formally withdrew it on 6 October 2025, after eight years without agreement. The existing ePrivacy Directive remains in force. Cookie rules may instead be moved into the GDPR through the Digital Omnibus proposal.
What law currently governs cookie consent in the EU?
Article 5(3) of the ePrivacy Directive (2002/58/EC, amended 2009) requires prior consent before placing non-essential cookies on a user's device. Each EU member state has transposed this Directive into national law, which is why specific requirements vary by country.
Why was the ePrivacy Regulation withdrawn?
The Commission cited no foreseeable agreement between the European Parliament and the Council. Member states could not agree on consent exemptions for advertising, the treatment of communications metadata, or whether cookie walls should be allowed.
Will analytics cookies become exempt from consent under the Digital Omnibus?
The Digital Omnibus proposes a narrow exemption for first-party audience measurement that produces aggregated statistics for the service provider only. Standard third-party analytics tools that send data to external companies would likely still require consent, and the proposal may still change.
When will the Digital Omnibus become law?
No date is set. The Commission proposed it in November 2025, and as of October 2026 the European Parliament's committees had published a draft report but not voted. It must still be agreed by the Parliament and the Council, and then apply, before cookie rules change.
Keep your banner right under today's rules
Whether cookie rules stay in the ePrivacy Directive or move into the GDPR, you need to know what cookies your site sets and give visitors a real choice. Kukie.io finds and sorts the cookies on your site, shows a banner with an equal "Reject all" and keeps a record of each choice.
