The Digital Omnibus is a European Commission proposal of 19 November 2025 (COM(2025) 837) that would move the EU's cookie consent rule out of the ePrivacy Directive and into the GDPR, through a new Article 88a on consent for device storage and an Article 88b on browser and device signals. It would keep consent as the rule but add exemptions, including first-party audience measurement, require one-click refusal and stop sites asking again for six months after a refusal. As of October 2026 it is a proposal, not law: it is still at committee stage in the European Parliament.
What the Digital Omnibus package proposes
On 19 November 2025, the European Commission published the Digital Omnibus package, a set of proposed amendments to the EU's digital rules. It is a proposal for a regulation, not a directive, and should not be confused with the consumer-law "Omnibus Directive" (EU) 2019/2161. Among its most significant changes is a plan to move cookie consent rules out of the ePrivacy Directive and into the GDPR itself, through two new provisions: Article 88a and Article 88b.
Article 88a would govern when storing information on, or accessing information from, a user's device requires consent. Article 88b would require controllers to respect automated, machine-readable indications of a person's choices, such as browser-level signals.
The Commission described the proliferation of cookie banners and consent fatigue as a problem whose regulatory solution is "long-overdue".
Why cookie rules would move from ePrivacy to the GDPR
Since 2002, cookie consent has been governed by Article 5(3) of the ePrivacy Directive, amended in 2009 to require consent. The ePrivacy Regulation was meant to replace the Directive, but after years of deadlock it was withdrawn on 6 October 2025, and the Commission has taken a different approach.
Under the Omnibus proposal, the GDPR would govern storage of and access to personal data on people's devices, while the ePrivacy Directive would keep covering information that is not personal data. The aim is to reduce the confusion that comes from having two overlapping legal instruments covering the same cookies.
For website owners, this would mean one regulation to follow rather than two where personal data is involved.
Article 88a: the proposed cookie consent framework
Article 88a does not eliminate the need for cookie consent. It keeps consent as the general rule but introduces a closed list of exemptions where storing or accessing information on a user's device would be allowed without prior consent.
The proposed Article 88a test for one cookie
Exemptions that would not require consent
According to the EDPB and EDPS Joint Opinion 2/2026 on the proposal, the proposed exemptions in Article 88a(3) cover four categories:
| Exemption | Description | Example |
|---|---|---|
| Network transmission | Strictly necessary for transmitting a communication over an electronic communications network | Load balancing cookies |
| User-requested service | Strictly necessary to provide a service explicitly requested by the user | Shopping cart cookies, PHPSESSID |
| First-party audience measurement | Creating aggregated audience measurement information, used solely by the service provider for its own online service | Self-hosted analytics pageview counters |
| Security | Maintaining or restoring the security of a service | Anti-fraud tokens, CSRF cookies |
The first-party analytics exemption is new and significant. If adopted as proposed, a website running its own privacy-preserving analytics purely for internal use could skip the consent prompt for those measurement cookies. Third-party analytics services like Google Analytics would still require consent, since the data leaves the site owner's direct control. The EDPB and EDPS have asked for the exemption to be limited to anonymous, aggregated information that is not combined with other data or used for another purpose.
What still requires consent
Everything outside these four categories would still need consent before cookies are set. That includes marketing cookies, cross-site tracking pixels such as the Meta Pixel, third-party analytics, and personalisation cookies.
The proposal does not introduce legitimate interest as a legal basis for cookie storage. The exemptions in Article 88a are specific carve-outs, not a broad permission to process data without consent.
Article 88b: browser-level consent signals
Article 88b is the more forward-looking provision. It would require controllers to respect automated, machine-readable signals of a person's choices sent by browsers or operating systems.
Rather than answering a cookie banner on every website, a user would set their privacy preferences once in their browser, and websites would read those preferences and act on them.
This concept is not entirely new. The Global Privacy Control (GPC) signal already exists and carries legal weight under several US state privacy laws, including the CCPA. In EU law, the Omnibus proposal would set a similar requirement, though the technical standards for how browsers should implement it are not yet defined.
The practical gap
Browser vendors would need to agree on technical standards, build the functionality and ship it to users. That will take time, so Article 88b would apply later than Article 88a, on dates set in the final text. Until browsers widely support standardised consent signals, cookie banners will remain necessary.
The Article 88b mechanism is also the most uncertain part of the package. As of October 2026, a Council compromise text dated 18 June 2026 has dropped the proposed Article 88b, while the European Parliament has not yet adopted a position.
New limits on repeat consent prompts
The Omnibus proposal targets consent fatigue directly. Where a user refuses consent, Article 88a(4)(c) would stop the controller from asking again for the same purpose for at least six months. The proposal also aims to stop repeated requests after consent has been given.
For website owners, this would mean storing and respecting refusal decisions for at least six months rather than showing a banner on every visit. The EDPB and EDPS point out that recording a refusal itself needs some storage on the device, and suggest a specific exception for it.
The proposal also requires a single-click way to refuse. This echoes existing enforcement by the CNIL in France, which has fined companies for making rejection harder than acceptance. The one-click reject principle would become a statutory requirement across the EU if the proposal is adopted.
EDPB and EDPS response
The European Data Protection Board and the European Data Protection Supervisor adopted Joint Opinion 2/2026 on the Digital Omnibus on 10 February 2026. They "strongly welcome" the proposed requirements for machine-readable signals of people's choices and support reducing consent fatigue.
Their concerns include the split between personal and non-personal data. The GDPR only covers personal data, while Article 5(3) of the ePrivacy Directive covers all information stored on a device, so the same operation could need consent under one law but not the other. They also ask for the new exemptions to be clearly limited to what is strictly necessary.
The EDPB and EDPS also raised strong objections to the Omnibus proposal's changes to the definition of personal data, which they argue could significantly narrow data protection rights. These broader concerns, while not directly about cookies, could affect how cookie-related processing is classified.
Timeline and status as of October 2026
The Digital Omnibus follows the ordinary legislative procedure: the European Parliament and the Council of the EU must both agree on a text. In Parliament, the ITRE and LIBE committees are jointly responsible. They published a draft report on 22 June 2026 and amendments were tabled in July 2026, with no committee vote yet, according to the Legislative Observatory file 2025/0360(COD).
| Milestone | Date |
|---|---|
| Commission proposal published | 19 November 2025 |
| EDPB and EDPS Joint Opinion 2/2026 | 10 February 2026 |
| Council compromise text drops Article 88b | 18 June 2026 |
| Parliament committees' draft report | 22 June 2026 |
| Committee vote, plenary and trilogue | Not yet, as of October 2026 |
| Article 88a and 88b apply | On dates set in the final text, after adoption |
These timelines can move further. Previous attempts to reform EU cookie law, including the ePrivacy Regulation, stalled for years, and political negotiations could extend the process considerably.
What website owners should do now
The Digital Omnibus is a proposal, not law. Cookie consent under the existing ePrivacy Directive and the GDPR remains the binding standard, and the rules that apply depend on where your visitors are.
That said, several steps can prepare your site for the direction the regulation is heading:
- Audit your analytics setup. If you rely on third-party analytics, the proposed first-party exemption would not cover you. Consider whether self-hosted analytics tools could reduce your reliance on consent.
- Make sure your banner already offers a single-click reject option with equal prominence to the accept button. Regulators enforce dark pattern rules now, not after the Omnibus.
- Track the legislative progress on the Legislative Observatory and in EDPB publications.
- If your site already supports GPC signals, you are ahead on browser-level consent. If not, honouring GPC signals is a practical step towards the Article 88b model, whatever its final form.
Questions about the Digital Omnibus
Will the Digital Omnibus eliminate cookie banners?
Not entirely. The proposal exempts certain cookies from consent requirements, such as first-party audience measurement and security cookies, but marketing cookies, third-party tracking, and personalisation would still require prior consent. Cookie banners will remain necessary for most commercial websites until browser-level consent signals are widely adopted.
When will the Digital Omnibus cookie changes take effect?
No date is set. The proposal was published in November 2025, and as of October 2026 it is still at committee stage in the European Parliament. Articles 88a and 88b would only apply after the Parliament and the Council adopt a final text, on dates set in that text.
Does the Omnibus proposal exempt Google Analytics from consent?
No. The first-party analytics exemption applies only where the service provider creates aggregated audience measurement information solely for its own online service. Google Analytics sends data to Google's servers, which falls outside the exemption. Self-hosted analytics tools used for internal measurement are the intended beneficiaries.
What is Article 88b and how does browser-level consent work?
Article 88b would require websites to respect machine-readable signals of people's choices from browsers or operating systems. Users would set their privacy preferences once in their browser, and websites would honour them automatically. Technical standards have not been finalised, and a Council compromise text of June 2026 dropped the article.
Can websites keep showing cookie banners after a user refuses consent?
Under the proposal, if a user refuses consent, the website must not ask again for the same purpose for at least six months. This aims to reduce consent fatigue and repetitive banner displays.
How does the EDPB view the Omnibus cookie changes?
In Joint Opinion 2/2026, the EDPB and EDPS welcomed machine-readable consent signals and the aim of reducing consent fatigue. They raised concerns about splitting cookie rules between the GDPR and the ePrivacy Directive, since the GDPR only covers personal data while the ePrivacy Directive covers all device storage.
Keep today's consent right while the law changes
However the Omnibus proposal ends, consent for non-essential cookies is required today. If you are not sure which cookies your site sets, start with a free scan. Kukie.io finds and sorts every cookie, shows a banner with a one-click "Reject all" and records each choice.
