Cookie Consent Is Being Rewritten: What the Digital Omnibus Changes

The cookie banner is the most disliked piece of user interface in Europe. It is also, after eight years, still legally fragile on a large share of websites. Brussels has finally decided to do something about both problems at once, and the vehicle is the Digital Omnibus package proposed on 19 November 2025.

This article covers what is actually in the proposal, what is already law today, and what we would and would not change in a consent implementation right now. As of 10 October 2026 the GDPR and ePrivacy part of the package has not reached trilogue: the Council has no negotiating mandate yet and Parliament has no position, so parts of this will move.

How We Got Here

Cookie consent has never lived in GDPR. It lives in Article 5(3) of the ePrivacy Directive from 2002, amended in 2009, which says that storing information on, or accessing information from, a user's terminal equipment requires consent unless it is strictly necessary for a service the user requested.

That directive was supposed to be replaced by an ePrivacy Regulation. The proposal sat in Council deadlock for eight years and was formally withdrawn on 11 February 2025. What we were left with was a 2002 directive, transposed twenty-seven slightly different ways, policing a web that did not exist when it was written.

The result is the mess everyone recognises: banners that differ by country, consent that is technically invalid on a large number of sites, and users who click accept reflexively because rejecting takes longer.

What Is Already Enforceable Today

Before getting to the proposal, it is worth being blunt about the current state, because a lot of teams believe their banner is fine and it is not.

Enforcement has been steady and specific. In September 2025 the French supervisory authority fined Google 325 million euros and Shein 150 million euros on the same day. The findings were mechanical rather than philosophical: cookies were set before the banner appeared, and the refuse option did not reliably refuse.

The rules that regulators actually apply:

Nothing non-essential before the user acts. Not the analytics tag, not the pixel, not the chat widget, not the third-party font. If it fires on page load, it does not matter what the banner says.

Reject must match accept. Same layer, same visual weight, same click count. Making rejection a two-step journey through a preferences panel while accept is one button is treated as a dark pattern that invalidates the consent.

Consent is granular. A single toggle bundling analytics, advertising and personalisation is not specific consent.

Withdrawal has to be as easy as granting. A permanently reachable control, not a support email.

Consent expires. Most authorities work to roughly six to thirteen months before you should ask again.

Consent or pay is narrow. The European Data Protection Board's Opinion 08/2024 says large platforms generally cannot present a binary choice between accepting tracking and paying. A genuine free alternative without behavioural advertising is expected.

If your banner fails any of the first two, fix that before worrying about the reform. Those are the ones that generate fines today.

What the Digital Omnibus Proposes

In the Commission's proposal, the core structural move is to lift terminal equipment rules out of the old directive and put them into GDPR itself, through two new articles.

Article 88a: consent for terminal equipment access

This replaces Article 5(3) of the ePrivacy Directive and, importantly, widens the set of purposes that do not require consent. The current strictly necessary exemption is narrow enough that even basic audience measurement generally needs a banner. The proposal expands exemptions towards things like security, aggregate audience measurement and maintaining service integrity.

Two operational changes get most of the attention:

• Single-click acceptance or refusal. The choice has to be presentable in one action, both ways.
• A cooling-off period. If a user declines, you are not supposed to ask again for six months. That alone would remove a large share of the banner fatigue people experience.

Article 88b: machine-readable consent signals

This is the more interesting one for engineers. It would make browser-level or system-level consent signals legally binding on controllers. If a user expresses a preference once, at the browser, sites would have to honour it rather than asking again.

This is also the part member states liked least. The Council's text, described below, deletes Article 88b altogether.

Other bits worth knowing

The package also proposes moving the personal data breach notification deadline from 72 hours to 96 hours, and adjusts several definitions around pseudonymised data and AI training. Those are outside the scope of this article, but they travel in the same vehicle, which is part of why the file is contested.

What the Council's text does differently

The member states are working from a different text. The Irish presidency's compromise of 2 October 2026 (Council document 13886/26, drafted as the Council's mandate for negotiations with Parliament and not yet adopted on 10 October 2026) changes the Commission's design in several places:

• Cookie rules stay in the ePrivacy Directive. Article 5(3) is rewritten where it is, and Articles 88a and 88b are not added to GDPR. There is no obligation to honour browser signals in this text.
• Six purposes need no consent: transmitting a communication, a service the user explicitly asked for, first-party audience measurement that produces anonymous aggregated data, media audience measurement under the European Media Freedom Act, security, and measuring the display and performance of contextual advertising, without profiling.
• Refusal in one click. Users must be able to refuse "with a single-click button or equivalent means".
• A shorter wait. After a refusal, no new request for the same purpose for "at least four months", against six in the Commission's text.
• Two Commission ideas survive: the 96 hour breach notification deadline and the relative definition of personal data.

This is a negotiating position, not law, and Parliament has not adopted its own yet.

Timing, and Why You Should Not Plan Around It Yet

The realistic picture as of 10 October 2026:

• Trilogues have not started. A vote by EU ambassadors on the Council mandate planned for 7 October was postponed, and was reported to be rescheduled for 11 October 2026.
• In Parliament, the LIBE and ITRE committees published their draft report on 22 June 2026 and received more than 1,750 amendments. There has been no committee vote.
• In the Commission's text, Article 88a would apply roughly six months after entry into force. The Council's text gives member states 24 months to transpose the new Article 5(3), although its final provisions still carry a six month date, a conflict the negotiators will have to settle.
• In the Commission's text, Article 88b would apply within about 24 months. The Council's text drops it.

So the earliest plausible date for the single-click and cooling-off rules is 2027 on the Commission's timetable, and later if the Council's 24 months survive. Browser signal obligations may not come at all. Anyone telling you the cookie banner is dead this year is selling something.

What We Would Change Now, and What We Would Not

The reform is not law, but the direction is stable enough to inform architecture. Here is how we are advising clients.

Do this now

Fix the mechanics. Reject as easy as accept, nothing firing before interaction, granular categories, working withdrawal. This is current law and it is where the fines are.

Separate consent state from consent UI. Keep a consent service that owns the state, exposes it to the application, and stores the record with a version reference. Then the banner becomes a replaceable presentation layer. When the rules change, you swap the UI and keep the plumbing.

Store consent records properly. Timestamp, per-category state, the identifier of the banner text version, the mechanism used, and the source of the decision. Without the text version you cannot prove what the user actually agreed to.

Start listening for signals. Global Privacy Control is already legally relevant in several jurisdictions and costs very little to honour. Reading it now means Article 88b, if it lands, is a configuration change rather than a project.

Audit your tags for real. Not in the tag manager UI, but in the browser, on a real page, in a clean profile. Count the requests before consent. There are usually more than the team expects.

Do not do this yet

Do not rip out granular consent on the assumption that exemptions will widen. If the final text narrows again, you will have to rebuild it.

Do not rewrite your privacy notice around draft article numbers.

Do not remove the banner for audience measurement. The expanded exemption is a proposal, not a permission.

Do not commit to a 96 hour breach process. Keep operating on 72.

The Bigger Design Question

There is a broader shift worth naming. Regulators have moved from asking whether you have consent to asking how you obtained it. Interface mechanics are now the enforcement surface. That is why cookie banner cases turn on button placement and click counts rather than on the wording of a policy.

That trend continues past the Digital Omnibus. The Digital Fairness Act, expected as a proposal in late 2026, is aimed squarely at dark patterns, manipulative interfaces, personalised pricing and addictive design. Application is realistically 2028 or later, but it tells you which patterns have a shelf life.

If your growth numbers depend on a confusing interface, that is now a compliance risk with a date attached rather than a clever optimisation.

A Note on Analytics

A lot of the banner problem is self-inflicted. Teams load a third-party analytics platform that requires consent, then lose a third of their data to rejections, then try to design their way around it.

Self-hosted, privacy-first analytics can change the calculation, because measurement that stays on your own infrastructure and does not build cross-site profiles has a much stronger argument for the exemption, and would sit comfortably inside the expanded exemptions the Omnibus proposes. We wrote about one option in our guide to setting up Matomo, and the same logic applies to self-hosted marketing automation.

This is not a compliance trick. It is a genuine reduction in what you have to justify.

Where This Sits in the Wider Picture

Cookie consent is one piece of a much larger regulatory build-out. The full 2026 EU digital compliance map covers the rest, and the GDPR engineering guide covers the layer underneath.

If you want your consent implementation reviewed against what regulators are actually enforcing, or you want it rebuilt so the next rule change is a configuration rather than a rewrite, we can help. Write to office@c9group.dev.

We build systems, we do not provide legal advice, and the final call on interpretation belongs to your counsel.