On 21 October 2026, the Council of the EU adopted its negotiating position on the Data Omnibus, the Digital Omnibus GDPR reform. It provides for more exemptions for cookies, AI training based on legitimate interest and restrictions on the right of access. None of this is applicable law: cookie banners and access request processes remain unchanged for now.
Since the member states reached their agreement, reports have been circulating that make it sound as if the end of the cookie banner had been decided. That is not the case. A Council decision is a negotiating position, not a law. Several steps still lie between the Commission's proposal, the Council's position and a later legal text. This applies to the Digital Omnibus GDPR changes as a whole.
According to press reports, the Council has kept the definition of personal data and added rules on pseudonymisation. It wants to extend the exemptions from the consent requirement for cookies, allow AI training to rely on legitimate interest and restrict the right of access for abusive or excessive requests. On these points it differs from the Commission draft and from current law: the definition of personal data, cookies and audience measurement, AI training and the right of access. The table below sets the three levels side by side.
The sources are the reports by netzpolitik.org and IAPP, the Council press release and Council document 14756/26 of 22 October 2026. The information reflects the state of reporting and is not legal advice. The change markings in the Council document are not always clearly legible in the text version, so statements about them are subject to reservation.
Digital Omnibus GDPR: where the procedure stands
"Data Omnibus" here means the part of the Digital Omnibus package that is meant to amend the GDPR, the ePrivacy rules for cookies and terminal equipment, and parts of data law. In the press, the package and its parts are called Digital Omnibus or Digital Rulebook, depending on the outlet. They refer to the same project. The Commission presented the data part on 19 November 2025 as COM(2025) 837. The part on the AI Act is proceeding separately as COM(2025) 836.
Quite a lot has happened since then. On 11 February 2026, the European Data Protection Board and the European Data Protection Supervisor issued their Joint Opinion 2/2026 and, according to IAPP, spoke out against the originally proposed change to the definition of personal data. On 21 October 2026, the Irish Council Presidency announced the agreement of the member states. According to netzpolitik.org, citing government circles, Germany, Austria and Estonia voted against.
Next, the European Parliament needs its own position. According to netzpolitik.org, this is to happen in February, apparently meaning February 2027. That is a plan, not a firm commitment. Only after that does the trilogue begin, in which the Council, Parliament and Commission negotiate a joint text. When a law will be adopted and from when it will apply remains open.
It helps to distinguish three stages. The Commission's proposal is the starting point. The Council's negotiating position is the member states' stance for the trilogue. Only a law that has been adopted and published binds companies. At present the procedure is at the second stage, and the third is not in sight.
A Council position is not yet law.
For running a website, this means: the GDPR, the ePrivacy Directive and, in Germany, the TDDDG continue to apply unchanged. Anyone who now switches off banners or adapts processes to a draft is acting on a basis that does not exist.
Does the EU states' agreement on the Data Omnibus already require changes to cookie banners or access request processes?
The five most important changes in the Council position
The reporting names five points that matter in practice for companies. The table compares them with current law and the Commission draft.
First, the definition of personal data stays, and rules on pseudonymisation are added. Second, the list of purposes for which terminal equipment may be accessed without consent grows. Third, according to netzpolitik.org, the Council rejects a central signal in the browser. After a refused consent request, it should not be permitted to ask again for at least four months. Fourth, AI training is to be allowed to rely on legitimate interest. Fifth, access requests are to be easier to refuse as excessive. Netzpolitik.org summarises this as the right of access lapsing for unfounded or excessive requests.
In addition, according to netzpolitik.org, the position provides for targeted exemptions for scientific research. Under the Data Act, trade secrets are to be better protected, and for the reporting of cybersecurity incidents the Council, according to IAPP, rejects a single EU reporting portal. These points do not directly affect most website operators and are not discussed in depth here.
The central consent management (PIMS) that has long been planned in Germany is fundamentally not feasible.
Numerous technical reasons speak against it, and legal ones too.
The nature of the table matters. The column on current law describes the position today. The column on the Commission draft describes a proposal that need not come about in that form. The column on the Council position describes a stance that can still change in the trilogue. Parliament has not yet committed itself and will set its own priorities.
Personal data and pseudonymisation: the definition stays, rules are coming
The Commission wanted to change the definition in Article 4(1) GDPR. Whether data is personal was to depend more on whether the entity concerned can identify the person with reasonable effort. For some recipients, pseudonymised data would then no longer have been personal data. That would have noticeably narrowed the scope of the GDPR.
According to IAPP, the Council does not follow this and keeps the existing definition. Instead, new rules on pseudonymisation are to be introduced. According to netzpolitik.org, the European Data Protection Board is to give technical and legal guidance so that pseudonymisation and anonymisation are applied consistently. What these rules will look like in detail cannot be seen from the available sources.
In practice, nothing changes for the time being. Pseudonymised data remains personal data, even though pseudonymisation is a recognised protective instrument. Anyone who passes data on to service providers cannot rely on a pseudonym removing the link to a person. The difference between pseudonymised and anonymised data is explained in the article on the anonymisation of personal data.
The new framework will be interesting above all for analytics and AI projects. If pseudonymisation is regulated more clearly in future, safeguards will be easier to describe and to demonstrate. Until then: pseudonymisation remains a sensible technical measure, but not an exemption from the GDPR.
Cookies and audience measurement: what might work without consent in future
Today, Art. 5(3) of the ePrivacy Directive, implemented in Germany in § 25 TDDDG, requires consent for storing information on and accessing terminal equipment. Exempt is what is strictly necessary for the transmission or for an expressly requested service. Under the German reading, consent for audience measurement is generally required where information is stored on or read from the device. The article Are cookies for audience measurement exempt from consent? covers this, and a general overview can be found in the overview of cookies and consent.
The Commission wanted to move the rules into the GDPR and add new exemptions there. According to the draft, expressly requested services, security purposes and aggregated audience measurement for the controller's own purposes were, among other things, to be possible without consent.
According to netzpolitik.org, the Council rejects this relocation. The ePrivacy rules remain, but the list of purposes without consent is extended. The purposes named are providing a service, audience measurement and the security of the terminal device. IAPP reports that the focus is on third-party cookies and names the same purposes. Netzpolitik.org concludes that some cookie banners will disappear and tracking will in part become easier.
The Council document makes this more concrete. According to it, Art. 5(3) of the ePrivacy Directive is to receive a list of purposes that includes, among others, transmission, an expressly requested service, security and the measurement of advertisements under narrow conditions. Audience measurement is described as anonymous, aggregated information. It may be carried out by the provider or by a third party on its behalf, but the data may not be passed on to third parties or combined with third-party data. Media have their own variant with pseudonymisation and without tracking beyond the measured service. Whether a common analytics tool meets these conditions depends on the individual case. Anyone who transmits data to third parties or recognises visitors across several sites should not assume that it is covered.
Access without cookies, for example through browser fingerprinting or local storage, also falls under access to terminal equipment. An inventory should therefore not stop at cookies in the narrow sense. A scan that captures cookies and browser storage together is helpful. One option is the author's own Security Check on wwwschutz.de (a service offered by the author), which lists cookies as well as local and session storage. More details are in the section on preparation.
Central cookie switch in the browser: why the Council refuses
In Art. 88b of its draft, the Commission had proposed that visitors set their choice once centrally, for example in the browser, and that websites must respect this signal. According to the draft, the obligation was to apply only once technical standards are available and a transition period has expired. Media providers were exempt. In addition, after a refusal there was to be no new request for the same purpose for at least six months.
According to netzpolitik.org, the Council rejects the central switch. The decision therefore stays with the individual website. The draft of Art. 88b is still contained in the Council document, but whether and how it is changed cannot be clearly read from the markings and is therefore not assessed. On the waiting period, the Council document names at least four months after a refused consent request for the ePrivacy rule, provided the purpose is the same. Germany considered three months sufficient and wanted exceptions so that services may ask again sooner. The period applies to the same purpose; it is not a blanket ban on all requests.
For banners and consent management this means: nothing changes for the time being. There is no signal that would have to be respected and no statutory waiting period. Anyone who already limits the repetition of the request today, for example by storing the decision for several months, can keep doing so.
For technical implementation, the Council's restraint is a relief. A browser signal would have required interfaces and testing. Without this signal, the effort remains manageable. Should Parliament bring the switch back, the question will be on the trilogue agenda again. A commitment in advance is therefore not possible.
AI training based on legitimate interest: opportunities and the right to object
Even today, AI training with personal data can be based on Art. 6(1)(f) GDPR if the balancing of interests comes out in the controller's favour. Guidance is provided by Opinion 28/2024 of the European Data Protection Board on AI models. The situation is described in the article AI training and the GDPR, and the general principles in the article on legitimate interest.
The Commission wanted to regulate this option expressly and combine it with safeguards, including data minimisation, transparency and an unconditional right to object. According to netzpolitik.org, the Council goes further: AI training with personal data is to be allowed even without pseudonymisation if there is a legitimate interest. The legal basis remains Art. 6 GDPR, and the right to object remains. The Commission is to examine whether the requirements for small and medium-sized enterprises are proportionate. According to IAPP, additional safeguards are to apply to particularly sensitive data.
The opportunity lies in greater legal certainty. An express rule could defuse the question of whether legitimate interest can be considered for AI training at all. That could make it easier for projects that have so far failed because of uncertainty. The final wording is open, however, and the legal basis remains Art. 6 with a balancing of interests.
Legitimate interest is a legal basis, not a free pass: the balancing test and a route to object remain mandatory.
The right to object under Art. 21 GDPR remains the benchmark. Data subjects must be informed and must be able to object to the processing. That requires a working way to keep data out of future training runs, and a statement on what happens to models that have already been trained. Criticism comes from noyb, which, according to netzpolitik.org, speaks of "digital expropriation". According to netzpolitik.org, trade unions, consumer protection and civil society see the package as a whole as a step backwards for digital fundamental rights.
Companies should therefore document AI projects as if the stricter standard applied: purpose, data sources, balancing test, safeguards and route to object. That is already necessary today and remains sensible after a reform.
Right of access and excessive requests: what is meant to change
The right of access under Art. 15 GDPR applies today with one limit: under Art. 12(5) GDPR, controllers may charge a fee or refuse access for manifestly unfounded or excessive requests. The burden of proof lies with the controller. The threshold is high, and supervisory authorities and courts interpret it narrowly.
The Commission wanted to allow refusal or a fee even where the right is used for purposes other than data protection. According to netzpolitik.org, under the Council position the right of access lapses for "unfounded or excessive requests". The Council document is more cautious: Art. 12(5) is still to provide for refusal or a reasonable fee, and a request under Art. 15 may also be regarded as excessive where an abusive intent is demonstrated. Examples named are requests made only to demand compensation after a refusal, or series of similar requests intended to harm the controller. According to the text, the burden of demonstrating this remains with the controller. What exactly is new and what was already in the Commission draft cannot be determined with certainty from the markings.
In everyday practice, not much will change as long as the text is not law. What matters is not to conclude from the debate that access requests could be warded off across the board today. Anyone who refuses a request must set out the reasons comprehensibly and document them. That applies even if the request is a nuisance or was made in the middle of a dispute.
A well-rehearsed process makes sense: record receipt, verify identity, monitor deadlines, search systems systematically, document the response. The better this process runs, the less it is necessary to fall back on an exception. If one comes, it can be built on clean documentation.
What companies can prepare now
Preparing does not mean switching over. The following steps are useful regardless of how the procedure ends, because they make gaps in the current position visible.
Start with the cookie inventory. Record every entry that is set on or read from the terminal device: cookies, local storage, session storage and comparable techniques. For each entry, note the name, provider, purpose, storage period and whether it comes from your own domain or from third parties. The storage period can often only be read in the browser tools or in the provider's documentation. The entries are then assigned to today's categories: strictly necessary, statistics, marketing, convenience. In addition, you can note which entries might fall under a future exemption for service, audience measurement or device security. This note is only a working hypothesis and not a legal basis.
Among others, two of the author's own tools are suitable for the scan. According to the site, the GDPR website check includes a cookie analysis with a GDPR assessment. The Security Check captures cookies and browser storage with source, purpose and risk level and, according to the site, uses a cookie database with tool assignment. The results are a starting point and must be checked, for example to add the lifetime.
Second, the access request process. It is worth playing through a test case: where is the data on a person, who supplies it, how is it documented? Cases in which a request was refused or limited should also be recorded in a comprehensible way.
Third, AI projects. For every project that uses personal data, you need a documented balancing test, a description of the safeguards and a route for objections. Whether training uses pseudonymised or raw data should be justified in writing.
Fourth, follow the procedure. The next date is Parliament's positioning, which according to netzpolitik.org is planned for February. Only then will it become clear where a compromise may lie. According to netzpolitik.org, Germany demands that the Commission take its position into account in the upcoming Digital Fitness Check, a review of the digital rulebooks for simplification needs.
What is better left undone for now
What should not yet be done is just as important.
- Do not switch off cookie banners. As long as the consent requirement applies, the banner remains necessary, and violations cannot be justified by pointing to the Council.
- Do not change audience measurement on a hunch. Measurement without consent needs a sound basis today. A Council decision is not one.
- Do not re-justify training data across the board. Anyone who has so far relied on consent or anonymisation does not simply fall back on legitimate interest without a balancing test.
- Do not dismiss access requests as excessive across the board. The threshold is high today, and the future wording is still open.
- Do not build on browser signals. The Council rejects the switch; whether it will come is open.
The result can be summed up in a few statements.
- The Council has taken a position; there is no law.
- The definition of personal data stays, and pseudonymisation is regulated separately.
- For cookies, the list of exemptions grows, and the browser switch drops out.
- AI training based on legitimate interest is made easier, and the right to object remains.
- On the right of access, according to the Council document the burden of demonstration stays with the controller; the threshold and the final version are open.
According to the plan, Parliament wants to set its position in February 2027. Until then, current law applies, and a clean inventory pays off under any version.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
