Baking a New Batch: Digital Omnibus and Cookies

25/06/2026: Every company working with cookies and similar techniques has been struggling with both GDPR and ePrivacy Directive and all local implementations. The Digital Omnibus proposes cookies and similar techniques with personal data, to be handled exclusively by the GDPR. Introduced by the European Commission on 19 November 2025, the Digital Omnibus is a broad legislative package that would amend several EU digital laws, including the GDPR, the ePrivacy Directive, the Data Act and the NIS2 Directive. It aims to simplify the increasingly complex EU digital rulebook. 

This blog is part of a series exploring the proposals set out in the European Commission’s Digital Omnibus package. In a previous blog, we examined the Omnibus’s vision for a single-entry portal for incident reporting. In this post, we turn our attention to the proposal to bring all cookies and similar tracking technologies involving personal data under the unified framework of the GDPR, including the introduction of automated, machine-readable mechanisms for capturing and communicating data subjects’ preferences.  

The proposal by the European Commission 

Since May 2018, cookie consent banners have become a persistent source of frustration for internet users. Visiting almost any website means navigating yet another pop-up, clicking through layers of options, and repeating the process on every return visit. Users are fatigued, business bears significant compliance costs, and the privacy choices presented are often far from meaningful. Ultimately, few people have the time, nor the inclination, to review the dense legal language that typically accompanies these banners.   

The European Commission has recognized this problem and is looking to address it by amending the rules governing cookies and similar tracking technologies. The proposed changes aim to encourage less intrusive forms of tracking, prioritize first-party data collection, and reserve strict consent requirements for more invasive tracking practices. In practice, this should lead to a significant reduction in unnecessary cookie banners, while giving users simpler, more meaningful control over their privacy.   

This clearly fits a broader shift in the EU policy, from personal tracking to data minimization and from profiling to contextual insights.  

The EDPB & EDPS's joint opinion broadly supports the objective of simplification and harmonization between the GDPR and ePrivacy Directive. They do have some concerns that simplification could lead to reducing the level of protection of fundamental rights. The ePrivacy Directive is tied to fundamental rights to privacy and confidentiality of communications. The GDPR is much smaller in scope, focusing exclusively on personal data. This means that ePrivacy Directive protects the terminal equipment and private sphere, not just personal data. It could be that by moving the regulation of cookies towards GDPR, the risk of losing broader protection logic becomes real.  

They propose keeping the scope of the proposed changes to both cookies and similar techniques, to ensure the cookie rules remains broadly applicable. They are also worried that the proposed changes will weaken the consent requirements for tracking, even if simplification is the goal.  

In short, the EDPB and EDPS say, simplifying the rules around cookies and tracking is a good idea where necessary, but do not use simplification to weaken consent, narrow scope, or dilute the fundamental privacy protections of the ePrivacy framework.  

Practical proposed changes 

There are two important changes the European Commission is proposing:  

1. Fewer overlapping rules 
   1. Cookies and similar techniques with a personal data aspect, will be handled by GDPR exclusively.  
2. The way of giving consent 
   1. Browser- and device-level preferences 
      1. This means you only have to set your preferences once in your browser and/or device and websites will respect it 
3. Machine-readable signals 
   1. Preferences will again be shared automatically with websites, preventing you from clicking multiple times 
4. Less frequent consent requests 
   1. If you say ‘no’ the website cannot ask again for 6 months 

With the above proposal, cookie banners will not completely disappear, but they will decrease significantly.  

Additionally, the categories of cookies and similar techniques that you can use without consent are extended:  

• The functional cookies will remain  
• Security functions 
• Basic, first-party analytics (for audience measurement) will be possible, if:  
  • It is only first-party 
    • How many people visited a page 
    • Which pages are popular 
    • How long users stay 
    • Rough traffic sources 
  • The data is aggregated 
  • Only used for internal use 
  • No tracking across services 

You still need to ask for consent for advertising tracking, cross-site tracking and personalized profiling. For those purposes, cookie banners will remain.  

Looking forward 

Since most of the EU organs believe we should change things, future change appears inevitable. But what can you already do as an organization to prepare?  

• Think about your analytics setups, can you already aggregate the data or anonymize it?  

• Look at the third parties you are using and determine if you want to keep using them or if you can go with first-party information? 

• Do you have your analytics fused together with advertising? Start separating it.  

• Decide what type of tracking is enough for your business? Do you need the detailed-on person level tracking, or can you do with the less severe audience measurement type of tracking?  

At Considerati, we will follow the legislative process closely and provide updates as things develop. If you have questions about how the Digital Omnibus may affect your organization's cookie policy, or about the package more broadly, we are happy to have an introductory call.