Status as at 26 October 2026: the text examined is the Council of the EU’s negotiating position in procedure 2025/0360(COD), not law currently in force.
A practical legal analysis for online stores, SaaS companies, digital agencies and organisations using data, cookies or AI.
Author: Ivanova Legal Solutions | Category: Personal data, AI and technology
1. Introduction: A new stage in European digital legislation
On 21–22 October 2026, the Council of the European Union formally approved its negotiating mandate on the key Digital Omnibus legislative package (procedure 2025/0360(COD), Council document ST 14756/26). The initiative aims to harmonise, simplify and modernise the existing EU framework on personal-data protection, the confidentiality of electronic communications and cybersecurity.
The main elements of the agreed compromise directly affect everyday processes in the digital economy:
- Reducing the burden of cookie banners by expanding the situations in which cookies may be used without prior consent;
- A higher threshold and an extended 96-hour deadline for notifying supervisory authorities of personal-data security breaches under Article 33 GDPR;
- Legal safeguards and clarity for data processing in artificial-intelligence (AI) systems, as well as clarification of pseudonymisation;
- A single national entry point for centralised cyber-incident reporting under GDPR, NIS2, DORA, eIDAS and the Critical Entities Resilience (CER) Directive.
Important clarification for businesses: The Council’s mandate is its position for the forthcoming interinstitutional negotiations (trilogues) with the European Parliament. The text is not yet finally adopted law. At present, the existing GDPR rules and Directive 2002/58/EC (ePrivacy) remain fully applicable, and businesses should not prematurely remove consent banners or alter their security procedures.
2. Cookies and tracking: Will intrusive banners disappear?
One of the most anticipated practical improvements addresses so-called consent fatigue. The Council’s negotiating position maintains the general principle that consent is required for access to a user’s terminal equipment under Article 5(3) of the ePrivacy Directive and the proposed new Article 88a GDPR, but introduces express and broader exceptions where consent would not be required.
When could cookies be placed without consent?
- Transmission of electronic communications and strictly necessary services: The established exception remains for operating an information-society service expressly requested by the user, such as an online-store basket or preservation of a session;
- Aggregated audience measurement: Measuring website visits and traffic by the controller exclusively for its own use would be permitted. The conditions are that the collected data are pseudonymised after collection, final reports contain no personal data, and the information is not used for profiling or targeted advertising;
- Cybersecurity and maintenance of terminal equipment: Storage and access would be permitted to maintain or restore the security of the service or terminal equipment, including fraud prevention and critical security software updates;
- Measurement of contextual advertising: Measuring the display and basic effectiveness of advertising based solely on content viewed during the current session would be permitted, without tracking past or future user activity across websites.
An end to endless repeated requests (cookie fatigue)
The proposal introduces strict rules for banner interfaces:
- One-click refusal: A user must be able to refuse consent as easily as they can give it, through a clear and visible first-layer button;
- No repeated request after refusal: Where the user refuses, the controller may not show another consent banner for the same purpose for at least four months (and up to six months under the general rules for terminal equipment);
- Automated browser signals: Platforms would be required to respect machine-readable preference signals set at browser or operating-system level, subject to transition periods of 24 to 48 months for browser developers.
3. GDPR, pseudonymisation and artificial intelligence (AI)
The Digital Omnibus addresses some of the most contested practical questions at the intersection of GDPR, new technologies and generative AI.
A relative approach to the concept of personal data and pseudonymisation
The amended Article 4(1) GDPR expressly clarifies that information is not automatically personal data for every recipient merely because a third party is able to identify the individual concerned. For a particular recipient, information is not considered personal data where that recipient does not have means reasonably likely to be used for re-identification. This provides much-needed legal certainty for the exchange of pseudonymised datasets.
Training and operation of AI systems (Article 88c GDPR)
The legislative proposal confirms that the development and operation of AI models may be based on legitimate interests under Article 6(1)(f) GDPR, provided that the balancing test is met, data-minimisation measures are used and the unconditional right to object under Article 21 is secured.
It also introduces a derogation for special categories of data under Article 9 GDPR: where sensitive data are inadvertently and residually included in training and validation datasets, the developer would not be liable for an infringement if adequate preventive measures were implemented and the data are deleted without delay, or technically isolated where full deletion from the model is technically impossible.
Relief in cases of abusive data-subject requests
The negotiating text introduces clearer criteria and procedural relief for controllers receiving manifestly unfounded or excessive requests for access, erasure or portability, as well as for certain low-risk information duties.
4. New rules for cyber incidents: 96 hours and a single entry point
| Aspect | Current GDPR regime | Council proposal under the Digital Omnibus |
|---|---|---|
| Threshold for notifying the supervisory authority | Every breach, unless it is unlikely to result in a risk to rights and freedoms. | Only breaches likely to result in a high risk to the rights and freedoms of natural persons. |
| Initial notification deadline | Within 72 hours of becoming aware. | Within 96 hours of becoming aware, where delay is justified. |
| Reporting channel | Directly to the Commission for Personal Data Protection through the national form. | A single national entry point combining reports under GDPR, NIS2, DORA, eIDAS and CER. |
| Internal documentation | A register of all breaches is mandatory under Article 33(5). | The full obligation to document and internally assess the risk remains. |
Creating a national entry point in each Member State, with an information portal coordinated by ENISA, aims to eliminate the double and triple reporting faced by banks, fintech companies, cloud-service providers and critical operators simultaneously within the scope of GDPR, NIS2 and DORA.
5. What this means for business: practical guidance
1. For online stores and e-commerce platforms
Although banners for third-party marketing and tracking cookies would continue to require consent, removing consent for basic first-party audience measurement would improve the customer experience and the accuracy of analytical data.
2. For SaaS and software companies
The higher notification threshold for incidents, limited to high-risk cases, and the extended 96-hour period would reduce administrative panic and unjustified reporting of minor technical deviations while providing valuable time for a genuine incident analysis.
3. For digital and marketing agencies
Agencies will need to prepare their clients for strict one-click refusal requirements and the four- to six-month pause before a repeated request. Consent-collection strategies will need to become significantly more transparent and more centred on user trust.
6. Next steps and timeline
The Council’s adoption of its mandate gives the green light for trilogue negotiations with the European Parliament after the Parliament has adopted its negotiating position. The final Digital Omnibus Regulation is expected to be agreed and adopted during 2027, followed by a transition period: between 18 and 24 months for most obligations, and up to 48 months for browser providers.
Recommendation from Ivanova Legal Solutions: Do not make changes to technical banners or internal security registers at this stage. Use the current period for an internal audit of deployed cookies, separating first-party analytics from remarketing, and for a review of cyber-incident readiness under NIS2/DORA.
For legal advice on the compliance of your software, online platform or AI solution with European legislation, contact Ivanova Legal Solutions.
Official sources: Council document ST 14756/26 and European Commission proposal COM(2025) 837 final. This material is for general information only and does not constitute individual legal advice.