For years the joke about EU privacy law has been that its most visible output is the cookie banner. Brussels now agrees the banners went too far. On 21 October 2026, EU member states agreed their negotiating position on the Digital Omnibus, the package meant to simplify the EU's digital rulebook, and cookies are a central part of it.
If you run a website, an agency or a SaaS product with EU visitors, you will see headlines saying cookie banners are going away. That is not what has happened. Here is what was actually agreed, how it differs from the original proposal, and what you should do with your banner this quarter.
This is an operational guide, not legal advice. Sources are listed at the end.
The short version
- Nothing has changed in law yet. The Council has agreed a position, not a final text. Your current cookie consent obligations still apply.
- The direction is fewer banners for low-risk purposes. Both the Commission and the Council want some cookie uses to stop needing consent.
- The Council took a different legal route. The Commission wanted to move the cookie rules for personal data into the GDPR. The Council keeps them in the ePrivacy Directive and updates that framework instead.
- The next step is the European Parliament. Once it agrees its own position, the institutions negotiate the final wording in trilogue.
How we got here
The European Commission published the Digital Omnibus on 19 November 2025. Its cookie section had a clear goal: cut consent fatigue without letting tracking run unchecked. According to the Commission's own Digital Package FAQ, the proposal would:
- let people refuse all cookies with a single click, so banners would need a one-click refusal button;
- require websites to respect people's choices for at least six months, so a "no" cannot be followed by the same question on the next visit;
- let people set their privacy preferences centrally, for example in the browser, with websites required to respect them;
- stop cookies used only for non-risk purposes, like counting website visits, from triggering a banner;
- move the rules on access to devices, where personal data is processed, from the ePrivacy Directive into the GDPR, which would bring GDPR-level enforcement and fines.
In February 2026 the European Data Protection Board and the European Data Protection Supervisor adopted a joint opinion on the proposal, and the political debate since then has been intense. Privacy groups pushed for strong browser signals. Industry groups pushed for wider exemptions.
What the Council agreed on 21 October 2026
The Council's press release, updated on 22 October with the text of the mandate, sums up the cookie part in a few lines. The mandate:
- maintains the rules on cookies and other tracking technologies under the ePrivacy Directive, rather than moving them into the GDPR;
- updates that framework with clearer and additional purposes for which consent is not required, with the stated aim of reducing the number of cookie banners;
- gives examples of such purposes: when storage is necessary for the provision of a service, for audience measurement, or for ensuring the security of the user's device.
On the wider GDPR changes, the Council also kept the current definition of personal data, which the Commission had proposed to narrow. That matters for cookies too, because cookie identifiers and IP addresses are often personal data, and a narrower definition would have changed how many tracking tools are assessed.
What the press release does not tell you is how the Council text treats the Commission's single-click refusal, the six-month rule or browser signals. Those details sit in the full mandate and will be reopened in trilogue anyway. Treat any article that tells you exactly how they will end up as a guess.
Commission proposal vs Council position at a glance
- Where the rules live. Commission: the GDPR, for device access when personal data is processed. Council: the ePrivacy Directive, updated.
- Consent-free purposes. Commission: low-risk purposes such as counting visits. Council: clearer and additional purposes, including service provision, audience measurement and device security.
- Refusal mechanics. Commission: single-click refusal and choices respected for at least six months. Council: not detailed in the press release.
- Browser signals. Commission: central preferences, for example in the browser, that websites must respect. Council: not detailed in the press release.
- Enforcement. Commission: the GDPR framework and its fines. Council: stays with the ePrivacy framework and national enforcement.
What this means for your cookie banner today
1. Keep your banner and your blocking
Until a final text is adopted and starts to apply, the existing rules remain. In most EU countries that means prior consent for anything that is not strictly necessary, and consent that meets the GDPR standard: freely given, specific, informed and unambiguous. Removing a banner because of a headline is the most expensive mistake you can make here. Our guide to GDPR cookie consent requirements covers the current baseline.
2. Sort every cookie and script by purpose
Both the Commission and the Council talk about purposes, not cookie names. When the final list of consent-free purposes arrives, you will need to know which of your tools fall inside it. Start that work now:
- list every cookie, pixel, tag and embed your pages load;
- note the purpose of each one: delivering the service, security, audience measurement, advertising, personalisation, support chat and so on;
- flag tools that mix purposes, such as an analytics tool that also feeds ad audiences, because those are the least likely to qualify for any exemption.
A scan gives you the starting inventory. COKIQ's website scanner detects first-party and third-party cookies, scripts, pixels and widgets, and turns findings into a cookie policy inventory you can review. A spreadsheet works too. What matters is that each item has an owner and a purpose.
3. Look hard at your analytics setup
"Audience measurement" is the exemption most website owners will care about, and it is also the one most likely to come with conditions. Exemptions of this kind are usually tied to measurement for the site's own use, with no combination with other data and no sharing for advertising. Until the final text sets the conditions, assume:
- analytics that only count and measure use of your own site are the strongest candidates;
- analytics that send data to an ad platform, build cross-site profiles or link to advertising IDs will still need consent.
If you use Google Analytics with Google Ads, keep Consent Mode v2 correctly wired to visitor choices. Google's own EU consent requirements sit alongside the law, and the Omnibus does not change them.
4. Make refusal as easy as acceptance now
A first-layer "Reject all" option is already what many EU regulators expect, and the Commission put single-click refusal at the centre of its proposal. If your banner still hides refusal on a second layer, fix that now rather than waiting. Our article on the Reject All button has a quick test you can run.
5. Remember refusals instead of re-asking
The Commission's six-month idea targets banners that reappear on every visit until people give in. Whatever the final text says, re-asking someone who just said no is poor practice. Check how long your banner stores a refusal and what makes it show again. Our guide to how long cookie consent lasts explains the trade-offs.
6. Prepare for browser-level signals
Whether or not binding browser preferences survive the negotiations, such signals already exist. Global Privacy Control is recognised for opt-outs under California's privacy rules, and it shows how a browser-level choice can travel with every request. If your consent tool can read and log signals like this, you are better placed for whatever the EU settles on. Our GPC website testing checklist shows how to verify yours.
7. Keep evidence of consent decisions
If the final text keeps cookies under the ePrivacy Directive, national regulators stay in charge of enforcement, and they ask for evidence. If parts end up under the GDPR, the fines framework is larger. Either way, a record of which banner version a visitor saw and what they chose is your best defence. See consent logging explained for what a useful record contains.
Timeline: what to watch next
- 19 November 2025: the Commission publishes the Digital Omnibus proposal.
- 10 February 2026: the EDPB and EDPS adopt their joint opinion on the proposal.
- 21 October 2026: the Council agrees its negotiating mandate (text published on 22 October).
- Next: the European Parliament agrees its position, then trilogue negotiations on a final text.
- After adoption: the final regulation will set when the new cookie rules start to apply. Expect a transition period, and a longer one for anything that depends on new technical standards, such as browser signals.
Set a reminder to review your banner when the Parliament votes and again when trilogue concludes. Those are the two moments when the shape of the exemptions will become clear.
A practical checklist for this quarter
- Banner and script blocking unchanged until the final rules apply.
- Every cookie and script listed with a single named purpose.
- Analytics tools split into "own-site measurement only" and "feeds advertising".
- Reject all available on the first layer with equal prominence.
- Refusals stored and respected, not reset on every visit.
- Browser privacy signals detected and logged where your tool supports them.
- Consent records kept with the banner version shown.
- A named person watching the Parliament vote and the trilogue outcome.
If you want a quick look at what your site loads today, run a free COKIQ scan. It will not tell you what the final Omnibus text says, because nobody knows yet, but it will give you the inventory you need to act fast when it lands. For banner design ideas that already follow the "easy to say no" principle, see our cookie banner examples.
Sources
- Council of the EU, press release, 21 October 2026 (updated 22 October 2026): Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules
- European Commission, Digital Package FAQ
- EDPB and EDPS, Joint Opinion 2/2026 on the Digital Omnibus proposal (adopted 10 February 2026)
- IAPP, EU member states finalize Digital Omnibus negotiating stance (22 October 2026)