EU Digital Omnibus tracker: GDPR and ePrivacy status, timeline and text

The ordinary legislative procedure needs three things before a text becomes law. The Council and the Parliament each adopt a position, the two then agree a text in trilogue with the Commission, and both formally adopt it. Only the first step has happened, and only on the Council side.

The Parliament file sits with two committees jointly. Aura Salla (EPP, ITRE) and Marina Kaljurand (S&D, LIBE) were appointed co-rapporteurs on 25 February 2026 (Legislative Observatory). Their draft report says Parliament asked for a targeted impact assessment on specific provisions in Articles 3, 4 and 10 of the proposal. Article 3 holds the GDPR amendments (draft report PE786.818).

Members tabled more than 1,000 amendments to the GDPR and ePrivacy parts, according to noyb's count reported on 12 October 2026 (PPC Land, 12 October 2026). No committee vote date appears on the Legislative Observatory page we checked.

Each row names its source. "Primary" means we read the official text. "Reported" means the document is not public and we rely on dated reporting.

The law today. Article 5(3) of the ePrivacy Directive allows storing or reading information on a device "only" with consent. It has two exemptions: technical storage for transmitting a communication, and storage "strictly necessary" to provide a service the user explicitly requested (Directive 2002/58/EC, consolidated, Article 5(3)). Each member state transposes it into national law and chooses the authority that enforces it.

The Commission's design. The proposal would add a sentence switching Article 5(3) off where the user is a natural person and the information "constitutes or leads to the processing of personal data" (COM(2025) 837, Article 5). A new Article 88a GDPR would then govern those cases, with four exempt purposes, from six months after entry into force. Article 88b would oblige controllers to honour automated, machine-readable choices after 24 months, and non-SME browser providers to support them after 48 months.

The Council's design. The mandate strikes Articles 88a and 88b in full (Council document 14756/26, pp. 143 to 145). It rewrites Article 5(3) of the Directive instead, so the rule stays in ePrivacy. Member states would transpose it within 24 months of adoption, and GDPR supervisory authorities would enforce it (pp. 156 to 158).

The practical difference is timing and uniformity. A GDPR article applies directly and at once. A directive arrives country by country, through national laws.

The Commission column quotes COM(2025) 837 (EUR-Lex). The Council column quotes the mandate (document 14756/26), with page numbers. Parliament has no text to compare.

Two points need care. First, the Council text speaks of "information", not "personal data", so its rule covers any reading of a device. Second, the Council deleted the Commission's sentence on the six-month start date (p. 169), which leaves transposition as the only clock.

These are positions, not law. Each carries its date and its status.

EDPB and EDPS (10 February 2026). The two bodies "strongly welcome" Article 88b. They also warned that splitting device-access rules across two instruments could create legal uncertainty, and recommended "adding an exception for contextual advertising" (Joint Opinion 2/2026, pp. 6 and 32). The Council later adopted the contextual exemption and dropped the signal.

Industry and civil society. Google commissioned a study from Implement Consulting Group, published in March 2026. It estimated that browser-level consent would cost EU businesses EUR 40 billion to 50 billion a year (company-commissioned estimate, reported by PPC Land, 28 June 2026). noyb disputed the figures in the same report. The French association Alliance Digitale asked on 21 May 2026 for Article 88b and the re-ask ban to be deleted. A coalition of 19 organisations asked on 10 September 2026 for the signal to return (PPC Land, 13 September 2026).

Law firms. Taylor Wessing read the Commission's audience-measurement exemption as excluding tools that work across several services, so most advertising measurement would stay consent-based (Taylor Wessing, 2 February 2026). That reading concerns the Commission draft; the Council text changed the wording.

This section is our analysis of the texts above. It is not a statement of law in force. A bid request flow, an analytics tag and a frequency cap fall under different exemptions, so each needs its own test.

The mandate does not mention consent management platforms or the IAB Europe Transparency and Consent Framework; we found no reference to either in document 14756/26 (Council register). How TCF purposes would map to the six exemptions is therefore open. For the bid-request fields that carry consent today, see our guide to GDPR, ePrivacy and RTB consent signals, and for decoding strings, the TCF consent string decoder.

The pseudonymisation rule may matter more to measurement than any cookie change. If it survives, a clean room partner's legal position would depend on what that partner can do with the data. Our comparison of clean room architectures explains the processor and independent-recipient models.

The ePrivacy Regulation proposal of 10 January 2017 is no longer pending. EUR-Lex marks COM(2017) 10 as withdrawn and gives 6 October 2025 as its end of validity (EUR-Lex, COM(2017) 10). The Directive of 2002, as amended in 2009, remains the law. The Digital Omnibus is now the only live vehicle for changing the cookie rule. For how member states apply Article 5(3) today, see our tracker of cookie banner rules by country.

• Commission proposal: COM(2025) 837 final on EUR-Lex, with the explanatory memorandum (EUR-Lex).
• Council mandate: document 14756/26, a public PDF on the Council register. Bold marks additions and strikethrough marks deletions against the Commission text (Council register).
• Parliament: draft report PE786.818 of 22 June 2026 and the amendment documents listed on the procedure file (Legislative Observatory).
• Regulators: EDPB-EDPS Joint Opinion 2/2026 (EDPB).

A plain-text copy of the mandate loses the strikethrough, so deleted Commission wording reads as if it were kept. Only the PDF layout shows which wording the Council struck.

The dates of every other 2027 deadline that touches advertising are in our ad tech regulation calendar. The UK changed its own cookie rules separately; see the UK Data (Use and Access) Act guide. The AI Act timetable is covered in EU AI Act and advertising, and the Data Act changes in EU Data Act for ad tech.

1. European Commission, Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), COM(2025) 837 final (19 November 2025). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837
2. Council of the European Union, document 14756/26, Mandate for negotiations with the European Parliament, outcome of proceedings (22 October 2026; agreed by Coreper 21 October 2026). https://data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf
3. European Parliament, Legislative Observatory, procedure file 2025/0360(COD) (checked 9 November 2026). https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0360%28COD%29
4. European Parliament, ITRE and LIBE, Draft report PE786.818, rapporteurs Aura Salla and Marina Kaljurand (22 June 2026). https://www.europarl.europa.eu/doceo/document/CJ72-PR-786818_EN.html
5. EDPB and EDPS, Joint Opinion 2/2026 on the Digital Omnibus proposal (adopted 10 February 2026). https://www.edpb.europa.eu/system/files/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf
6. Directive 2002/58/EC (ePrivacy Directive), consolidated version of 19 December 2009, Article 5(3). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219
7. European Commission, Proposal for a Regulation on Privacy and Electronic Communications, COM(2017) 10, procedure record showing withdrawal (end of validity 6 October 2025). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:52017PC0010
8. European Parliament, Legislative Observatory, procedure file 2025/0359(COD), Digital Omnibus on AI (checked 9 November 2026). https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0359%28COD%29
9. PPC Land, "EU Council drops cookie signal after Google lobbying - EUR 40-50 bn at stake" (28 June 2026). https://ppc.land/eu-council-drops-cookie-signal-after-google-lobbying-eur-40-50-bn-at-stake/
10. PPC Land, "19 groups ask EU to re-insert the cookie banner fix Google lobbied out" (13 September 2026). https://ppc.land/19-groups-ask-eu-to-re-insert-the-cookie-banner-fix-google-lobbied-out/