{"page":"/blog/eu-digital-omnibus-tracker","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Issue","Law today","Commission proposal, 19 November 2025","Council mandate, 21 October 2026","Parliament, 9 November 2026"],"rows":[["Where the device-access rule sits","ePrivacy Article 5(3) (EUR-Lex)","New Article 88a GDPR for personal data of natural persons; Article 5(3) disapplied there","Rewritten ePrivacy Article 5(3); Articles 88a and 88b struck (pp. 143 to 145, 156)","No position (OEIL)"],["Consent exemptions","Two: transmission; strictly necessary for a requested service","Four: transmission; requested service; aggregated audience measurement by the controller \"solely for its own use\"; security","Six, each \"solely related to and strictly necessary for\" the purpose: transmission; requested service and its functionality; anonymous aggregated audience measurement; media audience measurement under EMFA Article 24; technical security; contextual ad measurement (p. 157)","No position"],["Audience measurement by a vendor","Not exempt in the Directive text","Controller only, for its own use","A third party may measure \"on behalf of\" the provider; data not shared, combined or reused (p. 157)","No position"],["Contextual ad measurement and frequency capping","Not exempt","Not exempt","Exempt if the ad uses only the page or a single search query, with no profiling, no past or future activity, and pseudonymised data (p. 157); recital names \"capping cookies\" (p. 48)","No position"],["Refusal and re-ask","Not specified in Article 5(3)","Single-click refusal; no new request for 6 months after a refusal","Single-click refusal; no new request for at least 4 months (p. 158)","No position"],["Browser and machine-readable signals","None","Article 88b: controllers honour signals after 24 months; non-SME browsers support them after 48 months; media service providers exempt","Deleted (p. 145)","No amendment in the draft report (PE786.818)"],["Legitimate interest after exempt access","GDPR Article 6 applies to later processing","Exempt access \"and subsequent processing\" lawful for the listed purposes","Later processing for other purposes needs an Article 6 basis; a recital sets limits for legitimate interest, such as no monitoring of large parts of online activity (p. 49)","No position"],["AI training and operation","No specific article; a legal basis under Article 6 GDPR is needed","Article 88c: legitimate interest \"where appropriate\", with safeguards including \"an unconditional right to object\"","Article 88 bis: legitimate interest under Article 6(1)(f), with the Article 21 right to object; the unconditional right is struck (pp. 145 to 146)","No amendment in the draft report"],["Definition of personal data","Article 4(1), read with the case law","Adds entity-relative sentences to Article 4(1)","Article 4(1) sentences struck (p. 131); new Article 25a: pseudonymised data is not personal data for a third party unable to identify the person (p. 140)","No amendment in the draft report"],["Who enforces cookie rules","National authority chosen by each member state","GDPR authorities, for cases moved into Article 88a","GDPR supervisory authority for Article 5(3) (p. 158)","No position"],["When the cookie rules would apply","In force","6 months after entry into force (Article 88a)","National laws apply 24 months after adoption (p. 158)","No position"]],"sourceUrls":[["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219","https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0360%28COD%29"],[],[],[],[],["https://www.europarl.europa.eu/doceo/document/CJ72-PR-786818_EN.html"],[],[],[],[],[]]}