MeanCEO: Tech Startups and Startup Ideas

The EU's Cookie Banner Fix Is Stuck: Digital Omnibus Stalls as France and Germany Block the Vote

TL;DR: what happened to the EU's cookie and GDPR simplification?

The Digital Omnibus, the EU package meant to cut cookie banners and simplify the GDPR and the Data Act, is stuck. EU ambassadors were due to vote on the Council's position on 7 October 2026; Germany and France pushed it back, and on 11 October the text "wasn't even discussed". The latest Council draft would let websites ask for cookie consent again after 4 months instead of 6 and exempt some ad measurement from consent, but it also drops the Commission's plan to make sites respect browser-level choices. None of this is law. Until it is, your cookie banner and GDPR duties stay exactly as they are.
Every founder with a website has asked the same question: when do the cookie banners go away? A year ago, the European Commission promised relief. This month, the member states couldn't even agree to discuss it.
Here's where the EU's Digital Omnibus stands, what's on the table for cookies and GDPR, and what it means for your site today.

What happened this week

The Irish presidency of the EU Council wanted ambassadors (Coreper) to approve the Council's negotiating position on 7 October. France and Germany pushed the vote back to Sunday 11 October, Agence Europe reported. Their main concern is the Data Act: Berlin wants an "explicit agreement" before data protected as a trade secret can be shared.
On 11 October, the text "wasn't even discussed – or voted on", according to Agence Europe. No new date has been set, and the presidency may consult delegations again. EU leaders had asked in March for all the simplification packages to be agreed by the end of 2026.

What the Commission proposed

The Commission presented the Digital Omnibus on 19 November 2025 (COM(2025) 837), claiming up to €5 billion in administrative savings by 2029. According to its Q&A, the main changes for small companies were:
  • Cookies: one-click refusal, choices respected for at least six months, browser or device settings that websites must respect, and no consent needed for low-risk uses such as counting visits. Cookie rules would move from the ePrivacy Directive into the GDPR.
  • GDPR: a narrower definition of personal data, codifying a Court of Justice ruling that data isn't personal for a recipient who can't re-identify the person; AI training allowed under legitimate interest; clearer rules on impact assessments and breach notifications.
  • One reporting point: a single entry point, run by ENISA, for incident reports under NIS2, the GDPR, DORA and other laws.
  • Data Act: four data laws merged into the Data Act, cloud-switching exemptions for SMEs and small mid-caps, and stronger trade-secret protection.
The AI Act part of the package was split off, agreed and entered into force on 27 July 2026, delaying the high-risk AI rules. The GDPR, cookie and Data Act parts are the ones now stuck.

What the Council draft would change for cookies

A leaked 163-page Council draft dated 2 October 2026 (document 13886/26), reported by PPC Land, rewrites the cookie part. It's friendlier to advertisers in some ways and weaker for users in others:
TopicRules todayCommission proposal (Nov 2025)Council draft (2 Oct 2026)
Where cookie rules liveePrivacy Directive, art. 5(3)Moved into the GDPRStay in ePrivacy
Asking again after a refusalNo EU-wide ruleRespect refusal for at least 6 monthsMay ask again after 4 months
Browser-level consent signalsNo duty to follow themSites must respect themDuty dropped
Consent exemptionsStrictly necessary onlyLow-risk uses such as visit countsSix exemptions, incl. contextual ad measurement
Who enforcesVaries by countryData protection authoritiesData protection authorities
Germany has also proposed a category of "low-risk data controllers" that would exempt small companies and non-profits from many GDPR duties. That idea is in discussion, not in any agreed text.

The criticism

The GDPR changes are controversial. In a joint opinion in February 2026, the EU's data protection authorities, the EDPB and the EDPS, "strongly urge" lawmakers not to change the definition of personal data, saying it would go far beyond a technical amendment. Privacy group noyb has also attacked the definition change and the limits on the right of access, and 19 organisations wrote in September asking for the browser-signal rule to be restored.
In the European Parliament, the file sits with a joint committee of ITRE and LIBE, with rapporteurs Aura Salla (EPP) and Marina Kaljurand (S&D). It is still awaiting a committee vote.

What this means for you

  1. Change nothing yet. The current ePrivacy and GDPR rules apply in full. Don't plan around the "4 months" rule or a consent-free analytics exemption until a final law is published.
  2. Fix your banner now. The EDPB's guidance is clear: no cookie walls, scrolling isn't consent, and refusing must be as easy as accepting. Tracking pixels count too. See cookie consent and website compliance.
  3. Use privacy-friendly analytics. Cookieless or first-party analytics reduce how much consent you need today and are likely to fit whatever the final rules say.
  4. Keep your GDPR basics in order. Breach reports within 72 hours, records of processing, a clear privacy notice. Start with our GDPR compliance guide for early-stage startups and the GDPR checklist.
  5. Watch December. If the Council agrees its position before the end of the year, negotiations with the Parliament can start in 2027. In our view, final rules are unlikely before late 2027.
For more EU and startup news this month, see European startup news for October 2026.
Are you getting customers from ChatGPT yet?

More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.

👉 Rank on ChatGPT

FAQ: the EU Digital Omnibus

What is the EU Digital Omnibus?

A package proposed by the European Commission on 19 November 2025 to simplify EU digital rules, including the GDPR, cookie consent rules, the Data Act and incident reporting. The AI Act part has already been adopted.

Are cookie banners going away?

Not yet. The proposals would reduce some consent requests, for example for visit counting, but nothing has been adopted. The current consent rules still apply.

What is the 4-month cookie rule?

A Council draft of 2 October 2026 would let websites ask again for consent 4 months after a user refuses. The Commission had proposed respecting refusals for at least 6 months. It isn't law.

Why did the Digital Omnibus stall?

France and Germany delayed the Council vote, mainly over trade-secret protection in the Data Act. On 11 October 2026 the text wasn't discussed at all, and no new date was set.

Will the GDPR definition of personal data change?

The Commission proposed narrowing it, but the EDPB and EDPS strongly oppose the change. It depends on the final negotiations.

When will the new rules apply?

Not before the Council and Parliament agree. EU leaders want agreement on the simplification packages by the end of 2026, but in our view the final rules are unlikely before late 2027.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
2026-10-13 18:44 News and Trends