Digital Omnibus Cookies: What the Council Agreed in October

The Digital Omnibus is the EU's plan to simplify a long list of digital laws, and one part of it rewrites the cookie rules that put a consent banner on almost every European online shop. On 21 October 2026 the Council agreed its position, including new purposes for which cookies and similar technologies would need no consent, and it is tempting to read that as the end of banners for analytics. It is not law yet, and for an online store nothing changes today.

The short answer: nothing changes yet, and Arktis belongs in your consent setup

The Digital Omnibus cookie changes are a proposal under negotiation, not law. On 21 October 2026 the Council agreed its negotiating mandate, which keeps the cookie rule in the ePrivacy Directive, lists six purposes that would need no consent, among them anonymous aggregated audience measurement, and requires a single-click way to refuse plus a pause of at least four months before asking again. The European Parliament has not adopted its own position, the two institutions then have to agree one text, and under the Council's version member states would have 24 months after adoption to apply it. Until then Article 5(3) of the ePrivacy Directive applies as it stands.

For an online store that wants to know which ads and campaigns brought its orders, Arktis is the clear winner, because it is designed to run inside your consent setup today rather than to rely on an exemption that is not yet law. Its tracker captures ad click identifiers and UTM tags on landing and holds them on the server against the visitor, and its session recordings are uploaded only after consent. Plans are $49, $149 and $349 a month, with a 7-day free trial on Growth.

Key takeaways

The Council's position is one side of a negotiation. It would let a website measure its audience without consent if it produces anonymous aggregated information and the data collected for that purpose are not reused for another purpose, shared with third parties or combined with third-party data, and it would let visitors refuse in one click and be left alone for at least four months. It drops the Commission's plan to make websites honour consent signals sent by the browser. Parliament's committees have not voted, so the final text, and the date it applies, are unknown. Marketing attribution that keeps an identifier per visitor and matches orders to ad clicks does more than anonymous aggregate counting, so a store should plan on asking for consent for it.

What the Commission proposed in November 2025

The Commission published the Digital Omnibus, COM(2025) 837, on 19 November 2025 as a single regulation amending the GDPR, the ePrivacy Directive and several data laws. For cookies, it moved the rule on storing or reading personal data on a person's device out of the ePrivacy Directive and into the GDPR as a new Article 88a.

Consent would have stayed the rule, with four exceptions: transmitting a communication, providing a service the person explicitly requested, creating aggregated information about the use of an online service to measure its audience where the controller does it solely for its own use, and keeping a requested service or the device secure. Visitors would have to be able to refuse with a single click or equivalent means, and a controller could not ask again for the same purpose for at least six months after a refusal.

A separate Article 88b would have required websites to accept consent and refusals sent as automated, machine-readable signals, 24 months after entry into force, with media service providers exempt. Browser providers that are not SMEs would have had to offer the means to send those signals, 48 months after entry into force.

What the Council agreed on 21 October 2026

Member states' permanent representatives agreed the Council's mandate for negotiations with Parliament on 21 October 2026, and the Council published the text, document 14756/26, the next day. Its press release says the mandate "maintains the rules on cookies and other kinds of online tracking technologies" under the ePrivacy Directive, while adding purposes that need no consent so that visitors see fewer banners.

In the text, the Council deleted Articles 88a and 88b from the GDPR amendments and rewrote Article 5(3) of the ePrivacy Directive instead. Storing or reading information on a subscriber's or user's device would still need consent, given in line with the GDPR, unless one of the listed purposes applies.

Six purposes that would need no consent

The rewritten Article 5(3) lists six purposes, and the storage or access must be solely related to and strictly necessary for one of them. The first is transmitting a communication over a network. The second is providing a service, including its functionality, that the user explicitly requested; the recitals give language settings and items in a shopping basket as examples. The third is creating anonymous aggregated information about the use of an online service to measure its audience, done by the provider or by a third party on its behalf, where the data collected for that purpose are not processed for another purpose, shared with third parties or combined with data from third parties. The fourth is audience measurement for media under Article 24 of the European Media Freedom Act, with personal data pseudonymised after collection. The fifth is security of the service or the device. The sixth is measuring the display and performance of contextual advertising, based only on the content on screen or a single search query, without personal data, profiling or any use of the visitor's past or future activity, including activity across sites.

Refusal in one click, and four months before asking again

Visitors would have to be able to refuse a consent request easily, with a single-click button or equivalent means. After a refusal, the provider could not ask again for the same purpose for at least four months. The recitals allow a new request within that period if the purpose changes, or if the cookie recording the choice is no longer valid for reasons outside the provider's control, such as the visitor deleting cookies.

No duty to honour browser signals

The Council struck out the whole of the Commission's Article 88b, including the duty on websites to respect machine-readable choices and the duty on browser makers to offer them.

Two years for member states

Because the rule would stay in a directive, it would take effect through national law. The Council text gives member states 24 months after adoption to adopt and publish their implementing measures and to apply them, where the Commission's Article 88a would have applied directly six months after entry into force.

What Parliament still has to do

On 26 October 2026, Parliament's Legislative Observatory listed procedure 2025/0360(COD) as awaiting committee decision. The file sits with a joint committee of Industry, Research and Energy (ITRE) and Civil Liberties, Justice and Home Affairs (LIBE), with Aura Salla and Marina Kaljurand appointed as rapporteurs on 25 February 2026. A draft report dated 22 June 2026 and amendments tabled in committee on 27 July 2026 are on file. No committee vote is listed.

After the committees vote and Parliament settles its position, the Council presidency will start negotiations with Parliament, as the Council's press release says. Any agreement must then be formally adopted by both institutions, and under the Council's text the 24 months for member states run from adoption. The 'One Europe, One Market' roadmap signed on 24 April 2026 sets an objective of concluding all simplification packages by the end of 2027; that is a political aim, not a legal deadline. Parliament's position may differ on any of the provisions above, including the purposes, the four-month pause and the browser signals.

Would store analytics fit the audience measurement exemption?

This is our reading, not legal advice. The Council's third purpose is narrow. The recitals say providers should be able to learn about the use of their service at an aggregated level without analysing individual user behaviour, that the aggregated data should not relate to a specific person, and that it should not be combined with other data such as analytics information from other websites. Counting visits, popular pages and devices to improve a site fits that description.

Marketing attribution usually does more. It keeps an identifier per browser so that visits can be linked over time, records which ad click brought a visitor, matches orders to visits, and sometimes records sessions. We do not read the Council text as covering that, and the sixth purpose covers only contextual advertising without profiling, which excludes click-based attribution by definition. A store should expect attribution and session recording to need consent under any version of the text published so far.

What changes for an online store today

Nothing. Article 5(3) of the ePrivacy Directive, as amended in 2009, still allows storing or reading information on a visitor's device only with consent after clear and comprehensive information, unless it is purely to transmit a communication or strictly necessary for a service the visitor explicitly requested. National regulators apply it, and their readings differ; our guide to first-party cookies covers how individual regulators, and the UK's separate rules, treat analytics cookies.

The rule is not limited to cookies. The European Data Protection Board's Article 5(3) guidelines, adopted on 7 October 2024, list local storage alongside cookies and say that information kept there is caught once it, or anything derived from it, is accessed rather than staying on the device.

So keep your consent platform, list every script that stores or reads anything in the visitor's browser, and make sure each one waits for the consent it needs. Do not rebuild your banner around a four-month pause or a consent-free analytics category until the final text is adopted. Our guide to consent management for analytics covers the setup.

How Arktis handles consent and storage

Here is precisely what the Arktis tracker does. It keeps its visitor and session identifiers in local storage from the first page view and sends pageviews before consent, marked as not consented. It sets its own cookies only after consent. Session recordings, on the Growth and Scale plans, are buffered in the visitor's browser and uploaded only after consent; without consent the buffer is discarded. The server does not check consent, so what is collected before consent is decided by the tracker in the browser and by when your site loads it.

Because the EDPB treats local storage like cookies, Arktis is neither cookieless nor consent-free in the EU, and it belongs in your consent setup like any analytics script. If your counsel wants nothing stored or sent before consent, have your consent platform load the script only after the visitor agrees. The tracker also honours Global Privacy Control by default, which our Global Privacy Control guide describes.

Where Arktis does not fit

Arktis is not a consent management platform. It does not show a banner, manage consent for your other tags, enforce a four-month pause or decide your legal basis, so you still need a consent tool and advice on how the rules apply to you. If your goal is a consent-free audience count under a future exemption, a tool that only produces anonymous aggregate statistics is a better match for that wording than any attribution tool, Arktis included, at the cost of not knowing which ads produced orders. Arktis identifies visitors per browser and does not join one person across devices, so a visitor who refuses on a phone and accepts on a laptop is two visitors.

Measure inside the rules you have today

To see which campaigns brought your orders while consent stays in your hands, start the 7-day Growth trial, or compare plans on the pricing page. For the wider picture, read our guides to GDPR compliant analytics and session recording under the GDPR.

Sources

Council of the EU: Council agrees position to simplify data protection, privacy and cyber reporting rules, the 21 October 2026 position, cookie rules kept in the ePrivacy Directive, next steps and the 2027 objective, accessed 26 October 2026

Council of the EU: Digital Omnibus mandate for negotiations, document 14756/26, agreed by Coreper on 21 October 2026, rewritten Article 5(3), the six purposes, single-click refusal, four-month pause, deletion of Articles 88a and 88b, 24-month transposition, accessed 26 October 2026

European Commission: Digital Omnibus proposal, COM(2025) 837, proposed Articles 88a and 88b, the six-month pause and browser signal timings, published 19 November 2025

European Parliament Legislative Observatory: procedure file 2025/0360(COD), status, committees, rapporteurs, draft report and amendments, accessed 26 October 2026

EUR-Lex: Directive 2002/58/EC, consolidated text, the current wording of Article 5(3), accessed 26 October 2026

European Data Protection Board: Guidelines 2/2023 on the technical scope of Article 5(3), version 2.0, local storage and similar technologies, adopted 7 October 2024