EU member states finally have a position on the Digital Omnibus. On 21 October the Council agreed its negotiating mandate for the package that amends the GDPR, the ePrivacy Directive and the EU's cyber incident-reporting rules, after months in which the file had no agreed text among the 27 governments at all.
It is not law. The mandate is the instruction set the Irish presidency will carry into negotiations with the European Parliament, which has not yet adopted its own position. Nothing changes today for a website owner or a data protection officer. What the text does show is where member states have drawn the line, and in several places that line sits closer to the GDPR as written than the Commission wanted.
What the mandate actually covers
Omnibus VII is part of the simplification agenda the Commission has run since February 2025. Its AI half is already law, adopted on 29 June. This is the data and privacy half:
- GDPR. Keeps the current definition of personal data, adds a provision on pseudonymisation and when a person can be identified, defines "scientific research" in principle terms with targeted exemptions, and backs a longer deadline for notifying data breaches.
- Cookies. Keeps the rules in the ePrivacy Directive rather than moving them into the GDPR, and adds purposes that need no consent.
- Sensitive data and AI. Adds safeguards to the proposed derogation allowing sensitive data to be processed for biometric verification and in the development and operation of AI systems.
- The data acquis. Consolidates data altruism, data intermediation and open-data rules, repeals provisions of the P2B regulation, lets public bodies charge more for re-use by very large companies and gatekeepers, and tightens protection against trade secrets leaking to third countries.
- Incident reporting. Replaces the Commission's single EU portal with a national entry point in each member state, plus an EU-level information point.
The definition of personal data survived
This was the fight. The Commission's November 2025 proposal would have rewritten Article 4(1) so data does not necessarily count as personal even where it could be used to identify someone. Member states rejected that in February and held the line.
The EU's own regulators objected too. In a joint opinion, the European Data Protection Board and the European Data Protection Supervisor warned the change would undercut protection for pseudonymised data. EDPS Wojciech Wiewiórowski noted that, if passed, it "would significantly narrow the concept of personal data".
Pseudonymised data therefore stays inside the GDPR's scope — which matters for every company whose compliance story rests on hashing identifiers and calling the result anonymous.
Cookies: fewer banners, not no banners
The Council's most visible move is on consent fatigue, and it is smaller than the Commission's. The executive wanted browser-level "privacy signals": store your choices once, transmit them automatically, skip the banner. According to Rapporteur, which saw the final compromise text, the Council removed that proposal entirely.
What survives is a longer list of purposes where consent is not needed: cookies necessary to provide a service the user asked for, audience measurement, and ensuring the security of the device.
The detail matters more than the headline. The mandate's recitals limit audience measurement to anonymous, aggregated information about use of a service, produced by the provider or someone acting on its behalf, not reused for another purpose and not combined with data from other services or third parties. Media audience measurement is allowed separately, if the data is pseudonymised and the reports contain no personal data.
Advertising and cross-site profiling are not on the list. This is not "analytics without a banner", still less "tracking without one". A first-party page count fits the exemption; a multi-site advertising profile does not.
AI training gets a clearer legal basis, with conditions
The mandate keeps a clarification on the lawful ground for processing personal data in AI development and operation, surrounded by safeguards, and adds protections around sensitive data used for biometric verification.
Digital rights groups read that differently. EDRi argues that a specific legitimate-interest rule for AI risks creating a presumption that large-scale data reuse is acceptable, and that "simplification should strengthen rights, not dilute them". noyb called the package the biggest attack on privacy rights in years. Neither objection stopped it.
One entry point per country for incidents
A serious incident can trigger reporting under NIS2, the GDPR and DORA on separate clocks. The Commission proposed a single EU portal. Member states said no, preferring a national entry point per country, with an EU-level information point and provisions for cross-border notifications on top.
The trade-off is real. National portals respect how each country implemented the underlying laws. For a company operating in a dozen countries, "one form" becomes "one form per country" — better than three forms, short of what the Commission sold.
What happens next
The European Parliament still has no position. LIBE and ITRE are handling the file jointly, and MEPs have asked Parliament's research service for an impact assessment, expected in the coming weeks. Once Parliament votes, trilogues begin. The One Europe, One Market roadmap sets the end of 2027 as the target for finishing all simplification packages.
Until then, treat claims that EU cookie rules have changed as premature, including the ones from vendors selling consent tools.
This post will be updated when the European Parliament adopts its position.
No comments yet