The EU Digital Omnibus: New Cookie and GDPR Rules

Brussels spent five years adding digital rules. Now it is trying to take some back. The Digital Omnibus is the European Commission's attempt to thin out the overlap between the GDPR, the ePrivacy Directive, NIS2, DORA, the Data Act and the AI Act, and for most businesses the headline is the part that touches every website you run: the cookie banner is finally getting rewritten.

That matters because the current consent regime pleases almost nobody. Users reflexively click to make the wall go away, so the "consent" is theatre. Companies pay for banner tooling and legal review to collect a signal that means very little. The Omnibus tries to fix both ends at once. Before you act on any of it, though, keep one distinction straight: parts of this package are now law, and the parts that change your cookie banner are still a proposal.

What is actually decided, and what is not

There are two moving pieces and they are on very different timelines.

• The AI package is done. The Council adopted it on 29 June 2026, with publication in the Official Journal expected in July. Its main effect is to push the AI Act's high-risk obligations back by up to 16 months, tied to when the supporting technical standards are ready. We covered what that delay means in the EU AI Act delay guide.
• The data package is still being negotiated. The changes to GDPR, ePrivacy and cookies sit in the second track, and that one is not expected to be finalised before late 2026 at the earliest. So the cookie rules below are the direction of travel, not something you must comply with tomorrow.

The cookie changes that would hit every site

If the data package lands roughly as drafted, four things change how consent works on your pages.

• One click to reject, as easy as accepting. Accept and reject must sit at equal prominence, so the dark pattern of a bright "Accept all" button next to a buried "Manage preferences" link stops being legal.
• No nagging for six months. Once a visitor declines, you cannot re-ask for the same consent for six months. The endless re-prompt on every visit goes away.
• Browser-level signals you must honour. If a user sets a preference in their browser, the site has to respect it, which means far fewer people ever see a banner at all.
• Cookies move under the GDPR. The consent rules shift out of the old ePrivacy Directive and into the GDPR itself, which should mean one coherent rulebook instead of two that half-overlap.

The practical read: fewer banners, and the ones that remain have to be genuinely fair. For a business that has been treating the banner as a compliance formality, this is a nudge to treat consent as a real part of the user experience.

The quieter change that helps engineering teams

Buried in the same package is a reform that does not touch your front end but saves real time: a single portal for incident reporting. Right now a serious breach can trigger separate, differently-worded notifications under the GDPR, NIS2 and DORA, each with its own clock. The Omnibus proposes to collapse those into one channel. If your business falls under overlapping regimes, that is a meaningful reduction in the compliance choreography during exactly the moment you least want it, a live incident. It pairs with the direction we described in the EU Cyber Resilience Act guide.

There is also a subtler shift in what counts as personal data. The proposal codifies a more "relative" definition: information is personal data only if the party holding it can realistically identify the person with the means available to it. That sounds academic, but it changes how you classify pseudonymised analytics and logs, and it is worth a look if your data model has been treating everything as regulated by default.

What to do now

Nothing here demands a scramble, but three moves make sense while the text settles.

1. Audit your current banner honestly. If reject is harder than accept, you likely already have a problem under existing guidance, never mind the reform. Fix that now.
2. Reduce what you actually set. The less you depend on third-party tracking, the less any of this constrains you. Moving to first-party, privacy-first analytics shrinks your banner and your risk at the same time.
3. Build consent so it can change. Keep the logic that decides what loads separate from the banner UI, so when the final rules land you adjust a config, not a rebuild. That is ordinary good architecture, the same discipline behind a maintainable Next.js site.

The bottom line

The Digital Omnibus is genuinely good news for anyone tired of the consent circus, but it arrives in two speeds: the AI timeline is settled, the cookie rules are still in motion. Plan for a world with fewer, fairer banners and lighter breach reporting, and use the runway to cut your dependence on third-party tracking so the final text barely affects you. If you want your site's consent and analytics set up to adapt instead of break, tell us how your stack looks today and we will map the smallest change that gets you there.