Cookie Consent under the Digital Omnibus: Planned Changes and Technical Implementation

For years, cookie banners have been an integral part of almost every online service, without reliably achieving their goal of an informed and self-determined decision by users in practice. Legally, the consent requirement is based on Art. 5(3) of the ePrivacy Directive and its implementation in Section 25 TDDDG, whose relationship to the GDPR has long confronted companies with questions of demarcation. With the Digital Omnibus, the EU Commission now proposes to reorganise the cookie rules, create additional exemptions from the consent requirement and, for the first time, expressly regulate the design of consent requests. Following the Council's agreement on 21 October 2026, the European Parliament has yet to adopt its position, so entry into force is not expected before 2027. This article outlines the current legal framework, explains the planned changes and shows how companies can prepare technically for the new requirements.

I. Current Legal Framework

Under EU law, the setting of cookies and comparable access to terminal equipment is governed by Art. 5(3) ePrivacy Directive, implemented in Germany by Section 25 TDDDG. Such operations generally require the user's consent, regardless of whether personal data is processed. The only exceptions are the transmission of a communication and access that is strictly necessary to provide a service explicitly requested by the user, for example for shopping carts, logins or language settings. If personal data is subsequently processed, a legal basis under the GDPR is additionally required. Under this two-tier system, audience measurement, analytics tools and advertising technologies regularly require consent in practice.

The requirements for consent under Section 25 TDDDG are also governed by the GDPR. Consent must be given freely, on an informed basis and unambiguously. According to the case law of the Court of Justice of the European Union (CJEU), pre-ticked boxes are not sufficient. In addition, companies must be able to demonstrate that valid consent has been given, which requires appropriate logging. For the design of cookie banners, the German Data Protection Conference (DSK) and the courts require that refusing consent be as easy as giving it. If the user can consent with one click on the first layer, they must therefore also be able to refuse there with one click.

Advertising-funded services frequently rely on so-called pay-or-okay models, in which users choose between consenting to advertising-related tracking and paid access without tracking. The DSK generally considers such models permissible, provided that the paid offering constitutes an equivalent alternative at a reasonable price. The European Data Protection Board (EDPB) has formulated stricter standards for large online platforms.

Approaches to centralised consent management have not gained traction so far. The Consent Management Ordinance (EinwV), in force since April 2025, does allow the recognition of services through which users can store their decisions centrally, but providers of digital services are not obliged to take these into account. For companies, the coexistence of ePrivacy law and the GDPR, with different legal bases and demarcation issues, therefore remains. This coexistence is the starting point for the reform considerations at European level.

II. Planned Changes under the Digital Omnibus

1. The Commission's Proposal

The core of the Commission's proposal of 19 November 2025 is the transfer of the cookie rules into the GDPR (as we reported in Data Protection Update No. 266). Under the new Art. 88a GDPR in the draft version (GDPR-D), access to terminal equipment would in future be assessed under the GDPR insofar as personal data is concerned. Art. 5(3) ePrivacy Directive would remain applicable only to non-personal data. The draft retains the principle of consent but extends the catalogue of exemptions. In addition to the existing cases, aggregated audience measurement by the provider of a service for its own purposes and access to ensure the security of the service or the terminal equipment are to be permitted without consent.Nr. 266

In addition, Art. 88a GDPR-D contains, for the first time, express requirements for the design of consent requests. Users are to be able to refuse consent with a single click. Following a refusal, the provider would not be permitted to request consent again for the same purpose for six months. Likewise, no new request is to be made while a consent given remains valid.

Art. 88b GDPR-D went further. Under it, users would have been able to set their consent decisions centrally via browser settings, and providers would have been obliged to respect these automated signals. A period of 24 months was envisaged for technical implementation. Media services were to be exempt from this obligation so that they could make their own consent requests to their users.

2. Developments in the Council

In the Council, the proposals changed considerably over the course of 2026. According to the compromise texts made public so far, the transfer into the GDPR is not to take place. Instead, the cookie rules would be amended directly in Art. 5(3) ePrivacy Directive and would thus remain anchored in ePrivacy law. The obligation to respect browser signals was already deleted in June 2026.

By contrast, the Council has essentially retained, and in part extended, the substantive relief. According to a Council text that became public in April 2026, the exemption for audience measurement was also to cover measurement by commissioned third parties, provided that the data is aggregated and anonymised. In addition, an exemption for contextual advertising was included, in line with a demand by the EDPB and the EDPS. The current Council text from October 2026 also shortens the waiting period after a refusal from six to four months and provides for a further exemption for measuring contextual advertising, including limiting ad repetitions (frequency capping). A new request is to be possible before the period expires if the purpose changes or the user has deleted their cookies. On 21 October 2026, the Council adopted its position. The European Parliament, however, has yet to adopt its position.

III. Recommendations for Companies

As the final shape of the new rules is still open, companies should first implement the measures already required under current law and align their technical infrastructure so that future changes can be reflected through configuration rather than new development. The starting point should be an inventory of all cookies, pixels, SDKs and comparable technologies in use at the level of individual tags. Each element should be assigned to a specific purpose and categorised according to whether it is technically necessary, serves security, or relates to audience measurement, contextual advertising or behavioural advertising. This makes it possible, once the new rules enter into force, to remove services selectively from the consent request insofar as they fall under one of the extended exemptions.

In consent management, it should be possible to refuse with one click on the first layer of the banner, which already reflects supervisory practice. Consents and refusals should also be logged with a timestamp, purpose reference and version of the request. This serves as evidence of valid consent and at the same time provides the technical basis for a future waiting period. The consent management platform should be configured so that the period until a new request can be set as a parameter and requests for new purposes or service providers can be triggered separately. Since the length of the waiting period differs between the Commission and the Council, the implementation can thus be adapted to the outcome of the procedure without further development effort.

Finally, companies should keep an eye on open issues. Even though the Council has deleted the obligation to respect browser signals, the European Parliament could reintroduce corresponding requirements. When selecting a consent management platform, it may therefore be advisable to ensure that it can process technical preference signals. Providers with pay-or-okay models should examine at an early stage how a one-click refusal can be reflected in their access model. Overall, it is advisable to review the classification of the technologies used regularly and to adapt it to the progress of the legislative procedure.

IV. Conclusion and Outlook

The Digital Omnibus is unlikely to fundamentally reorganise the cookie rules, but it will noticeably change how they are applied. Based on the current status in the Council, the originally envisaged transfer into the GDPR and the obligation to respect browser signals are unlikely to be implemented. Extended exemptions from the consent requirement and express requirements for the design of consent requests can, however, be expected. Cookie banners will therefore remain necessary in future, but may be limited to a smaller range of technologies.

In the further procedure, the European Parliament must now adopt its position before trilogue negotiations with the Council can begin. The aim is for all simplification packages to be concluded by the end of 2027. Whether this timetable can be met remains open. Until the new rules enter into force, the current requirements continue to apply. Companies that already structure their consent management cleanly and configure it flexibly should be able to implement the changes with manageable effort.

This article was created in collaboration with our student employee Emily Bernklau.