Digital Omnibus Cookie Rules: Consent-Free Uses and the 4-Month Re-Ask Wait

If you run a website or app in the EU, nothing changes yet: keep your current consent banner and keep asking for consent. On 21 October 2026 the Council of the EU agreed its negotiating position on the Digital Omnibus, the package that rewrites parts of the GDPR and the cookie rules. The European Parliament still has to adopt its own position before the two sides negotiate a final text. What the Council text does show is where the rules are heading: a short list of uses that would no longer need consent, a four-month wait before asking again after a refusal, and no obligation to honour browser consent signals.

Digital Omnibus Cookie Rules: Consent-Free Uses and the 4-Month Re-Ask Wait

Council position at a glance

Topic	European Commission proposal (November 2025)	Council position (October 2026)
Where the cookie rules sit	Moved into the GDPR (new Articles 88a and 88b)	Kept in Article 5(3) of the ePrivacy Directive
Default rule	Consent needed to store or read data on a device	Unchanged: consent stays the default
Uses without consent	A short list of exemptions	A closed list of six purposes, including first-party audience measurement and contextual ad measurement
Refusing	Easy refusal	A single-click button or equivalent means
Asking again after a refusal	Not before six months	Not before four months, for the same purpose
Browser consent signals	Sites must honour automated, machine-readable signals	Deleted
Supervision	GDPR authorities	GDPR authorities

The mandate was agreed by EU ambassadors on 21 October and circulated as Council document 14756/26 on 22 October. The Council's press release confirms the headline points: the ePrivacy Directive stays the framework for cookies, and consent would not be needed for cookies used to supply a service, measure audiences or protect a device.

Cookie rules stay in the ePrivacy Directive

The Commission wanted to move the cookie rules into the GDPR. The Council reversed that and kept them in a rewritten Article 5(3) of the ePrivacy Directive. For site owners the practical effect is small: consent is still the default for anything that stores or reads information on a user's device, including cookies, local storage, pixels and fingerprinting. One change is worth noting. Enforcement would move to the data protection authorities that already supervise the GDPR. In some member states that is a different regulator from the one handling cookies today.

Six uses that would not need consent

The Council text lists six purposes that would be exempt from consent. Each comes with conditions:

1. Transmission. Carrying a communication over a network.
2. A service the user asked for. Providing a service, "including its functionality", that the user explicitly requested. Shopping baskets, logins and language settings fall here.
3. First-party audience measurement. Creating anonymous, aggregated statistics about how your own service is used. The data cannot be used for another purpose, shared with third parties or combined with third-party data. A processor can do this on your behalf.
4. Media audience measurement. Measurement under Article 24 of the European Media Freedom Act, with personal data pseudonymised after collection and no tracking outside the measured service.
5. Technical security. Maintaining or restoring the security of what is strictly needed to provide the service.
6. Contextual ad measurement. Measuring the display and performance of ads chosen only from the content on screen during a single visit or a single search. It cannot involve profiling or data about a user's past or future activity, and data must be pseudonymised after collection.

The list is closed. Personalised advertising, retargeting, third-party analytics that combine data across sites, and building user profiles all still need consent. So does most of what runs through the IAB TCF.

A four-month wait before asking again

If a user refuses, the Council text says the provider "shall not make a new request for consent for the same purpose for a period of at least four months". The Commission had proposed six months. Refusal also has to be possible with a single-click button or equivalent, which matches what most regulators already expect from a Reject All button.

Two details matter for how this would work in practice. The wait applies per purpose, so a refusal of analytics does not block a later request for a different purpose. And it applies to "a new request", so a site that changes its banner and re-prompts everyone would also be re-prompting people who refused recently.

Browser consent signals were dropped

The Commission's Article 88b would have required sites to honour automated, machine-readable consent and refusal signals sent by browsers. The Council deleted it along with Article 88a. Under the Council text a consent decision stays between the user and each site, recorded by the site's consent management platform. This is a different direction from California, where AB 566 requires browsers to offer an opt-out preference signal from 1 January 2027.

What the Council text does not settle

• The TCF and vendors. The text says nothing about consent management platforms or the IAB TCF. It does not say how a vendor embedded on your page would show that it relies on one of the six exemptions, or how an exemption would be signalled in a TC string. Until that is clear, keep collecting consent for TCF vendors as you do today. See IAB TCF 2.4 and how to check your vendors.
• What "performance" means in contextual ad measurement. It is not defined.
• Timing. The text gives member states 24 months after adoption to transpose the rules, but another provision would apply the ePrivacy changes six months after publication in the Official Journal. The negotiations will have to settle which. Parliament's committee vote is expected in early 2027, so a final text is unlikely before then.

What to do now

Nothing in the Council text is law, and today's rules still apply: consent before non-essential cookies, refusal as easy as acceptance, and proof of every choice. A few steps will make the switch easier if the final text looks like this one:

• Map your cookies to purposes. Know which tags would fall under the six exemptions and which would still need consent. A cookie scan is the quickest way to get the list.
• Keep refusal records with a timestamp and purpose. A four-month rule can only be applied if you know when each user refused and what they refused. UniConsent Consent Logging records every consent and refusal event, so you can show when a choice was made.
• Plan banner changes. In UniConsent a Config Version change re-prompts every returning user, and the Re-consent Interval (up to 150 days) controls how often vendor list updates bring the banner back. If a four-month rule becomes law, these are the settings you would adjust.
• Don't drop consent for analytics yet. First-party, aggregated measurement may become exempt, but the conditions are strict and nothing applies until the final text is adopted and in force.

UniConsent is a Google-certified CMP and IAB TCF registered CMP (ID 68). It follows these changes for you and updates the banner, purposes and logs when the rules are final. Start a free trial to check your setup today.

FAQ

What is the Digital Omnibus? A package of EU proposals published by the European Commission in November 2025 to simplify digital rules. It changes parts of the GDPR, the ePrivacy cookie rules and incident reporting.

Is the Digital Omnibus law? No. The Council agreed its negotiating position on 21 October 2026. The European Parliament has not adopted its position, and the final text will come out of negotiations between the two.

Will cookie banners go away? No. Consent stays the default. Sites that only use cookies within the six exempt purposes may not need a banner, but any site with advertising, retargeting or third-party analytics will still need one.

Does the four-month wait apply now? No. Today there is no fixed EU waiting period, although several regulators already discourage asking again repeatedly after a refusal.