The GDPR changes inside the Digital Omnibus now have a first formal reference point: the Council’s negotiating draft dated 2 October 2026, circulated as document 13886/26. Under the Irish presidency, which began on 1 July 2026, the text would amend the GDPR, the ePrivacy Directive, the Data Act and NIS2, and it would largely repeal the Platform-to-Business Regulation. Parliament has not yet fixed its own position, so the member states are setting the first marker.

Where the GDPR changes stand in the Council

Ambassadors met on 7 October 2026 and ended the session without a vote, because the Data Act chapter remained contested. They were expected to return to the file on 11 October. The delay matters because the package bundles several laws that different capitals treat very differently.

The draft is a mandate, not law. Any compromise still has to survive talks with Parliament, and Parliament has yet to show how far it will follow the Council. That gap will define the negotiating calendar.

It helps to separate three layers of the GDPR changes: the legal definitions, the consent mechanics and the enforcement deadlines. Each layer has different winners. Advertisers and publishers gain from the cookie exemptions, privacy groups focus on the definition of personal data, and regulators care most about the breach window, because a 96-hour limit changes how supervisory authorities receive incident reports.

Cookie consent and the four-month wait

The most visible change concerns cookies. The Council text keeps the rules in Article 5(3) of the ePrivacy Directive and leaves out the browser-level consent signal that the Commission proposed as Article 88b. Websites would therefore not be able to read a single preference sent by the browser.

After a user refuses cookies, the waiting period before a site may ask again would fall from six months to four. Six purposes would also be exempt from consent, including first-party audience measurement, technical security and the measurement of contextual advertising. Contextual measurement qualifies only if the data is pseudonymised and not used for profiling or programmatic advertising.

A timing puzzle remains. The ePrivacy changes would apply six months after publication in the Official Journal, yet member states would have 24 months to transpose them. The draft does not explain how those two clocks fit together.

Personal data, AI training and breach deadlines

Article 4(1) would make the definition of personal data relative to the entity that holds the information. That shift matters most for pseudonymised data shared with measurement partners, because a recipient with no means of identifying a person could treat the data as non-personal.

These GDPR changes also touch AI development directly. The draft lets developers of AI systems rely on legitimate interest as a legal basis, with a reference to the right to object under Article 21. Privacy regulators will watch how that safeguard works in practice. Breach notification would apply only to high-risk breaches, and the deadline would stretch from 72 to 96 hours.

The tax data recital that split opinion

One disputed item sits in recital 40b. It says repetitive transfers of tax data can fall under the public interest derogation in GDPR Article 49. Fabien Lehagre, who is tied to a challenge to FATCA data flows, reports that France and Poland have asked for the recital to be deleted. The Council document itself does not record those positions, so the point stays open.

What happens next

Three questions will shape the GDPR changes over the coming months: whether Coreper agrees a mandate, how far Parliament’s committees resist the relative definition of personal data, and whether the browser signal returns in trilogue. For companies exposed to the GDPR changes, the practical advice is to plan for a four-month consent cycle without assuming that any of the 2026 text is final.

The GDPR changes in the Digital Omnibus will not settle quickly. The Council mandate gives the clearest picture so far of what member states will accept, and it shows how much of the 2026 reform still depends on Parliament.