Dublin: EU ambassadors agreed the Council’s negotiating mandate on the Digital Omnibus on 21 October 2026, setting a four-month wait before a website may ask again for cookie consent after a refusal. The Irish Presidency steered the 179-page text through the Committee of Permanent Representatives after an earlier compromise stalled on 7 October. The Commission had proposed a six-month wait.

The Council text, circulated on 22 October as document 14756/26 under file 2025/0360(COD), builds on the Commission proposal of 19 November 2025. It lists six purposes for which a site can access a device without consent, including first-party and media audience measurement, technical security and measuring contextual advertising, with limits on frequency capping. Cookie consent stays in a rewritten Article 5(3) of the ePrivacy rules, and the Commission’s Articles 88a and 88b, which included a browser consent signal, are struck through.

The Digital Omnibus also touches data protection. Pseudonymised data can count as non-personal for a third party that cannot identify the person, through a new Article 25a. AI developers may rely on legitimate interest under Article 6(1)(f) of the General Data Protection Regulation. Notification of high-risk breaches to the authority moves from 72 to 96 hours.

Timelines differ across the text. Incident reporting through national entry points would apply 30 months after entry into force, compared with 24 months in the Commission draft. The cookie rules would apply through national transposition within 24 months of adoption. The Platform-to-Business Regulation is amended rather than repealed.

Parliament has no position yet on the Digital Omnibus. The file has drawn more than 1,000 amendments, and negotiations with the Presidency begin only after Parliament adopts its mandate. The privacy group noyb found that the European People’s Party tabled 248 amendments it rated as weakening privacy, while a study commissioned by Google estimated that a browser signal would cost €40 billion to €50 billion a year, a figure noyb disputed.

For publishers and advertisers, the Council position on the Digital Omnibus is a partial win, because it keeps cookie banners but shortens the pause after a refusal and widens the list of consent-free uses. For privacy advocates, the removal of the browser signal and the AI provision are the main worries. Companies that run consent platforms should watch both sides.

The next test is Parliament. Until its committees vote, the Digital Omnibus remains a draft with two very different wish lists, and the four-month cookie wait is only one of many figures that negotiators will trade before a final law.