Tallinn: Nine months after the Commission published its digital simplification package, the easy half has landed and the contested half has not. The AI component cleared the Council on 29 June 2026 and moved to publication in the Official Journal weeks later. The data component, which reopens the General Data Protection Regulation alongside the ePrivacy Directive, the NIS2 cybersecurity rules and DORA, remains in negotiation with an adoption target around the end of this year.

That split is not administrative accident. It reflects where the political cost sits. Adjusting timelines for artificial intelligence obligations asks legislators to move dates. Rewriting the GDPR asks them to touch a text that European institutions have spent a decade presenting to the world as a rights instrument, and that several member states treat as constitutional in spirit if not in form.

The technical move with the largest consequences

One change deserves more attention than it has received. The proposal would lift the rules governing storage of and access to information on a user’s terminal equipment out of the ePrivacy Directive and place them inside the GDPR, wherever that access involves processing personal data. Framed as consolidation, it does considerably more than tidy the statute book.

ePrivacy operates as a directive, which means twenty-seven national transpositions and twenty-seven slightly different consent regimes. The GDPR operates as a regulation with a single text and a consistency mechanism. Moving device access into the regulation removes that fragmentation, which businesses have complained about for years. It also changes the legal test. Under ePrivacy, consent is the default gateway. Under the GDPR, controllers can reach for legitimate interests and other lawful bases, subject to a balancing exercise.

Whether that broadens or narrows real-world tracking depends entirely on the drafting of the exemptions. Advertising technology firms read the shift as an opening. Data protection authorities read it as a risk. Both readings can be correct, because the text has not settled.

Where the supervisors drew their line

The European Data Protection Board and the European Data Protection Supervisor issued joint opinions in January and February, covering the artificial intelligence elements and the GDPR elements respectively. Their framing repays a careful read. The supervisors endorsed the simplification objective and the competitiveness argument behind it. They then objected wherever the package narrows the scope of a right or dilutes the accountability architecture.

That distinction now shapes the negotiation. Provisions that reduce paperwork survive contact with the supervisors. Provisions that shrink what counts as personal data, or that loosen the duty to demonstrate compliance, meet institutional resistance and give Parliament’s civil liberties committee a ready-made objection. Anyone forecasting the final text should sort the articles into those two buckets rather than treating the omnibus as a single object with a single fate.

Companies face a planning problem in the meantime. If the data package concludes near the end of 2026, application dates will fall around mid-2027 or 2028. Compliance programmes designed today therefore run against rules that will change before they mature, while the current rules stay fully enforceable throughout. Regulators have not paused anything, and the November 2025 publication date created no standstill.

The sensible response is to separate obligations that survive any plausible outcome from obligations that depend on the drafting. Records of processing, breach notification discipline, transfer documentation and vendor governance will look much the same in 2028. Consent architecture for device access, and the classification of pseudonymised data, will not. Firms that rebuild consent flows this autumn risk paying twice.

The Union has spent this legislature arguing that regulatory density costs it growth. The omnibus tests whether that argument can survive contact with a text Europe exports as a standard. The answer arrives in the trilogue on device access, and nowhere else.