The EU Digital Omnibus is moving again.
On 21 October, member states agreed the Council’s negotiating position on the package covering data protection, cookies, data rules and cyber incident reporting. That supersedes the position NEMO reported earlier this month, when the file had stalled without a Council mandate.
For European marketing teams, the important distinction is straightforward: the Council now has a position, but the underlying rules have not changed yet.
No consent platform should be reconfigured because of yesterday’s agreement. No analytics team should start treating audience measurement as generally consent-free. And no publisher should tell clients that the EU has already rewritten its cookie rules.
The Council mandate is a negotiating position. The European Parliament still needs its own position before the institutions can negotiate a final text.
The Council mandate is now real
The Council’s official release confirms that governments have agreed how they want the Digital Omnibus to amend several parts of the EU’s digital rulebook.
The mandate keeps the current GDPR definition of personal data and adds a provision intended to clarify pseudonymisation and when a natural person can be identified. It also supports simpler treatment of some requests and information obligations, along with changes around scientific research and certain uses of sensitive data.
For marketers, however, the ePrivacy section is the part that deserves closest attention.
The Council says cookie and similar tracking rules remain under the ePrivacy Directive. Its position would add clearer purposes for which consent is not required when placing or accessing information on a user’s device.
The official examples include activity necessary to provide a service, audience measurement and device security.
That is a meaningful shift in the negotiating text. It is also narrower than saying “analytics no longer needs consent.”
The final wording, conditions and scope still have to survive negotiations with Parliament.
Audience measurement is the point to watch
Audience measurement is the most obvious marketing consequence in the Council release.
Many European sites currently make measurement decisions around a mix of ePrivacy requirements, GDPR legal bases, national regulator guidance and the technical design of their analytics stack. A future exemption could affect part of that work, but only if the final law actually contains it and the implementation conditions fit the measurement in question.
Those details matter.
A simple first-party audience count is not automatically the same thing as a multi-site advertising profile. Measuring whether an article was read is different from joining that activity to identifiers used for behavioural advertising. The words “audience measurement” therefore should not become a shortcut for every analytics or ad-tech use case.
The Council release itself does not provide enough detail to justify changing production settings today.
Earlier reconstructions of Council drafts have reported more specific ideas, including limits around re-asking users after a refusal and defined categories of consent-free access. Those details remain useful signals, but the official release does not confirm every operational parameter that appeared in those drafts.
Marketing teams should therefore separate what the Council has formally announced from what has appeared in negotiating documents.
GDPR and incident reporting also move
The package is broader than cookies.
The Council says its position supports extending the deadline for notifying personal-data breaches. It also backs a single EU-level list of processing activities likely to create a high risk for individuals and common templates for regulatory compliance.
The official release does not state the exact new breach-notification deadline in its summary, so teams should not build an operational change around a number taken only from secondary reporting.
The mandate also changes the proposed approach to cyber and data incident reporting.
Rather than one EU-level entry point, the Council wants a national entry point in each member state. It also proposes an EU information point and a more harmonised framework for cross-border notifications.
For larger marketing organisations, ecommerce groups and publishers running operations across several EU markets, that distinction could become important later. Incident workflows often sit across legal, security, analytics and platform teams. A national-entry-point model could still simplify some reporting, but it would not be the same as one central EU submission route.
Again, those are future implementation questions. Nothing in yesterday’s mandate changes current reporting obligations by itself.
The old “no mandate” status is now obsolete
The practical reason for updating this page rather than publishing a second article is that the underlying story has changed status.
On 12 October, the correct position was that no Council mandate had been adopted and the proposed cookie and measurement changes remained drafts without a negotiating mandate behind them.
That is no longer accurate.
The Council has now agreed its position and says its presidency will begin negotiations once the European Parliament establishes its own position.
The next useful milestone is therefore not another Council scheduling rumour. It is the Parliament’s position and, after that, the trilogue process.
This distinction also helps keep the Digital Omnibus separate from other regulatory stories NEMO tracks. A Council mandate is not final legislation, just as a platform policy change or court judgment is not automatically an amendment to ePrivacy or GDPR.
What marketing teams should do now
The best response is preparation without premature implementation.
Consent and analytics owners should document which current tools rely on storage or access to information on a user’s device. They should separately identify straightforward audience measurement, advertising measurement, personalisation and cross-site profiling rather than grouping all of them under “analytics.”
That inventory will make later legal and technical review much easier if the final text creates a workable audience-measurement exemption.
CMP teams should also record current refusal and re-prompt logic. There is no reason to change those settings simply because the Council agreed a mandate.
For reporting, use precise language:
The Council agreed its Digital Omnibus negotiating position on 21 October 2026. It proposes changes to GDPR, cookies, audience measurement, data rules and incident reporting, but those changes are not yet EU law.
That sentence is less dramatic than saying the cookie banner is disappearing. It is also much more useful.
The Council’s move is significant because negotiations can now progress once Parliament is ready. The operational question comes later, when there is a final text that marketing, privacy and measurement teams can actually implement.