The Digital Omnibus is a package of European Union legislation, proposed by the European Commission on November 19, 2025, that amends a large body of existing digital law in one go rather than reopening each act separately. It targets the General Data Protection Regulation (GDPR), the cookie rules of the ePrivacy Directive, the Data Act, the NIS2 cybersecurity directive and the Artificial Intelligence Act. "Omnibus" is Brussels shorthand for a single legal instrument that changes many others. The stated purpose is simplification: the Commission estimated the changes would save businesses up to 5 billion euros in administrative costs by 2029. Critics see a deregulation of privacy law dressed as housekeeping.

Two regulations, two tracks

The package is in fact two proposals. The first, COM(2025) 837, procedure 2025/0360(COD), is usually called the Digital Omnibus. It covers data, privacy and cybersecurity. The second, COM(2025) 836, procedure 2025/0359(COD), is the Digital Omnibus on AI, a narrower text that postpones and adjusts parts of the AI Act. They were published together alongside a Data Union Strategy and a proposal for European Business Wallets, which the Commission said could save companies another 150 billion euros a year.

Both follow the ordinary legislative procedure. The Commission drafts; the European Parliament and the Council of the EU, representing the 27 governments, each adopt a position; and a trilogue negotiation reconciles them. The two files have moved at very different speeds. As of October 2026, the AI text is law and the data text has not yet reached trilogue.

What the data omnibus changes

The Commission's text rewrites several GDPR provisions that matter to advertisers. A revised Article 4(1) would make the definition of personal data relative: information would not be personal for an entity that cannot reasonably identify the person behind it. That codifies the Court of Justice of the European Union's September 4, 2025 ruling in EDPS v SRB (C-413/23 P), which held that pseudonymised data is not personal data "in all cases and for every person". A new Article 88c would confirm that developing and operating AI systems can rest on legitimate interest under Article 6(1)(f), and a new exception in Article 9 would tolerate residual special category data in AI training sets.

Breach notification to regulators would apply only where a breach is likely to pose a high risk, with the deadline extended from 72 to 96 hours, filed through a single EU reporting point shared with NIS2 and other incident regimes. Data subject access requests judged abusive could be refused or charged for under Article 12. Information duties under Article 13 would be lighter where the relationship is clear.

The cookie proposals drew the most attention from the ad industry. The Commission proposed moving consent for device access into the GDPR through a new Article 88a whenever personal data is involved, with consent-free exemptions for aggregated audience measurement and security, one-click refusal and a six-month bar on asking again after a refusal. A separate Article 88b would have obliged websites to honour machine-readable consent signals sent by browsers and operating systems, with media service providers exempted. Device access not involving personal data would stay under Article 5(3) of the ePrivacy Directive.

Outside privacy, the omnibus folds the Data Governance Act, the Open Data Directive and the Free Flow of Non-Personal Data Regulation into a restructured Data Act, adds cloud-switching relief for smaller firms and largely repeals the 2019 Platform-to-Business (P2B) Regulation, on the grounds that the Digital Services Act made much of it redundant.

What the AI omnibus changed

Regulation (EU) 2026/1744 was adopted on July 8, 2026 and published on July 24. Its main effect is delay. Obligations for high-risk systems listed in Annex III of the AI Act, such as those used in hiring or credit scoring, moved from August 2, 2026 to December 2, 2027. High-risk systems covered by product safety law in Annex I moved to August 2, 2028. The Commission had proposed tying the dates to the availability of technical standards; Parliament insisted on fixed deadlines. Providers of generative systems already on the market gained until December 2, 2026 to meet the Article 50(2) marking duty, and new Article 5 bans on non-consensual intimate imagery, including so-called nudifier apps, apply from the same date.

The regulation also handed the AI Office exclusive supervision of AI systems built on a provider's own general-purpose model and of systems embedded in very large online platforms, with periodic penalties of up to 5 per cent of average daily turnover. Relief for small and medium-sized enterprises was extended to "small mid-caps" with fewer than 750 staff.

Origin and evolution

The omnibus grew out of the competitiveness agenda that followed Mario Draghi's September 2024 report on European competitiveness. The Commission's work programme of February 11, 2025 set targets of cutting reporting burdens by at least 25 per cent for all companies and 35 per cent for SMEs. Omnibus I, on sustainability reporting, followed on February 26, 2025, and further packages covered investment, agriculture, small mid-caps and defence.

A call for evidence opened on September 16, 2025. Germany had already sent a 19-page paper, dated October 23, 2025, asking for GDPR changes beyond the Commission's plans, including a three-working-day breach deadline. Drafts leaked around November 10, and Max Schrems of noyb accused the Commission of "secretly trying to overrun everyone else in Brussels". No impact assessment accompanied the proposal.

The AI track moved quickly because the August 2, 2026 high-risk deadline loomed. The Council agreed its mandate on March 13, 2026; Parliament's committees voted 101 to 9 on March 18 and plenary followed on March 26. Talks collapsed overnight in late April before a provisional agreement on May 7 under the Cyprus presidency.

Why it matters for marketers

The data omnibus decides how much of the European audience can be measured without a banner, and on what terms. Consent-free exemptions for audience measurement, a ban on re-asking after a refusal and any browser-level signal all change the share of traffic available for frequency capping, attribution and retargeting. They also determine what consent management platforms (CMPs) must build. A relative definition of personal data would affect whether pseudonymous identifiers handled by a vendor without the key fall inside the GDPR at all.

Criticism and disputes

Regulators objected first. On the day of publication, the Netherlands government warned that new exceptions would allow more tracking without consent than current rules. On February 10, 2026, the European Data Protection Board and the European Data Protection Supervisor rejected the narrowed personal data definition, while backing the browser signal and warning that splitting device rules between two laws "may lead to legal uncertainty".

The ad industry disputed the browser signal from the other direction. France's Alliance Digitale called for deleting Article 88b in May 2026. A Google-commissioned study by Implement Consulting Group estimated that a browser mechanism could cost European businesses 40 to 50 billion euros a year. noyb called the figure "completely far-fetched". The two positions remain irreconcilable in public, and no independent estimate has been published.

The AI training clause drew the sharpest language. Germany proposed that AI training be "presumed as a legitimate interest", while Schrems called the September Council draft "a digital expropriation of Europeans". Process is a further complaint: Council texts marked LIMITE have reached the public mainly through leaks.

Not the same as

Digital Markets Act (DMA). Regulation (EU) 2022/1925 imposes obligations on designated gatekeepers. The omnibus does not amend it; the DMA is under separate review.

Digital Services Act (DSA). Regulation (EU) 2022/2065 governs content moderation and ad transparency on platforms. The omnibus cites it as the reason to repeal the P2B Regulation but leaves it intact.

Omnibus Directive. Directive (EU) 2019/2161 modernised consumer protection law, including bans on fake reviews, with national rules due by May 28, 2022. It shares the name but nothing else.

Earlier omnibus packages. Omnibus I of February 26, 2025 and its successors simplified sustainability, investment and product rules. The Digital Omnibus applies the same method to digital law, and a broader Digital Fitness Check is meant to follow.

Recent developments

On June 18, 2026, a Council compromise removed Article 88b. The Irish presidency's text of September 3, 2026 returned cookie rules to Article 5(3) of the ePrivacy Directive, set six consent exemptions including contextual advertising measurement, and dropped the unconditional right to object to AI training. A week later, 19 organisations asked for the browser signal back. Council document 13886/26 of October 2 cut the re-request wait from six months to four and kept the 96-hour breach deadline.

The ambassadors' committee, Coreper, failed to adopt a mandate on October 7, 2026 after Germany and France pressed for stronger trade secret protection under the Data Act, according to Agence Europe. A further meeting was scheduled for October 11. As of October 12, 2026, no Council mandate had been publicly confirmed. In Parliament, co-rapporteurs Aura Salla (European People's Party) and Marina Kaljurand (Socialists and Democrats) presented a draft report on June 22, 2026; no committee vote had been held as of mid-September. The European Council has asked for agreement on all pending omnibus files before the end of 2026.

Timeline

  • September 2024 - Mario Draghi's report on European competitiveness calls for simpler regulation.
  • February 11, 2025 - Commission work programme sets 25 per cent and 35 per cent burden-reduction targets.
  • February 26, 2025 - Commission presents Omnibus I on sustainability reporting.
  • September 4, 2025 - CJEU rules in EDPS v SRB (C-413/23 P) on pseudonymised data.
  • September 16, 2025 - Commission opens a call for evidence on digital simplification.
  • October 23, 2025 - Germany sends its GDPR simplification paper to the Commission.
  • November 19, 2025 - Commission proposes the Digital Omnibus, COM(2025) 837, and the Digital Omnibus on AI, COM(2025) 836.
  • February 10, 2026 - EDPB-EDPS joint opinion on the Digital Omnibus.
  • February 25, 2026 - Parliament appoints co-rapporteurs Aura Salla and Marina Kaljurand.
  • March 13, 2026 - Council mandate on the AI omnibus.
  • March 26, 2026 - Parliament adopts its position on the AI omnibus.
  • May 7, 2026 - Provisional agreement on the AI omnibus.
  • June 18, 2026 - Council compromise deletes Article 88b.
  • June 22, 2026 - Parliament draft report on the data omnibus.
  • July 8, 2026 - Regulation (EU) 2026/1744 adopted.
  • July 24, 2026 - Regulation (EU) 2026/1744 published in the Official Journal.
  • September 3, 2026 - Irish presidency compromise returns cookie rules to Article 5(3).
  • October 2, 2026 - Council document 13886/26 cuts the re-request wait to four months.
  • October 7, 2026 - Coreper vote on the data omnibus mandate postponed.
  • December 2, 2026 - New AI Act prohibitions and the Article 50(2) grace deadline apply.
  • December 2, 2027 - Annex III high-risk obligations apply.
  • August 2, 2028 - Annex I high-risk obligations apply.

Summary

Who. The European Commission proposed the package; the European Parliament, led by co-rapporteurs Aura Salla and Marina Kaljurand on the data file, and the Council, under the Irish presidency since July 2026, negotiate it. Its rules fall on website operators, ad tech vendors, AI providers and data holders.

What. Two regulations: a Digital Omnibus amending the GDPR, ePrivacy Directive, Data Act and NIS2, and a Digital Omnibus on AI that delayed high-risk AI Act obligations and widened the AI Office's powers.

When. Proposed on November 19, 2025. The AI part became Regulation (EU) 2026/1744 in July 2026. As of October 12, 2026, the data part awaits a Council mandate and a Parliament committee vote before trilogue can begin.

Where. Across the European Union and the wider European Economic Area, with most changes applying directly as regulations and the ePrivacy amendments requiring national transposition.

Why. The Commission presents it as cutting compliance costs by up to 5 billion euros by 2029. For advertising, it decides the future of cookie banners, the reach of the personal data definition and whether AI training can proceed without consent.