EU ambassadors on October 21, 2026 agreed the Council's negotiating mandate on the Digital Omnibus, a 179-page text that rewrites parts of the GDPR, the ePrivacy Directive, the Data Act and the EU's cybersecurity incident reporting rules. The Council's General Secretariat circulated the agreed text to delegations on October 22 as document 14756/26. For the advertising market, the mandate fixes the member states' position on three points: a closed list of six purposes for which cookies need no consent, including the measurement of contextual ads; a four-month minimum wait before a site may ask again after a refusal; and a relative definition of personal data backed by a new article on pseudonymisation.

In Short

EU governments have settled on their version of a big package of changes to Europe's privacy and data laws, ending weeks of delay. Websites would still need consent for most cookies, but not to count an audience or measure ads matched only to the page you are reading, and a site you said no to would have to wait four months before asking again. None of this is law yet, because the European Parliament has not agreed its own version, and the two sides must then negotiate a final text.

What was agreed, and when

The document is an "outcome of proceedings" note from the General Secretariat of the Council to delegations. It states that the annex contains "the text of the mandate for negotiations with the European Parliament on the above-mentioned file as agreed by the Permanent Representatives Committee at its meeting on 21 October 2026." Changes against the Commission's November 19, 2025 proposal are marked in bold, and deletions in strikethrough. The interinstitutional file number is 2025/0360 (COD); the previous document in the series is 14532/26.

The agreement came two weeks after a failed attempt. Coreper examined an Irish Presidency compromise on October 7 without adopting it. According to Agence Europe, technical talks followed, and a revised text went to ambassadors on October 21 with stronger protection for trade secrets, described by the Brussels news service as one of Berlin's red lines. Agence Europe reported on October 20 that the ePrivacy part of the compromise was kept unchanged, and that the GDPR part had been amended to require a Commission report on the proportionality of obligations for small companies. On October 21 it reported that the text adopted was the same as the last compromise put to ambassadors.

PPC Land had reported on the October 2 version of the mandate, document 13886/26, when ambassadors were still expected to decide on October 11. The agreed text keeps the cookie architecture described then.

In a press release on October 21, the Council said negotiations with the European Parliament can begin only once Parliament has adopted its own position, and that the Irish Presidency will lead them. No date for a Parliament vote appears in the document. In Parliament, the file has drawn more than 1,000 amendments, and noyb found that the EPP group tabled 248 amendments it rated as weakening privacy.

Luis Alberto Montezuma, who writes on data and privacy policy on LinkedIn and labels his posts as personal opinion, shared the full text on October 22. "Yesterday, the Council agreed its position on the proposal to simplify certain rules on GDPR, ePrivacy Directive and cybersecurity," he wrote. A second post shared a 40-page extract of the GDPR and ePrivacy articles, pages 131 to 170 of the annex.

Cookies: six exemptions and a four-month wait

The Commission had proposed moving cookie consent out of the ePrivacy Directive and into the GDPR, as a new Article 88a, with an Article 88b obliging websites to honour machine-readable consent signals from browsers. Both articles are struck through in the mandate. The Council had removed the browser signal in June, and 19 organisations asked the Irish Presidency in September to put it back. The agreed text does not.

The rules instead stay in a rewritten Article 5(3) of the ePrivacy Directive. "Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679," the provision begins.

Device access without consent, together with "subsequent processing of personal data for the same purpose," would be lawful only "to the extent it is solely related to and strictly necessary for" six purposes:

  • transmission of an electronic communication over a network;
  • providing a requested service, "including its functionality, explicitly requested by the subscriber or user";
  • first-party audience measurement, creating "anonymous aggregated information about the usage of an online service," carried out by the provider or a third party on its behalf, where the data "are not processed for another purpose, shared with third parties or combined with data from third parties";
  • media audience measurement under Article 24 of the European Media Freedom Act, "provided that personal data are pseudonymised after collection and not processed for another purpose";
  • maintaining or restoring technical security;
  • measuring the display and performance of contextual advertising.

The contextual advertising clause

The sixth purpose is the one ad tech will read line by line. The operative text covers "measuring the display and performance of advertising that is based solely on the immediate content displayed on a subscriber or user's online interface during an individual visit or on the basis of a single search query and that does not involve the processing of personal data, where such measurement is carried out by the provider of an online service, including jointly with others, or on behalf of that provider."

Three conditions follow. "Such measurement shall not involve profiling or processing of data relating to the subscriber or user's past or future activity, including activity across sites or services. Data collected for such measurement shall be pseudonymised after collection and shall not be processed for another purpose."

Recital 44g names the tools in scope. "At the same time, the effectiveness of such advertising often relies on the possibility to measure the display and the performance of the advertisement displayed such as capping cookies and advertising measurement cookies," it says. That brings frequency capping into the exemption, within limits. The same recital excludes data "processed for another purpose including profiling or providing programmatic advertising."

There is a tension in the wording. A frequency cap works by remembering that a device has already seen an ad, which is information about earlier activity, yet the article bars processing "relating to the subscriber or user's past or future activity." The phrase "including activity across sites or services" suggests the cross-site case is the main target. Where a single-site, single-campaign cap falls will be for supervisory authorities, and possibly courts, to decide. The inclusion of "a single search query" also puts measurement of keyword-matched search ads within reach, provided no user history is used.

Refusals must stick for four months

The paragraph after the six purposes sets the consent mechanics. "The subscriber or user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means," it reads. Once consent is given, the provider cannot ask again for the same purpose while it can lawfully rely on that consent. "If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least four months."

The Commission's Article 88a had set six months. Recital 45 explains the rule and its exits. Users who refuse "are often confronted with a new request to give consent each time they visit the same" service, which "may have detrimental effects" because they "may consent just in order to avoid repeating requests." The obligation applies to "any provider that accesses or stores information in the terminal equipment of a subscriber or user, including so-called third-party cookie."

A new request is allowed earlier when "the purpose of processing changes," for instance "where a new service is offered or where substantial changes to the service are made." It is also allowed when the cookie recording the refusal "is no longer valid for reasons beyond the service provider's control, including when the user has deleted the cookies." Browser storage limits, such as Safari's caps on script-set cookies, could therefore shorten the wait in practice.

The French advertising association Alliance Digitale had asked in May for the re-request ban to be deleted outright. It survives, shortened by a third.

Recital 45 ends with a sentence publishers have watched since the summer: the amendments "should not be understood as setting out conditions relating to the online revenue streams of media services providers." The recital does not mention pay-or-consent, but the sentence keeps revenue models outside the stated scope of the reform.

Who enforces, and when

A new Article 15a(5) would require member states to designate their GDPR supervisory authority "for the supervision and enforcement of the rules under this Article 5, paragraph 3." In countries where a telecoms or consumer regulator handles cookies today, enforcement would move to the data protection authority.

The timing is now consistent. The Commission's draft final provisions said the ePrivacy amendment "shall enter into application 6 months after the publication in the Official Journal." That sentence is struck through in the mandate. What remains is a new Article 17(3) of the Directive: member states adopt and publish their transposition laws "by [24 months after the adoption of this Regulation]" and apply them from the same date. Because the cookie rules stay in a directive, they would arrive country by country, two years after adoption.

A new paragraph in Article 18 asks the Commission for a report within 12 months of adoption on "the use of privacy-enhancing technologies, including in relation to the storing of, or gaining access to information on terminal equipment," with proposals "where appropriate."

Personal data, pseudonymisation and the Board

The GDPR's definition of personal data in Article 4(1) gains three sentences from the Commission's proposal, kept by the Council. "Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity," reads the middle one. The language follows the Court of Justice's September 2025 ruling in EDPS v SRB.

Where the mandate departs most from the Commission is the new Article 25a, titled "Application of pseudonymisation and identification of a natural person." The Commission had proposed that it would adopt implementing acts to specify "means and criteria" for when pseudonymisation takes data outside the GDPR for certain entities. In the agreed text, all of that is struck through. In its place are five rules written into the regulation itself.

Controllers and processors "may apply pseudonymisation in order to reduce the risks to the data subjects concerned," subject to "appropriate technical and organisational measures, including security measures, to prevent other persons from identifying the data subject." Then the key sentence: "Pseudonymised data shall not be considered personal data for third party if that third party is unable to identify the natural person to whom the data relates."

Two limits follow. If a third party passes such data on to another party that "possesses or can obtain means reasonably likely to enable the data subject to be identified," both the transfer and the recipient's processing are "processing of personal data." And "where a processor processes personal data on behalf of a controller, that data shall be considered personal data for the processor."

Instead of Commission implementing acts, the European Data Protection Board would issue an opinion "addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures." Its chair must request it no later than six months after entry into force. Recital 27c adds that the Board should hold a public consultation first. The cross-reference in paragraph 7 points to "the opinion referred to in paragraph 4," although the opinion is in paragraph 6, a drafting slip that lawyer-linguists will likely correct.

For ad tech, the processor clause matters as much as the third-party one. A clean room or measurement vendor acting as a processor cannot use Article 25a to say the data are not personal. Only an independent recipient without the means to re-identify can. The Board and the EDPS had urged lawmakers in February not to change the definition at all. The Council has changed it and given the Board the job of explaining how it applies.

The same shift runs through other articles. Under Article 35, the Board would "establish and make public" EU-wide lists of processing that does and does not need a data protection impact assessment, published within nine months of the rules applying. The Commission had wanted to adopt those lists itself. The Board would also establish lists of personal data breaches that are and are not likely to be high risk. A common breach template and a common impact assessment methodology would still go through Commission implementing acts on the Board's proposal.

AI training under legitimate interest

The AI article, renumbered Article 88 bis, is shorter than the Commission's version. Its first paragraph now reads: "The processing of personal data in the context of the development and operation of an AI system or of an AI model, may be carried out for a legitimate interest of the controller or a third party in accordance with Article 6(1)(f) of this Regulation."

The Commission's text had included in the article itself an exception "where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject," with specific reference to children. That wording is struck from the operative paragraph and appears only in recital 33a. Article 6(1)(f) already requires that balancing test, so the legal effect may be limited, but the explicit mention of children no longer sits in the binding text.

A second paragraph states that the article "does not affect the obligation of the controller to choose an appropriate lawful ground of processing." A third requires that, whatever the legal basis, processing for AI "shall be subject to appropriate technical and organisational measures and safeguards to protect the rights and freedoms of the data subject in accordance with this Regulation, including the right to object under Article 21." That is the general legitimate interest objection right, which a controller can override with compelling grounds, not the unconditional opt-out the Commission proposed and the Council dropped in September.

Recital 33a adds that "the development and operation of an AI system or AI model does not in itself constitute a legitimate interest," and that applicability "is to be assessed on a case-by-case basis, taking into account the underlying purpose of that processing."

A new Article 9(2)(k) permits "incidental processing of residual data, where not intended by the controller," of sensitive categories in AI development and "technical operation." Controllers must try to avoid collecting such data, "erase such data without undue delay" once found, and where erasure is technically impossible or "requires manifestly disproportionate effort," protect it from being "further processed or processed for other purposes, used to produce outputs, disclosed or otherwise made available to third parties."

Access requests, notices and automated decisions

Several changes affect day-to-day compliance work.

Access requests. Article 12(5) would let controllers charge a fee or refuse a request under Article 15 "where an abusive intention on the part of the data subject submitting those requests can be demonstrated." The controller must give reasons for a refusal and carries the burden of showing, "in the light of all the relevant circumstances of the case," that a request is excessive or abusive. Recital 35 lists examples, including requests made to provoke a refusal "in order to subsequently demand the payment of compensation," and requests offered for withdrawal "in return for some form of benefit from the controller." It also says repeated requests "are not automatically excessive."

Privacy notices. A new Article 13(5) would waive the full notice "if and to the extent that" there are "reasonable grounds to believe" the person already knows who the controller is and why the data are processed, and the processing is not high risk. The exemption "shall not apply where the processing requires complex processing operations, the processing of large amounts of personal data, or personal data referred to in Articles 9 and 10." Recital 36 gives "the relationship between a craftsman and their clients" as an example and excludes employment.

Automated decisions. The Commission's rewrite of Article 22 would have allowed solely automated decisions for a contract "regardless of whether the decision could be taken otherwise than by solely automated means." In the mandate, that phrase is struck from the article. Article 22 keeps the form of a right "not to be subject to a decision based solely on automated processing," with the existing exceptions and a restored obligation to offer "at least the right to obtain human intervention." The clarification survives only in recital 38, which says the fact that a human could take the decision "does not prevent the controller from taking the decision by solely automated processing."

Privacy by design. Article 25 would extend data protection by design and by default to processors as well as controllers, "with particular regard to the lists referred to in Article 35(4) and (5)."

Smaller organisations. A new Article 97(5a) asks the Commission for "a dedicated report with recommendations on Chapter IV on controller and processor" within six months of entry into force, looking at "the proportionality of the obligations for small and medium enterprises and non-commercial organisations undertaking low risk processing activities." This is the amendment Agence Europe described as added just before the vote.

Breaches: 96 hours, through national entry points

Under the amended Article 33, only breaches "likely to result in a high risk to the rights and freedoms of natural persons" would have to be notified to the supervisory authority, "where feasible, not later than 96 hours after having become aware of it," compared with 72 hours today.

The routing changes. The Commission had proposed a single-entry point run by ENISA, the EU cybersecurity agency, through which companies would file reports under the GDPR, NIS2, DORA, eIDAS and the Critical Entities Resilience Directive. The Council rejected that. Each member state would instead "establish and maintain a national entry point," under a new Article 23b of NIS2, with "flexibility to configure" it around existing national systems. ENISA would run only an "incident reporting information point" that helps companies work out which obligations apply and directs them to the right national portal. The text states that this information point "shall not enable the submission, transmission, storage or processing of any incident notification."

ENISA would issue non-binding recommendations for national entry points within 12 months and an open-source solution member states may use within 18 months. The Commission would report within six months on differences in "definitions, thresholds, deadlines, formats and procedures" across the six incident regimes. The obligation to report through national entry points would apply 30 months after entry into force, up from 24 in the Commission's draft. Until a national entry point exists, controllers keep notifying their data protection authority directly.

The Data Act and the rest of the package

The Data Act takes up most of the annex. The final change before the vote concerned the so-called trade secrets "handbrake" in Articles 4 and 5. A data holder could refuse access, case by case, where disclosure "poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities," subject to weaker protection than under EU law, "in particular as regards trade secrets representing industrial manufacturing know-how" in sectors covered by NIS2. Refusals must be reported to the competent authority every three months, and the Commission would issue guidelines. Agence Europe reported that a request for a presumption of risk for certain sector data did not find broad support.

Other Data Act changes narrow business-to-government data requests to public emergencies, delete the smart contract rules in Article 36, and spare custom-made cloud services and cloud providers that are SMEs or small mid-caps from most switching obligations for contracts concluded on or before September 12, 2025. The phase-out of switching and egress charges still applies to those contracts.

The Data Governance Act and the Open Data Directive would be folded into the Data Act. Registration as a data intermediation service would become voluntary. A provider offering other services alongside intermediation could do so only through a functionally separate entity, and only if it "is not designated as a gatekeeper" under the Digital Markets Act. Public bodies could set higher fees and special licence conditions for data reuse by "very large enterprises," with gatekeeper designation named as a criterion.

The Platform-to-Business Regulation, which the Commission proposed to repeal entirely, would instead be amended. Articles 2(11), 2(12), 6, 8 to 10, 12 to 14, 16, 17 and 18(2) to (4) are deleted. The rest stays in force. Recital 59 names the provisions kept because other laws cross-refer to them, including Article 3 on terms and conditions, Article 4 on restrictions and suspensions, Article 5 on ranking, Article 7 on differentiated treatment, Article 11 on internal complaint handling and Article 15 on enforcement. The ranking transparency duty in Article 5, which requires platforms and search engines to explain their main ranking parameters, therefore survives in the Council's version.

What the mandate does not settle

The mandate is a starting position, not a final law. Trilogue negotiations cannot begin until Parliament votes, and any line can change there.

The browser signal is the most visible gap between institutions. The Council has removed it; the Board, the EDPS and the September coalition supported it. Google had commissioned a study estimating that such a mechanism would cost EU businesses EUR 40-50 billion a year, a figure noyb disputed.

Recital 40b, criticised by French campaigner Fabien Lehagre earlier this month, is still in the text. It says data transfers under points (d) and (f) to (g) of Article 49(1) GDPR "are not required to be non-repetitive," including "international data exchange between tax administrations, even where those transfers are repetitive." The question is pending before the Court of Justice in the FATCA case, C-804/25.

The mandate also says nothing about consent management platforms or the IAB Transparency and Consent Framework, which would have to record a refusal for at least four months and show which vendors fall within the six exempt purposes. Recital 44b says a media service provider may "mandate a third party, such as a market research company" to carry out exempt processing on its behalf, but does not explain how vendors embedded in a page prove they are acting within it.

Why it matters for marketers

For advertisers, publishers and measurement companies, the October 21 text is the first time all 27 governments have signed off on answers to three questions that have shaped European digital advertising since 2018: when a cookie needs consent, when data stop being personal, and what legal basis covers AI training.

The answers favour measurement over targeting. First-party analytics, joint-industry audience measurement, contextual ad measurement and context-bound frequency caps would no longer need a yes. Behavioural targeting, cross-site tracking and any programmatic reuse of the data would. The state of consent in Europe has pushed the industry toward modelled conversions and server-side tagging; the mandate would add a legal route for some measurement that today depends on consent.

The pseudonymisation article may matter more than any cookie rule. It writes into the GDPR that pseudonymised data in the hands of an independent recipient that cannot identify anyone are not personal data for that recipient, while keeping processors firmly inside the regulation. How the Board fills in that rule in its opinion, and whether Parliament accepts it, will decide what data clean rooms, measurement partners and AI developers can receive outside the GDPR.

None of it applies yet. The cookie rules, if adopted, would reach websites only after two years of national transposition. The breach reporting system would change after 30 months. Parliament has not voted.

Timeline

Summary

Who: The Council of the European Union, through the Permanent Representatives Committee and the Irish Presidency, which will negotiate with the European Parliament. The text affects website operators, advertisers, publishers, measurement companies, AI developers, cloud providers and the European Data Protection Board, which gains new tasks.

What: A 179-page negotiating mandate on the Digital Omnibus. It keeps cookie consent in the ePrivacy Directive with six exemptions, including contextual ad measurement and capping cookies, and a four-month minimum before a new request after a refusal. It adds a relative definition of personal data and a new Article 25a that takes pseudonymised data outside the GDPR for third parties unable to identify anyone, with the Board, not the Commission, giving guidance. It also allows legitimate interest for AI development subject to the Article 21 right to object, sets a 96-hour high-risk breach deadline routed through national entry points, and amends rather than repeals the Platform-to-Business Regulation.

When: Coreper agreed the text on October 21, 2026, and the General Secretariat circulated it on October 22, 2026. Talks with Parliament start once Parliament adopts its position; no date is set. If adopted, the cookie rules would apply after 24 months of national transposition, and the incident reporting changes after 30 months.

Where: Brussels, at the Council of the European Union. The GDPR and Data Act changes would apply directly across the EU; the ePrivacy changes would be transposed by each member state.

Why: The Council presents the package as simplification of overlapping digital rules. For the marketing industry, it sets the member states' position in the negotiations that will decide when cookies need consent, how pseudonymised data shared with partners are treated, and how AI training can be justified under the GDPR.