EU countries agree their line on changing the GDPR and cookie rules
On 21 October the EU member states settled their position on the Digital Omnibus, which is meant to simplify the GDPR and the cookie rules, among others. Now it is the European Parliament’s turn.
What happened
On 21 October the EU member states’ ambassadors agreed their position on the Digital Omnibus, the package meant to simplify the GDPR, the cookie rules and incident reporting. That clears the way for the Council of the EU to negotiate with the European Parliament.
The European Commission proposed the package in November 2025. It belongs to a series of twelve simplification packages the Commission has presented since February 2025. The part on the AI Act was adopted on 29 June. The rest took longer: according to PPC Land, the ambassadors failed to reach a decision on 7 October because of disagreement over the Data Act, the law on sharing data. Two weeks later the Irish presidency got it over the line.
In the Council’s position the GDPR stays largely intact. The definition of personal data does not change, but a provision on pseudonymisation is added: processing data so that it no longer points directly at a person. You would get longer than today’s 72 hours to report a data breach. Manifestly unfounded or excessive requests from people about their data would be easier to deal with, and in some low-risk situations you would need to explain less. Using sensitive data for biometric checks and for building and running AI systems would come with extra safeguards.
The cookie rules stay in the ePrivacy Directive, but more cookies would no longer need consent: those needed to provide a service, to measure audiences or to protect a device. You would report an incident to a desk in your own country, and an EU-level information point on incident reporting would be set up.
The European Parliament has not yet adopted its position. EU leaders want all the simplification packages agreed by the end of 2026.
Talks with the European Parliament only start once Parliament has settled its own position.
The Council of the EU’s press release of 22 October 2026, in short
The background
What the Commission proposed
The Commission wanted to go further. Data would no longer count as personal data for a company that cannot reasonably identify the person behind it, in line with a ruling by the EU Court of Justice in September 2025. Using personal data to train AI would be allowed on the basis of ‘legitimate interest’, with an unconditional right to object. A data breach would have to be reported within 96 hours instead of 72, and only if it poses a high risk. A single EU desk run by the cyber agency ENISA would take reports under the GDPR, NIS2 and other laws; the Commission says that would halve the reporting work for most organisations.
The Commission wanted to move the cookie rules into the GDPR, with a button to refuse everything in one click, preferences set in your browser that sites must respect, and a no that stands for at least six months. That alone would save businesses more than €800 million a year, by the Commission’s estimate.
What the member states took out
The new definition of personal data drew heavy criticism. In February the EU’s data protection authorities wrote that the change went far beyond a technical amendment. That same month the Cypriot presidency struck it from the text. According to PPC Land, the browser preference, which would have let you set your choice once for every site, is no longer in it either.
How much longer you would get to report a breach is not in the press release. According to PPC Land, a draft of 2 October still contained the 96 hours and the high-risk threshold; Germany wanted three working days.
The rules today
Today you report a data breach to the regulator within 72 hours, unless it is unlikely to pose a risk. The Dutch Data Protection Authority (AP) received 25,694 reports in 2023, around 70 a day. With a high-risk threshold, far from every breach would still go to the regulator.
In the Netherlands, cookie rules have required consent to store or read anything on a visitor’s device since June 2012. Since March 2015 there has been an exemption for analytics cookies with little or no impact on privacy.
Our analysis
The big change to the GDPR is off the table, and the cookie banner stays
The coverage makes it sound like a sweeping relaxation of the GDPR. Yet the member states took out the biggest change of all: the narrower definition of personal data, which regulators and privacy groups opposed. What remains is practical: more time to report, consent less often for measuring visitors, and less explaining where the risk is low.
Nor is the cookie banner going away. Without a browser preference, every site that tracks visitors for advertising will keep asking for consent itself. For a Dutch site that only measures visitors, little changes: that has been allowed without consent since 2015, as long as the impact on privacy is small. And the single EU reporting desk, with which the Commission wanted to halve the reporting work, becomes a desk in every country. Our expectation: for a company operating in several countries, much of that work will remain.
A higher threshold for reporting does not make the work inside your company any smaller. You still need to judge quickly whether a breach poses a high risk, and you can only do that if you know which data sits where. When the new rules take effect is still uncertain. Our expectation: not before 2027.
What stands out
- From one desk to one per country The Commission wanted a single EU reporting point for incidents. The member states chose a desk in every country, with an EU-level information point alongside.
- Big tech pays more for public data Public bodies may set different conditions and charge higher fees when very large companies, such as the gatekeepers under the EU’s platform rules, reuse public-sector data.
- AI is no free pass The draft of 2 October states that building or running an AI system is not in itself a legitimate interest. It has to be weighed case by case.
- A no stands for four months If a visitor refuses cookies, the same draft lets a site ask again after four months. The Commission wanted six.
What it means for you
Nothing changes for you yet, but the direction is clear: consent for cookies less often and more time to report a breach.
- Today’s rules still apply The GDPR and the cookie rules stay as they are. Only once the Council and Parliament agree will it be clear what changes.
- Consent for cookies less often A site may soon no longer have to ask for consent to measure visitors or keep things secure. How far that goes depends on the negotiations.
- You still report a breach The position gives you more time for it, and you report an incident in your own country. But you still need to know quickly which data was involved.
Where we come in · Advisory
We help you map which data goes where
When we map your processes in a Roadmap, you also see which data goes to which service. With Ongoing guidance we regularly talk through what has become possible since, including when the rules change. If your colleagues build their own tools, Support checks them against the GDPR on an ongoing basis.
Do you know where your customer data ends up?
Tell us which systems and AI tools you use. We’ll think it through with you and always reply within one working day.
