The EU’s Digital Omnibus: what could change for GDPR and cookies

The Digital Omnibus is a proposal the European Commission published on 19 November 2025 to simplify several EU digital laws in one go. On the GDPR side, it would change what counts as personal data, how cookie consent works, when a data breach must be reported and how AI training fits in.

It is not law. As of 19 October 2026, EU governments have not agreed their negotiating position and the European Parliament’s committees have not voted, so every rule you follow today still applies. Below, I set out the Digital Omnibus GDPR changes one by one, where the negotiations stand and what to do now, which is not much.

This article is part of my GDPR guide for small teams and concerns businesses outside the EU too, as soon as they have customers or users in it. It is general information, not legal advice.

Digital Omnibus and GDPR: where the proposal stands on 19 October 2026

The Commission’s text is proposal COM(2025) 837. It would amend the GDPR, the ePrivacy Directive (the cookie rules), the Data Act and the NIS2 cybersecurity directive, among others. It becomes law only once the Parliament and the Council, where member state governments sit, agree on the same text. The Parliament’s Legislative Observatory tracks it as procedure 2025/0360(COD).

The Council’s vote was postponed after France and Germany asked for stronger protection of trade secrets in the Data Act part of the package. In the Parliament, the rapporteurs, Aura Salla (EPP, Finland) and Marina Kaljurand (S&D, Estonia), have no committee vote date yet. In their joint opinion, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) back some changes and oppose others; I note their position where it matters below.

Personal data: a narrower, business-by-business test

Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable person. In the SRB case (C-413/23 P, judgment of 4 September 2025), the Court of Justice of the EU held that pseudonymised data are not necessarily personal data for every recipient: it depends on whether that recipient has means reasonably likely to be used to identify the person.

The Commission wants to write this into the GDPR. Information would not be personal data for a business that cannot identify the person with the means it is reasonably likely to use, and it would not become personal data for that business just because a later recipient could. A new Article 41a would let the Commission set criteria, in implementing acts, for when pseudonymised data stop being personal data for certain recipients. The EDPB and the EDPS asked the Parliament and the Council not to adopt this change: in their view it goes further than the case law and could weaken protection.

For most small teams, little would change: your client list, your CRM and your inbox name people, so they remain personal data for you. The new test would matter for data with names replaced by codes, such as a pseudonymised export you receive from a partner or pass on to a provider.

Cookies: one-click refusal and fewer consent requests

Today, cookie consent comes from Article 5(3) of the ePrivacy Directive, which each country writes into its own law. The Commission proposes to move the rules on personal data stored on or read from people’s devices into the GDPR, mainly in a new Article 88a. Three changes stand out:

• Fewer consent requests. Consent stays the rule, but some uses would no longer need it, among them aggregated audience measurement that a site runs for its own use, and keeping a service secure.
• A one-click refusal. Saying no would take a single click, and after a refusal the site could not ask again for the same purpose for six months.
• Browser signals. A new Article 88b would oblige sites to respect automated, machine-readable choices sent by the browser or the device.

The Council’s latest draft, which EU governments have not approved yet, differs on several points. It keeps the cookie rules in the ePrivacy Directive, lists six exemptions from consent (measuring contextual advertising and capping how often an ad is shown among them) and cuts the wait before asking again to four months. A Council compromise text of June 2026 deleted Article 88b.

If your visitors are in France, much of this will look familiar. The CNIL already expects a ‘Refuse all’ button as easy to use as ‘Accept all’, presents keeping a refusal for six months as good practice, and exempts audience measurement tools set up under strict conditions. My guide to cookie banner requirements covers today’s rules in the EU, France and the UK.

Data breaches: 96 hours, only when the risk is high

Under Article 33 of the GDPR, you notify a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. The proposal would change three things:

1. Only breaches likely to result in a high risk would be notified, the threshold that already applies to telling the people affected (Article 34).
2. The deadline would be 96 hours.
3. Notifications would go through a single EU entry point, developed with ENISA, the EU cybersecurity agency, and shared with other incident-reporting laws such as NIS2 and DORA, so that one report could serve several of them.

The EDPB and the EDPS back this part. Until it applies, the 72-hour deadline and today’s threshold stand, as set out in my guide on what to do after a data breach.

AI, impact assessments, privacy notices and access requests

Four other changes would affect small teams less directly.

Legitimate interest for AI. A new Article 88c would confirm that developing and running AI systems can rely on legitimate interest (Article 6(1)(f)), with safeguards such as data minimisation and an unconditional right to object. It mainly concerns businesses that build, train or run their own AI systems. If you only use an assistant, the questions in my article on what client data you can put into ChatGPT remain the ones to ask.

Impact assessments. Today each national authority publishes its own list of processing that needs a data protection impact assessment (Article 35). The proposal would bring them together into one EU list of processing that needs one and one of processing that does not, with a common template and method.

Privacy notices. Article 13 would gain an exemption when you collect data in a clear and limited relationship, your activity is not data-intensive and you can reasonably assume the person already has the information. The exemption would not apply if you pass the data on to other recipients, transfer it outside the EU or carry out high-risk processing, among other cases. My guide to what a privacy policy must say explains the current duty.

Access requests. The proposal would let you treat a request as excessive when someone uses the right of access (Article 15) for purposes other than protecting their data, on reasonable grounds rather than proof of abuse. The EDPB and the EDPS oppose this lower bar.

Outside the EU: UK, Swiss, US and other businesses

The GDPR follows your customers, not your address. Under Article 3(2), it applies to a business outside the EU that offers goods or services to people in the EU, or monitors their behaviour there. So the Omnibus changes, if adopted, would apply to a Swiss online shop delivering to France, a US app with users in Germany or a Moroccan training company selling online courses to Belgian customers, for those customers. My article on whether GDPR applies outside the EU explains the two tests.

UK businesses have two rule books. For people in the UK, the UK GDPR and the UK cookie rules (PECR) apply, and the Data (Use and Access) Act 2025 has already amended both: most of its changes have been in force since 5 February 2026, including a cookie exception for analytics used only for statistics, provided visitors are told and can object easily. For people in the EU, the EU rules apply as they stand today. A UK shop with French customers already works with two sets of cookie rules, and the Omnibus would change only the EU one. I cover the UK side in UK GDPR after the Data (Use and Access) Act.

What to do now, and when to get help

Nothing in the Digital Omnibus applies yet, so your to-do list has not changed:

1. Keep following today’s rules. Notify breaches within 72 hours, ask for consent before non-essential cookies and give people the Article 13 information.
2. Leave a compliant cookie banner alone. Rather than rebuilding it for a text that may still change, check it against today’s rules: refusing as easy as accepting, nothing non-essential loaded before the answer, the choice recorded.
3. Watch four milestones. The Council’s negotiating position, the Parliament’s committee vote, the start of trilogues, then publication in the Official Journal with its application dates.
4. Note which changes would touch you. For most small teams, that means the cookie and breach rules. If you work with pseudonymised data, use customer data to train AI or track visitors at scale, a lawyer or a DPO is worth consulting before you change anything: these are the parts most likely to move.

When I build a site, the cookie banner and the privacy pages are part of the website work, so they follow the rules in force on the day it goes live, not a proposal.