The EU proposed pulling cookie consent out of the ePrivacy Directive and writing it into the GDPR as Articles 88a and 88b. Article 88b — the browser-level signal that would have made banners redundant — was deleted by the Council on 18 June 2026. Article 88a survives: single-click refusal, a six-month cooldown after someone says no, and a new consent exemption for first-party aggregated analytics. None of it is law. Parliament has not taken a position. Your banner stays exactly where it is.
Every few months someone forwards us a blog post announcing that the EU has abolished cookie banners. It is always wrong, and it is always wrong in the same way: it describes a proposal as though it were a regulation, and it describes the most popular part of that proposal without mentioning that the Council has already cut it.
Here is the actual state of the Digital Omnibus as of today, with what changed, what did not, and what a site owner should do about it this quarter. Which is, mostly, nothing dramatic.
What the Digital Omnibus is
The European Commission published the Digital Omnibus package in November 2025 as a simplification exercise across several digital files. The part that matters here does something structurally interesting: it moves the rules on storing information on, or accessing information already stored on, a user’s device out of the ePrivacy Directive and into the GDPR itself, as new Articles 88a and 88b.
That relocation is not cosmetic. Today the legal basis for dropping a cookie comes from ePrivacy, a directive transposed twenty-seven different ways, while the legal basis for processing the resulting personal data comes from the GDPR, a regulation that applies directly. Two instruments, two enforcement paths, two sets of national quirks. Folding the device-access rule into the GDPR would collapse that into one — with GDPR enforcement powers attached.
Article 88a: what it would actually require
Three obligations are worth your attention because they touch the interface, not just the paperwork.
Refusal in a single click
Users must be able to refuse “in an easy and intelligible manner with a single-click button or equivalent means.” If you have been reading regulator decisions for the last five years this is not news — the CNIL was fining companies over exactly this in 2021 and 2022 — but it would move from national enforcement practice into the text of the regulation.
A six-month cooldown after a refusal
This is the genuinely new one. If a user declines, the controller may not ask again for the same purpose for at least six months. And while a valid consent is still running, you may not re-prompt for the same purpose at all.
Read that as an engineering requirement rather than a legal one and it gets sharper. Most consent implementations today re-show the banner on a fixed timer, or whenever the consent cookie goes missing — which happens constantly, because ITP and ETP cap first-party script-written cookies, users clear storage, and people switch devices. A six-month floor on re-asking after refusal means your re-prompt logic has to distinguish refused from never asked and survive the cookie being gone. Most implementations cannot currently tell those two states apart.
New exemptions from consent
Article 88a(3) would make four categories lawful without consent: transmitting a communication over a network; storage or access strictly necessary to provide a service the user actually requested; aggregated usage statistics produced by the service provider for its own internal use; and security of the service or the device.
The third one is the sleeper. A genuinely first-party, aggregate-only analytics setup — no cross-site identifiers, no data flowing out to a vendor for their own purposes, no individual-level profile — would move out of consent territory. That is roughly the shape of a self-hosted Matomo or Plausible install, and roughly not the shape of a standard Google Analytics deployment with advertising features on and data shared for modelling.
If it survives drafting, it is the single biggest practical change in the package for ordinary websites: it makes the honest, minimal analytics setup cheaper to run than the maximal one, for the first time.
Article 88b, and why it is gone
Article 88b was the part everyone wrote headlines about. It would have made a consent signal expressed once — at the browser or operating system level — legally binding on controllers, and obliged browser vendors to provide the technical infrastructure for it. One setting, honoured everywhere. The end of the banner as a per-site interruption.
The Council removed it entirely in its position of 18 June 2026.
noyb, which has been litigating this area for a decade, names Germany, France and Poland as the member states that pushed for the deletion, “presumably following massive pressure from the tracking lobby.” Max Schrems put it more bluntly: “the tracking industry is so terrified of consumers being able to simply say ‘no’ that, after a bit of lobbying, everyone gives in.”
You do not have to accept that framing to notice the shape of the outcome. The provision that reduced compliance work for every website in Europe, and reduced tracking revenue for a handful of intermediaries, is the provision that did not survive contact with the Council.
Where the file actually stands
This is the paragraph most coverage skips.
- The Commission proposed it in November 2025.
- The Council adopted its position on 18 June 2026, minus Article 88b.
- The European Parliament has not adopted a position at all.
- Trilogue negotiations between Parliament, Council and Commission are ongoing.
- Nothing in the package is in force. There is no compliance deadline to prepare for, because there is no adopted text to comply with.
Parliament could put Article 88b back. It has done stranger things, and the campaign to restore it is loud. But betting your roadmap on it would be a mistake, and so would ripping out working infrastructure on the assumption that banners are about to disappear.
What to do this quarter
Nothing in the Digital Omnibus requires action today. But three of its ideas are worth adopting early, because they are good practice regardless of whether the text ever passes.
- Make refusal one click. If rejecting takes more taps than accepting, you are already exposed under current national enforcement — not under a future regulation. Fix it now.
- Make your re-prompt logic state-aware. Store refused distinctly from no record, and make it survive cookie loss. You will need this if 88a lands, and in the meantime it stops you nagging users who already said no.
- Find out what your site loads before anyone clicks anything. Every version of this file, in every draft, leaves pre-consent tracking unlawful. That is the exposure that exists today, under law that is already in force, and it is the one nobody’s blog post about “the end of cookie banners” is going to help you with.
A note on sources
This area is now thick with pages that invent regulatory events — we have documented an entirely fictional EDPB guidance being cited across several SEO sites. If a post tells you a rule is in force, check it against the institution: the Council’s positions, the Parliament’s procedure file, and the EDPB’s own publications. The Digital Omnibus in particular is a moving target, and half the pages describing it are describing the November 2025 draft as though June never happened.
Whatever the final text says about banners, it will not say that firing analytics before consent is fine. Scan your site to see what actually loads before anyone clicks with CookieInspector.