The Digital Omnibus is the European Commission proposal COM(2025) 837 of 19 November 2025, which simplifies the EU rules on data, privacy and cybersecurity, cookies included. On 21 October 2026 the Council of the EU agreed its negotiating mandate and parted ways with the Commission on a point that affects almost every website. Cookies would stay in the ePrivacy Directive rather than move to the GDPR, and there would be more cases in which no consent is needed. None of this is law yet. The European Parliament still has to adopt its position and negotiate with the Council. In the meantime, Spain applies Article 22.2 of its Information Society Services Act (LSSI), as interpreted by the Spanish Data Protection Agency (AEPD).
If you need a digital law firm to review your cookies and your legal terms, ask for a free initial assessment.
The Council keeps cookies and other tracking technologies under the ePrivacy Directive and adds purposes for which no consent will be required. That is what the Council of the EU press release of 21 October 2026 says, with three examples. They are cookies needed to provide the service, audience measurement and the security of the user’s device. The stated aim is to reduce the number of cookie banners when browsing.
The mandate is the position the Council will negotiate with. The Irish presidency will open talks with the European Parliament once Parliament adopts its own. The Council text was published on 22 October 2026 as document 14756/26. Any of its points may change before the final agreement.
The mandate covers more ground. It keeps the current definition of personal data, supports a longer deadline for notifying data breaches and replaces the single EU entry point for incident reporting with a national entry point in each Member State. We explain the whole file in our analysis of the Digital Omnibus and the GDPR.
The Commission proposed taking cookies out of the ePrivacy Directive and moving them into the GDPR, through a new Article 88a, whenever the information stored is personal data. The Council rejects that move and keeps the current regime of Article 5(3) of the Directive, updated with a closed list of exempt purposes.
| Issue | Commission proposal (19/11/2025) | Council mandate (21/10/2026) |
|---|---|---|
| Where cookies are regulated | In the GDPR, where personal data is involved | In the ePrivacy Directive, as today |
| Cookies without consent | Closed list in the GDPR (transmission, requested service, own audience measurement and security) | Closed list in the Directive, including the requested service, audience measurement and device security |
| Refusal and asking again | One-click refusal and six months before asking again | Also regulated, with changes, and left to the negotiation |
| Automated browser signals | Obligation to respect them | Addressed with changes, still to be negotiated |
| Status | Proposal | Negotiating position, without Parliament’s |
The difference matters in practice in Spain. The ePrivacy Directive applies here through Law 34/2002 on information society services (LSSI). If cookies stay in the Directive, the change is likely to arrive through an amendment of the LSSI, not directly as it would with a GDPR article.
The mandate sets a limited list of purposes that do not require consent, and its recitals explain each one. The general rule does not change. Storing information on the user’s device, or accessing information already there, still requires consent outside those cases.
No consent will be needed where the cookie is necessary to provide a service the user has expressly requested. The recitals give two examples, remembering the chosen language and keeping the items in the shopping basket. This exception already exists today, with clearer wording.
Audience measurement will be possible without consent as long as the data is not used for another purpose. This is the change most websites will notice, because analytics tools are the most common reason for a cookie banner.
Spain already allows something similar. In January 2024 the AEPD published its guide on cookies for audience measurement tools (in Spanish), which exempts from consent analytics cookies that meet six conditions at once. They must be limited to measuring the audience of the site itself, produce only anonymous statistics for the publisher and not be cross-checked with other processing. The data cannot be passed to third parties, there can be no tracking across sites and no shared identifiers, and the provider cannot reuse the data for its own purposes. The cookie lasts thirteen months at most and the data is kept for twenty-five months.
Cookies and access that maintain or restore the security of the device, such as security updates, will not need consent either. The recitals limit this to what is strictly necessary for that security and point out that the user can turn off the automatic installation of updates.
Today a website can only place non-exempt cookies if the user consents after receiving clear and complete information on their use and purposes. That is Article 22.2 of the LSSI. Technical storage to transmit a communication and storage strictly necessary for a service the user has expressly requested are excluded.
The AEPD Guide on the use of cookies, in its May 2024 version, sets out how to ask for that consent. The option to reject must be in the same layer, at the same level and with the same visibility as the option to accept. As good practice, the AEPD recommends that consent should not remain valid for more than twenty-four months.
Placing cookies without informing users or without the consent required by Article 22.2 is a minor infringement under Article 38.4.g of the LSSI. The fine can reach 30,000 euros under Article 39.1.c of the same law.
There is no date. The European Parliament has not yet adopted its position on the Digital Omnibus, and negotiations with the Council cannot start without it. After an agreement, the text has to be adopted, published in the Official Journal of the EU and, where it amends the ePrivacy Directive, transposed into Spanish law.
The presidents of the Council, Parliament and Commission signed the «One Europe, One Market» roadmap on 24 April 2026. Its aim is to close all the simplification packages by the end of 2027. That is a political target, not a legal deadline. Until the change is published, the LSSI and the AEPD criteria apply in full.
A fictitious online shop in Bilbao, Lumen Hogar, sells lamps and uses an analytics tool that also uses the data for its own advertising purposes. In October it reads that the Council wants to exempt audience measurement from consent and considers taking those cookies out of its banner.
It cannot. Today the AEPD exemption requires the provider not to reuse the data, and the Council mandate also makes the exemption conditional on the data not being used for another purpose. Lumen Hogar keeps those cookies under consent. It does, however, compare its tool with a measurement tool that meets the six conditions of the January 2024 guide. If it switches, it can exempt the new tool now, sign the processor contract under Article 28 of the GDPR and be ready for the EU rule, whatever its final form.
None of the Omnibus changes is binding yet, but some adjustments work under today’s law and under the future one.
In an online shop, cookies overlap with the rest of the data protection obligations, as we explain in our article on the GDPR for online shops. The cookie policy is also part of the legal terms of an online shop, alongside the legal notice and the terms of sale.
Not entirely. The Council mandate of 21 October 2026 widens the cases in which no consent is needed, such as audience measurement and device security, so some websites will be able to simplify their banner. Advertising cookies and cookies shared with third parties will still need consent, and the change has not been approved yet.
Today, only if they meet the conditions of the AEPD guide of January 2024. They must be limited to measuring your own site’s audience, produce anonymous statistics, not be shared or cross-checked with other data and not allow tracking across websites. The provider cannot reuse the data. If your tool fails any condition, you need consent.
They have no date. The Council agreed its position on 21 October 2026, but Parliament’s position and the negotiation between the two are still pending. The text then has to be published and, since cookies would stay in the ePrivacy Directive, Spain would have to transpose it into the LSSI. Until then, Article 22.2 of the LSSI and the AEPD guide apply.
Up to 30,000 euros. Placing cookies without informing users or without the consent required by Article 22.2 of the LSSI is a minor infringement under Article 38.4.g of that law. Article 39.1.c punishes minor infringements with fines of up to 30,000 euros. The AEPD is the authority that imposes these fines.
In where cookies are regulated. The Commission proposed moving cookies into the GDPR where personal data is involved, through a new Article 88a. The Council prefers to leave them in the ePrivacy Directive, as today, and to extend there the list of purposes exempt from consent. Both versions exempt audience measurement and security, under different conditions.
Cookies are the part of the Digital Omnibus that most websites will notice, and also the easiest one to get ahead of by mistake. The sensible step today is to sort cookies by purpose, align analytics with what the AEPD already allows and get the banner ready to be simplified once the EU rule is adopted. At Innovatech we review cookies, banners and legal terms as part of our digital law services. Tell us about your case and we will give you a free initial assessment.
Marta Suárez-Mansilla is Managing Partner of Innovatech Legal and a Spanish lawyer (abogada), Madrid Bar (ICAM), working in technology law. She completed Harvard Law School's Copyright course and BerkeleyX's Blockchain programme, and has advised technology companies for more than eight years.