"EU to scrap cookie banners" is an easy headline. The real story, as of early November 2026, is more modest: a long package of proposed changes is still being negotiated, and the latest step moved some details but not the big promises.
Where things stand
In November 2025 the European Commission published the Digital Omnibus, a package that touches the GDPR, the ePrivacy Directive (the "cookie law"), the Data Act, and incident reporting. One strand, about AI, was split off and finished in June 2026. The data and cookie strand is slower.
On 21 October 2026 EU ambassadors agreed the Council's negotiating mandate on the data part. The Council says negotiations with Parliament can begin only after Parliament has adopted its own position, and no date for that vote has been given. Parliament has received more than a thousand amendments. Law-firm commentary concludes that entry into force is not expected before 2027.
What the Council position says about cookies
Rules stay in the ePrivacy Directive. The Commission wanted consent for device access moved into the GDPR as Article 88a. The Council deleted that. The consent rule stays in a rewritten Article 5(3) of the ePrivacy Directive.
No browser signal. The Commission also proposed that websites must honour machine-readable consent choices from browsers (Article 88b). The Council dropped it in June, and the October text does not restore it, despite a September letter from 19 organisations asking for it to return.
Six purposes need no consent. Access to a device is allowed without consent only where it is strictly necessary for one of these:
- transmitting a communication,
- providing a service the user explicitly requested,
- first-party audience measurement that produces anonymous, aggregated information and is not shared or combined with other data,
- media audience measurement under the European Media Freedom Act (with pseudonymisation),
- security,
- measuring the display and performance of contextual advertising that relies only on the content of the page or a single search query and involves no profiling.
A one-click refuse and a four-month wait. Users must be able to refuse easily with a single-click button or equivalent. If they refuse, the provider must not ask again for the same purpose for at least four months. The Commission had proposed six. A new request is allowed earlier if the purpose changes, or if the refusal cookie is gone for reasons outside the provider's control, such as the user deleting cookies.
Enforcement and timing. Data protection authorities would enforce the cookie rules. Because the rules stay in a directive, countries would transpose them by a date 24 months after adoption.
What this means for a website owner
- Today: nothing changes. Keep a consent banner that makes reject as easy as accept, and do not set non-essential cookies before consent. Our guide on AdSense and consent in the EEA, UK, and Switzerland still applies.
- If the Council text survives: simple, first-party, aggregated analytics could run without a banner. Cross-site tracking, retargeting, and anything that builds a profile would still need a yes.
- Your consent tool: it would have to remember a refusal for at least four months and distinguish exempt purposes from consent-based ones. The mandate does not explain how third-party vendors would prove they stay inside an exemption.
What to prepare now
- Inventory your cookies and scripts by purpose. Which are strictly necessary, which are analytics, which are advertising?
- Check your analytics. Could it be run first-party, aggregated, and not combined with other data? That is the category most likely to benefit.
- Do not delete your banner on speculation. Regulators enforce today's law.
- Re-ask rules. Look at how often your site prompts users who said no, and be ready to extend that interval.
- Watch Parliament. The next real signal is a Parliament position and the start of three-way talks.
Sources
- Council press release, 21 October 2026
- PPC Land: EU Council agrees 4-month cookie re-ask wait for Digital Omnibus talks
- Heuking: Cookie consent under the Digital Omnibus
Summary as of November 6, 2026, of a negotiating position that can still change. This is not legal advice.