Short version: the EU Council finally has a position. On 21 October 2026, EU ambassadors meeting as Coreper agreed the Council's negotiating mandate on the Digital Omnibus, after two failed attempts on 7 and 11 October. But the mandate that got adopted is not the one most trackers were watching. Cookie consent stays inside the ePrivacy Directive, the European Commission's plan to move it into the GDPR did not survive. Here is what actually changed, and why the headline "deal reached" does not mean new rules apply to your site yet.

What got agreed on 21 October

The Council of the EU agreed its negotiating position on the Digital Omnibus package, covering GDPR simplification, the Data Act, and cyber incident reporting alongside the cookie consent changes. This follows a Coreper vote postponed on 7 October under pressure from Germany and France over Data Act trade secret protections, and a second attempt on 11 October where the text was not even put up for discussion. The mandate that finally passed on 21 October keeps the same trade secret safeguards that blocked the earlier votes.

This is a Council negotiating position, not adopted law. The next step is the European Parliament, which has not yet adopted its own position on this part of the Digital Omnibus package (the separate AI Act part of the same package already finished its own process earlier in 2026). Only once Parliament has a position can trilogue negotiations between Council, Parliament and Commission begin.

The structural surprise: cookies stay in ePrivacy, not GDPR

The original Commission proposal, published 19 November 2025 as COM(2025) 837, wanted to move cookie and device-access consent rules out of the ePrivacy Directive and into two new GDPR articles, 88a and 88b. That approach did not survive the negotiations. By the Irish presidency's text of 3 September 2026, Article 88a was dropped, and the rules went back into Article 5(3) of the ePrivacy Directive, where they have lived since 2009. The Council's final mandate confirms this: consent for accessing or storing information on a device stays in ePrivacy, just with an expanded list of exceptions.

The idea of a legally binding browser-level consent signal, originally Article 88b, is gone entirely and has been since the June 2026 compromise. There is no EU-wide "set your preference once in the browser" mechanism in the current text.

What actually changes under Article 5(3)

The mandate widens the list of purposes that do not require consent before accessing or storing data on a device. Six exceptions are named:

• Transmitting a communication over a network.
• Providing a service the user explicitly requested.
• First-party audience measurement, limited to anonymous, aggregated information.
• Media audience measurement under the European Media Freedom Act.
• Maintaining or restoring the technical security of a service or terminal equipment.
• Measuring the display and performance of contextual advertising, including frequency capping, conditional on pseudonymised data, no profiling, and no tracking across different sites or services.

Two provisions that were attached to the now-dropped Article 88a survive as standalone requirements: refusing consent must be as easy as accepting it, one click for both, and a site that receives a refusal must wait at least four months before asking again for the same purpose. Both of those carried over from the June and October compromise texts into the final mandate.

What this means for your site today

Nothing changes in what you need to do right now. The rules you operate under are still the current GDPR and ePrivacy Directive, exactly as before this vote. A Council mandate is a starting position for negotiations with Parliament, not a deadline. Given that the related AI Act track inside the same Digital Omnibus package took from committee vote to Official Journal publication over roughly four months once both co-legislators had a position, and Parliament has not even started on this track yet, realistic adoption for the cookie and GDPR parts is unlikely before late 2026 at the earliest, with actual application more likely in 2027.

What is worth tracking is the direction. The easy-refusal and four-month cooldown requirements have now survived three consecutive compromise rounds, which makes them a reasonably safe bet to end up in the final text in some form. The six named exceptions are narrower than many cookie vendors are currently implying; "audience measurement" under the mandate explicitly means anonymous and aggregated, not your regular analytics cookie with a client ID.

A short checklist worth running now

• Your reject option is already as easy to find as accept, not buried in a settings panel, so this requirement will not force a redesign later.
• You are not relying on a yet-to-exist browser signal, since Article 88b's mechanism is off the table.
• If a banner vendor claims the EU has approved new cookie rules, ask for the Council document number. As of today, this is a negotiating mandate, not a regulation.
• You keep a record of what a user agreed to and when, which none of these drafts touch.

None of this depends on which version of the Digital Omnibus eventually passes. InCookie's default banner already ships with an equally sized reject button and records consent choices with a timestamp, so there is nothing to change on your side while the legislative process runs its course.

Want to check your own banner setup in three minutes? Start with InCookie's free tier and confirm your consent signals are already where this proposal wants them.

Sources

• Council of the EU, press release, "Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules", consilium.europa.eu, 21 October 2026
• Agence Europe, "EU Council adopts negotiating position on Digital Omnibus", 21-22 October 2026
• ieu-monitoring.com and news.europawire.eu, reporting on the 21 October 2026 Council mandate
• ppc.land, reporting on the Council's draft texts and the final mandate, including the six Article 5(3) exceptions and the four-month cooldown
• digidata.substack.com, "The Council Has Given the Digital Omnibus a Workable Direction", analysis of the 21 October 2026 mandate
• European Commission, Digital Omnibus proposal COM(2025) 837, 19 November 2025 (original proposal to move consent into GDPR Articles 88a/88b)