Fewer cookie banners, an exemption for simple audience measurement, consent through browser signals: the European Commission's Digital Omnibus promised a lot. If you're waiting for it, don't put your consent setup on hold. Parliament committees are sitting on well over a thousand amendments, and the Council's negotiating mandate fell through in June. Any reform is years away from applying to your website.
This article sums up what has been proposed, where the procedure stands and what it means for your site today. It is a practitioner's overview, not legal advice. Information as of 7 October 2026.
What the Commission proposed
On 19 November 2025 the Commission published the Digital Omnibus (COM(2025) 837), a package amending several digital laws at once. Three parts matter for websites:
- Cookie rules inside the GDPR. A new Article 88a GDPR would govern storing or reading personal data on users' devices: consent as the rule, with exceptions. One of them is aimed squarely at web analytics: creating aggregated usage information to measure an online service's audience, where the operator does so solely for its own use.
- Stricter rules for asking. Refusing would have to be possible with a single click, and after a refusal the site could not ask again for at least six months.
- Consent via browser signals. A new Article 88b would allow machine-readable consent and refusal, for example through browser settings, with long lead times: 24 months for websites, 48 months for browsers.
One important limitation: the new rules would only cover personal data. Everything else would stay under Article 5(3) of the ePrivacy Directive, which in Germany is implemented as Section 25 TDDDG. The Commission also wants to narrow the definition of personal data, which the European Data Protection Board and the European Data Protection Supervisor firmly opposed in February 2026.
Where the procedure stands
In the European Parliament, the industry (ITRE) and civil liberties (LIBE) committees handle the file jointly. By the 15 July 2026 deadline, more than 1,750 amendments had been tabled. The two rapporteurs deliberately left the most contested points, cookie rules and the data definition, open for committee negotiations. No committee has voted yet.
In the Council, member state ambassadors (Coreper) were due to approve the negotiating mandate on 26 June 2026. The item was pulled at short notice because a blocking minority had formed. The reason is telling: according to the Dutch government, some member states felt the compromise did not go far enough on simplifying the GDPR. The June compromise also took a different route from the Commission: it deleted the new GDPR Articles 88a and 88b and the new data definition, and wrote the exceptions, audience measurement included, straight into the ePrivacy Directive, which member states would then have 24 months to transpose. The Irish presidency is now negotiating a new compromise; the outcome of the next attempt was still open when this was written.
Don't confuse this file with the "Digital Omnibus on AI", which amends the AI Act and has applied since July 2026.
What applies until then
There is no official adoption date. The Commission aimed for agreement by June 2026; the European Council is pushing for one before the end of 2026. Even then, transition periods follow: six months for the cookie rules and up to 48 months for browser signals in the Commission's proposal, 24 months for national transposition in the Council's draft.
Until then, nothing changes:
- Article 5(3) of the ePrivacy Directive and, in Germany, Section 25 TDDDG require consent for storing or reading information on a user's device, unless it is strictly necessary for a service the user explicitly asked for. There is no exemption for audience measurement.
- The German Data Protection Conference (DSK) deliberately makes no blanket statement on whether audience measurement without consent is allowed; at most that can be judged for a precisely defined configuration. It treats reading device properties via JavaScript as access, whether or not personal data is involved.
- The European Data Protection Board, in its Guidelines 2/2023, explicitly brings JavaScript-based requests and tracking pixels into the scope of the cookie rule. Cookieless does not automatically mean consent-free.
France is different: the CNIL allows audience measurement without consent if it is tightly configured and produces only anonymous statistics, and Matomo says it can be set up that way. For Germany, however, Matomo itself recommends treating JavaScript tracking as requiring consent until a supervisory authority says otherwise. According to Matomo, only server-side analysis, such as web server logs, is clearly outside Section 25.
What this means for your consent setup
The key takeaway: don't tune your setup for a relaxation that may or may not come. Build it for the rules that apply today. In practice:
- Make refusing as easy as accepting. The Omnibus wants to write a one-click refusal into law, but consent already has to be freely given. A prominent "Accept all" next to a hidden "Reject" puts the validity of that consent at risk today, not after the reform.
- Measure sparingly. Your own server instead of a third party, masked IP addresses, short retention and no sharing of the data. Under any plausible version of the Omnibus this is the right starting point, because the planned exemption covers exactly this kind of first-party measurement.
- Classify your analytics honestly. Measure with consent; measure without consent only in a narrowly defined configuration and after talking to your data protection adviser; or analyse server-side via logs. Our article on cookieless Matomo walks through the settings.
- Keep the setup easy to change. Wire your consent logic so analytics depends on one switch that decides whether Matomo measures only after consent. If an audience-measurement exemption arrives, that becomes a configuration change instead of a rebuild.
Planning on two tracks therefore doesn't mean running two setups. It means working cleanly under current law today and building a setup that can follow a later relaxation with little effort.
How are you handling the Digital Omnibus: already planning around it, or waiting to see what is finally adopted? If you'd like to put your Matomo setup to the test, talk to us.
