SUMMARY

• On the 21st October, the Council adopted its negotiating mandate on the Digital Omnibus, setting out its position on proposed changes to the EU’s digital regulatory framework (see attached).
• The Council’s position includes several positive developments in line with FESI’s advocacy for a more proportionate and workable framework for cookies and online tracking.
• In particular, the Council deletes the proposed new GDPR Articles 88a and 88b, retaining the existing ePrivacy Directive framework for cookies and other tracking technologies. It also introduces additional exemptions from consent requirements for specific purposes, including certain audience measurement, service provision and security activities.
• Once the Parliament adopts its own position (currently expected for Q1 2027), the Council and Parliament will start the trilogues negotiations.

‍

MORE INFORMATION

• Article 88a – Cookies and access to terminal equipment: The Council removes the proposed standalone GDPR provision and retains the rules under Article 5(3) of the ePrivacy Directive. The mandate introduces additional circumstances in which consent would not be required, including for the "Measurement of contextual advertising » (point f), with the aim of reducing cookie banners and simplifying compliance (see p157 Council's proposed Article 5(3) of the ePrivacy Directive).
• Article 88b – Machine-readable consent signals: The Council deletes the proposed provision establishing a framework for automated, machine-readable indications of users’ consent, refusal or objection. This is in line with FESI’s position calling for the deletion of Article 88b and avoiding the introduction of a new mandatory technical framework for consent signals.
• Repeated consent requests: The Council also provides for a minimum four-month interval before a website can request consent again for the same purpose following a refusal.
• NIS2 – Single entry point for incident reporting: The Council’s mandate moves away from the Commission’s proposed EU-level single reporting entry point operated by ENISA, favouring national entry points in Member States (new Article 23b). For companies operating across several Member States, the key question will be whether the revised framework sufficiently harmonises reporting requirements and avoids duplicative notifications (see p159-162 - Article 6-amendments to NIS 2 Directive)

More information here

NEXT STEPS

Following the Council’s approval of its negotiating mandate on 21 October, negotiations with the European Parliament will begin once the Parliament has adopted its own position. The European Parliament’s ITRE and LIBE committees are expected to adopt their position in Q1 2027.