Contents5
On 19 November 2025, the European Commission proposed to simplify several digital laws in one go, under the name Digital Omnibus. The AI part became Regulation (EU) 2026/1744, in force since 27 July 2026. The other part, which amends the GDPR and moves the cookie rules, did not follow: on 7 October 2026, the Member States’ ambassadors were due to adopt the Council’s position, and the vote was postponed.
This post from our Business AI section takes stock as of 19 October 2026. It is not legal advice: until the text is adopted, your DPO sticks to the GDPR and to national cookie rules as they stand.
In short
The GDPR and the cookie rules have not changed: the data part of the Omnibus is still at first reading.
The proposal redefines personal data, opens legitimate interest for training or running AI, and eases cookie consent.
In Parliament, over 1,750 amendments have been tabled; in the Council, the mandate vote was cancelled in June, then postponed on 7 October under pressure from Germany and France.
The Council’s latest compromise text, dated 2 October, has already dropped several new features, including browser-level cookie settings.
What does the Digital Omnibus propose for the GDPR and cookies?
The Commission’s proposal covers four points that concern a business, according to the European Parliament’s legislative tracker, updated on 20 September 2026:
The Parliament’s official summary: pseudonymised data, legitimate interest for AI, cookie rules moved into the GDPR, a single reporting point for incidents. Captured on 19 October 2026.
- Personal data: pseudonymised data would no longer be personal data for an entity that has no means of re-identifying the person.
- AI: businesses could rely on the GDPR’s legitimate interest to use personal data to train or run AI systems, under conditions.
- Cookies: their rules would move from the ePrivacy Directive to the GDPR, with more processing exempt from consent, one-click consent valid for six months and preferences saved in the browser or the system.
- Incidents: a single reporting point for cybersecurity incidents and data breaches.
On legitimate interest, the change would be less radical than it looks in France: in its June 2025 recommendations, the French data protection authority, the CNIL, already considers legitimate interest a possible legal basis for developing an AI system, provided strong safeguards are taken.
Where do the negotiations stand?
- 19 November 2025
The Commission presents the proposal.
- 22 June 2026
Parliament’s rapporteurs publish their draft report; over 1,750 amendments are tabled in committee until 15 July.
- 26 June 2026
The Council mandate vote, prepared by the Cypriot presidency, is cancelled for lack of agreement.
- 27 July 2026
The AI part enters into force, on its own.
- 2 October 2026
The Irish presidency sends the ambassadors a mandate text.
- 7 October 2026
The vote is postponed to 11 October, under pressure from Germany and France.
The disagreement is less about the GDPR than about the Data Act, which the same text amends. Germany and France consider the protection of trade secrets insufficient when a user requests the data of a connected product; Berlin wants an “explicit agreement” from the data holder, and also proposes a category of “low-risk data controllers” exempt from part of the GDPR, according to Agence Europe. As of 13 October, the outcome of the 11 October meeting had not been announced, notes lawyer Nicola Fabiano’s newsletter, and as of 19 October we found no announcement of an adopted mandate. Commentators do not expect the data part to be adopted before late 2026 at the earliest, and the text may still change substantially, warns Acompli.
In Parliament, the two rapporteurs did not propose key amendments on the definition of personal data or on cookies, leaving these points to negotiations between committees, according to the Parliament’s tracker. Their amendments diverge: one proposes deleting the new definition, the other keeping it with clarifications, notes EUTechReg’s analysis of the file.
What the Council compromise has already dropped
The mandate text of 2 October shows that the proposal has moved a lot even before negotiations with Parliament, according to EUTechReg’s analysis, which compares the successive versions:
Commission proposal
New general definition of personal data in Article 4
Cookie rules moved into the GDPR
One-click consent setting in the browser
Legitimate interest for AI, with a right to object
Council mandate text, 2 October
General definition unchanged; a specific rule for pseudonymised data
Cookie rules kept in the ePrivacy Directive
No automated browser signal; four months before asking again for a refused consent
Legitimate interest for AI kept, right to object restated
The Council text also keeps consent exemptions for audience measurement and contextual advertising, under conditions. None of this is final: Parliament has not voted its position, and negotiations between the two institutions have not started.
Watch out
Do not change your cookie banner or how often you ask again on the strength of a draft. Until a text is adopted and applicable, audience measurement or ad tracking set without consent remains subject to the current rules, which data protection authorities enforce.
What it changes for a team of 20 to 500 people
For now, nothing in your obligations. But three pieces of work are worth preparing, because they will serve whatever the final text:
- Know which tools set what. The inventory of your website’s cookies and trackers, tool by tool, is the prerequisite for any future simplification, as for current compliance.
- Document your uses of data for AI. If legitimate interest becomes an explicit basis, you will have to show the balancing test and the safeguards; that is already what the CNIL asks. Our guide to the AI Act and the GDPR for SMEs gives the outline, and our guide to integrating AI in your business puts it in the overall approach.
- Keep sensitive data in-house. Less personal data sent to a provider means fewer legal questions, whatever the version of the GDPR: the options are in the four levels of private AI.
From the field
Our own contact form stores each request in storage hosted in Europe, under EU jurisdiction, before sending a single email: if sending fails, the request is not lost, and it is kept in Europe. That is the kind of choice that remains valid whatever the outcome of the Omnibus.
The AI part of the same package, already in force, is explained in what the Digital Omnibus changed in the AI Act, and every upcoming deadline is in our digital regulation calendar. Our other regulatory updates this autumn cover the marking of generated content on 2 December, NIS2 in France and Meta’s terms on crawling websites, summarised in our October AI news for business leaders. On the advertising side, what remains possible without third-party trackers is detailed in retargeting without third-party cookies. To map your AI uses and the data they expose, see our AI at the right cost offer.
Frequently asked questions
Has the Digital Omnibus amended the GDPR?
Not yet. Only the AI part of the Omnibus has been adopted, as Regulation (EU) 2026/1744. The part that amends the GDPR and the cookie rules is still at first reading: Parliament has not voted its position, and the Council had not announced a negotiating mandate as of 19 October 2026. The current GDPR applies.
Will cookie banners disappear?
The Commission’s proposal aimed to make them less frequent, with one-click consent valid for six months and preferences saved in the browser. The Council text of 2 October dropped the browser setting and keeps the rules in the ePrivacy Directive. Consent remains the rule for non-essential trackers.
Can legitimate interest already be used to train an AI?
In France, the CNIL has accepted it since June 2025 as a possible legal basis for developing an AI system, provided strong safeguards are taken and a documented balancing test is carried out. The Omnibus would make this possibility explicit in the GDPR, but would not waive the safeguards or the right to object.
When will the GDPR Omnibus be adopted?
No date has been set. First there must be a Council mandate and a Parliament position, then negotiations between the two and a formal adoption. Commentators do not expect the data part to be adopted before late 2026 at the earliest, and it would apply even later.
Sources
- The European Parliament’s legislative tracker (new tab)europarl.europa.eu
- Its June 2025 recommendations (new tab)cnil.fr
- Agence Europe (new tab)agenceurope.eu
- Lawyer Nicola Fabiano’s newsletter (new tab)nicfab.eu
- Acompli (new tab)acompli.ie
- EUTechReg’s analysis of the file (new tab)research.eutechreg.com
Jim · founder of Brain Plus AI
Also in business ai
Understand7 min
Digital Omnibus: what changed in the AI Act
Regulation (EU) 2026/1744, in force since 27 July 2026, revised the AI Act: high-risk rules postponed, AI literacy relaxed, two more prohibitions, relief extended to mid-sized companies. What changes, what does not, and the updated timetable.
Practical guide10 min
AI Act and GDPR: what an SME using AI must do
An SME that uses ChatGPT or a CRM with built-in AI already has obligations. This guide takes stock in October 2026: your role under the AI Act, the timetable revised in July 2026, what the GDPR requires and the steps to get compliant.
Choose and price9 min
Private AI in business: the four levels of control
A "private" AI is not a product, it is a degree of control over your data. We distinguish four levels, from an API used as is to a model installed on your premises, and a simple way to choose task by task.