EU member states have agreed their negotiating position on the Digital Omnibus. For websites the key point is that the wait before re-asking a visitor who declined cookies shrinks from six to four months. Nothing is law yet, but now is a good time to tidy up your cookies.
What happened?
On 21 October 2026 EU ambassadors (Coreper) agreed the Council’s mandate on the Digital Omnibus, a simplification package covering GDPR and ePrivacy, i.e. the cookie rules. See PPC Land, Relevant Audience and law firm Heuking.
What changes for cookies?
According to these sources: after a refusal you may not ask again for the same purpose for at least four months (the Commission proposed six); earlier requests are allowed if the purpose changes or the user deleted cookies; users must be able to refuse with a single click or equivalent; and some purposes, such as technical security and limited first-party audience measurement, need no consent. The browser-signal obligation is not in the Council text, though Parliament could reintroduce it.
Is it law?
No. Parliament must adopt its position first, then the institutions negotiate. Heuking does not expect the rules to apply before 2027.
What should you do now?
List all cookies, pixels and scripts; keep measurement and advertising tags separate; make sure the ”Reject” button is as clear as ”Accept”; and check that your consent tool logs choices and lets you configure the re-ask period. This is a summary of news reports, not legal advice.
Sources: PPC Land, Relevant Audience, Heuking.
Need help reviewing the tags and tracking on your website? Adeo Marketing builds and maintains websites – get in touch.