The Digital Omnibus cookie reform proposes changes to the GDPR by introducing Article 88a and Article 88b. It aims to reduce Cookie Consent fatigue by introducing automated browser signals and banning cookie banners for six months after a refusal.

EU Cookie Banner rules require websites to obtain Cookie Consent before setting cookies and other trackers on users’ devices. Almost every website asks visitors to accept, reject, or configure cookies, often through several layers of settings. This creates so-called cookie consent fatigue: users are asked for Cookie Consent so frequently that many simply select the fastest choice without considering other options.

The European Commission wants to change that. On 19 November 2025, the Commission presented its Digital Omnibus proposal, COM(2025) 837, as part of a wider effort to simplify the EU's digital regulatory framework. 

The EU Cookie Consent reform will affect how websites obtain consent for cookies and similar tracking technologies. Under the proposed approach, users would select their consent preferences once at the browser level, and those preferences would be communicated automatically to other websites, eliminating the need to respond to individual banners on each site.

The Commission’s proposal also introduces other changes for the GDPR, the eprivacy Directive, data rules, and cybersecurity requirements.

For website owners, publishers, advertisers, and consent management providers, the proposal could eventually change both when cookie consent is required and how consent banners are used.

However, these changes are not yet final. As of September 2026, the Digital Omnibus proposal remains in the EU ordinary legislative procedure and still needs committee approval. EU legislation of this type requires the Council and the Parliament to reach a joint position before any change to the law takes effect.

Businesses should therefore treat these measures as proposed requirements rather than rules that have already replaced the current framework.

EU Digital Omnibus Cookie Reform: What the European Commission Proposed

The European Commission proposed consolidating cookie-tracking rules into the GDPR, implementing browser-level signals for cookie preferences, banning websites from asking users repeatedly for the same purpose for six months, respecting single-click cookie refusal, and changing consent requirements.

Today, cookies in the European Economic Area (EEA) are governed by the eprivacy Directive and the GDPR. The eprivacy Directive generally governs storing or accessing information on a user's device, while the GDPR applies when the collected or processed user information includes personal data.

The Commission argues that these two frameworks can create legal uncertainty and additional compliance costs. It proposed Article 88a, that would align the processing of personal data directly within the GDPR framework.

The Commission aims to reduce unnecessary consent requests while preserving users' control over access to their devices and personal data.

Key proposed changes include:

• Fewer overlapping rules
  The proposal consolidates cookie tracking rules into the GDPR, ruling out the old eprivacy Directive.
• Browser-level signals
  New rules under Article 88b would let users set their privacy choices once, directly in their web browser. Websites must read these signals and apply selected preferences automatically without requiring users to click the banner every time.
• Six-month re-prompt ban
  When users reject cookies on a Cookie Banner, Article 88a bans websites from asking users repeatedly for the same purpose for six months.
• Single-click refusal
  Banners must make rejecting non-essential cookies just as easy as accepting them. Article 88b explicitly prevents using dark patterns for obtaining consent, such as confusing designs or hidden options.  
• Consent requirements
  Consent would remain an important principle. However, the proposal introduces a limited set of circumstances in which consent would not be required.

Consent would still be required for collecting, storing, or processing personal data. However, consent would not be necessary in limited cases, including data processing necessary to transmit electronic communications, provide a service specifically requested by the user, maintain or restore the security of a requested service or device, and produce aggregated information for measuring the audience of an online service when the measurement is carried out by the service controller solely for its own use.

That last category is particularly important for website analytics. Limited, First-party audience measurement could potentially operate without user consent.

However, these changes are not yet final. The proposal needs to be approved by the committee. This means that current cookie laws remain fully active until the proposal is adopted.

Scan your website for free to see all your website cookies and other tracking technologies in use:

What the EU Digital Omnibus Could Change for Cookie Banners

The European Commission's Digital Omnibus introduces requirements for single-click cookie refusal, a six-month cookie-banner re-prompt ban, and centralized privacy preferences. However, EU Digital Omnibus cookie reform will not eliminate banners. Websites would still display banners to provide mandatory legal information, request consent once every 6 months, or handle withdrawals.

The Digital Omnibus introduces Article 88a and Article 88b, governing cookie banners and cookie consent.

The key cookie banner changes include:

• Single-click refusal of cookies.
• Six-month cookie banner re-prompt ban.
• Centralized privacy preferences.
• Single-click refusal of cookies.

The Commission's central proposal is straightforward: users must be able to refuse consent with a single click or an equivalent simple action.

The proposed Article 88a says users must be able to decline a consent request as easily as accept it. Hiding “Reject all" behind additional menus or multiple configuration screens would be banned.

Six-month cookie banner re-prompt ban

If a visitor rejects consent, the website should not ask again for the same purpose for at least six months. When a person accepts consent, a new request for the same purpose is also not allowed, while the existing consent can still lawfully be relied upon.

Users would get considerably fewer repetitive pop-ups.

Businesses and consent management platforms would need to implement new technical requirements to store and respect previous consent decisions.

Centralized privacy preferences

Browser-level consent preferences would be the biggest long-term change.

Under Article 88b, controllers would be required to recognize and respect user privacy signals.

Users could configure their privacy preferences once, through a browser or another supported tool, so they wouldn’t need to make cookie choices separately on every website. Websites, apps, and other online interfaces would need to support automated, machine-readable ways for users to communicate their consent decisions.

The system would depend on technical standards that still need to be developed. A 2026 Commission standardization program specifically refers to standards intended to reduce cookie consent fatigue through centrally communicated preferences.

Implementation periods

The Commission's proposal would have transition periods. Under the original proposal, requirements for websites to support machine-readable signals would begin 24 months after the regulation enters into force, while larger browser providers could take longer to provide the necessary technical mechanisms.

Taken together, the proposed reforms aim to implement a cookie management model where banners’ display is significantly reduced, consent requests are reserved for processing that genuinely requires a user decision, and user preferences can be communicated automatically.

However, the EU Digital Omnibus cookie reform will not eliminate banners. Websites would still display banners to provide mandatory legal information, ask for consent once in 6 months, or handle withdrawals.

The easiest way to create cookie banners for your website, obtain and store user consent, and comply with current or proposed regulatory frameworks is to use a centralized Consent Management Platform (CMP).

What Businesses Should Do to Prepare for the New Consent Rules

EU Digital Omnibus Cookie Reform is still going through the EU legislative process; thus, businesses should therefore comply with the relevant framework: GDPR and the ePrivacy Directive. Requirements for websites to support machine-readable signals would begin 24 months after the regulation becomes effective, so businesses should monitor the legislative process.

EU Cookie Law changes are not finished yet. The legislation is still going through the EU legislative process, and Parliament and Council can amend the proposed requirements. Existing GDPR and ePrivacy requirements therefore remain the relevant compliance framework. EU consent rules in 2026 remain the same.

• You still need consent for non-essential cookies
  That consent must be freely given, specific, informed, and unambiguous.
• Rejecting cookies should be as easy as accepting them
  Focus on banner design and avoid dark patterns. Pre-ticked consent boxes are not valid, since they make the rejection option harder than the acceptance option.
• Websites should ensure they store user cookie preferences and remember refusals
  Under the six-month rule, platforms will need mechanisms that prevent users who have rejected a particular purpose from repeatedly receiving the same consent request.
• Centralized privacy preferences
  If Article 88b passes, businesses will need to adapt their consent management architecture to handle browser-level signals alongside banner-based consent. That is a technical and operational change, requiring changes in consent infrastructure. Websites will need to respond to browser-level or machine-readable privacy signals. However, the relevant standards have not yet been finalized, so implementing a specific technical solution today would be premature.
• Analytics setups deserve particular attention
  The proposed exemption for aggregated, controller-only audience measurement could reduce the need for consent in some scenarios. However, third-party sharing, user-level tracking, advertising integrations, or using analytics information for additional purposes would still require user consent.
• Finally, businesses should monitor the legislative process
  The final regulation could differ substantially from the Commission's November 2025 proposal, and technical standards for machine-readable consent will be critical to understanding how the proposed changes will work in practice.

Use a Consent Management Platform to manage user consent. CookieScript CMP automatically updates to new regulations and changes, so you can rely on it, without needing to monitor the legislative process by yourself.

In addition, CookieScript CMP delivers the right balance of compliance, affordability, and ease of use. You’ll get a fully compliant consent management tool for as little as €8 per month/ per domain for basic features or for €19 per month/ per domain for full compliance with current and upcoming European frameworks.

Frequently Asked Questions

What could change for cookie banners under the EU Digital Omnibus?

The European Commission's Digital Omnibus introduces requirements for single-click cookie refusal, a six-month cookie-banner re-prompt ban, and centralized privacy preferences. However, the EU Digital Omnibus cookie reform will not eliminate banners, which are still needed to provide mandatory legal information, ask for consent once every 6 months, or handle withdrawals. 

What are EU Digital Omnibus cookie consent changes?

Consent would remain an important principle. However, the EU cookie consent reform introduces circumstances in which consent would not be required, including data processing necessary to transmit electronic communications, provide a service specifically requested by the user, maintain or restore the security of a requested service or device, and produce aggregated information for measuring the audience for its own use. 

How does Digital Omnibus affect cookie banners?

The proposed changes could affect cookie banners by making consent requests simpler and less frequent. The European Commission proposes allowing users to reject cookies with one click, requiring websites to respect consent choices for at least six months, and enabling users to communicate privacy preferences through browsers or other central settings. Use CookieScript CMP to deliver cookie banners and obtain user consent.

Will EU Digital Omnibus remove cookie banners?

No. The proposal would not eliminate cookie banners entirely, but it could reduce how often they appear. Some low-risk or necessary uses may no longer require consent, while users could also manage certain preferences through browser-level settings. Use CookieScript CMP to deliver cookie banners.

Are the new EU cookie consent rules already in force?

No. The Digital Omnibus cookie reforms are still proposed changes and may be amended during the EU legislative process. Businesses should continue following the current GDPR and ePrivacy rules until new requirements are formally adopted.