EU plans fewer cookie banners, but nothing has changed yet

Cookie banners are not being abolished, and website owners should not remove existing consent mechanisms because of the latest EU Council announcement. On 21 October 2026, the Council agreed a negotiating position that would expand the circumstances in which cookies could be placed without consent, including certain audience measurement activities. The proposed changes have not yet become law.

The measures belong to the Digital Omnibus, a broader package intended to simplify European rules on data protection, electronic privacy and incident reporting.

The Council of the EU announced its position on 21 October 2026, updating the release on 22 October.

For businesses operating websites and online shops, the immediate question is what can safely be changed now, rather than what might become possible after negotiations.

Do websites still need cookie consent banners?

Yes, where their use of cookies or similar tracking technologies requires consent under current rules.

The Council's negotiating position retains the existing framework under the ePrivacy Directive.

What it proposes is a clearer and broader set of purposes for which placing cookies would not require consent.

The Council's announcement identifies examples involving:

• Cookies necessary to provide a requested service.
• Certain audience measurement activities.
• Technologies used to maintain the security of a user's device.

The intention is to reduce the number of consent banners visitors encounter while retaining safeguards for personal data.

However, the proposed additional exemptions do not currently apply.

If your analytics or advertising technologies require consent today, that requirement continues.

Nor should the announcement be interpreted as a general exemption covering every form of online tracking.

The final scope will depend on the legislation eventually agreed.

Could website analytics become easier to manage?

Audience measurement is one of the most commercially relevant elements of the proposal.

Many businesses use analytics to understand which pages attract visitors, which content performs well and how users navigate towards important actions.

Current consent requirements depend on the technologies involved and how information is collected and processed.

The Council supports allowing certain audience measurement purposes without requiring consent for placing cookies, subject to the eventual legal conditions.

That could simplify basic website reporting.

But the precise boundaries still have to be negotiated.

It would be premature to disable consent controls for analytics simply because the Council has endorsed this direction.

Instead, businesses can examine what they genuinely need to measure.

Basic reporting does not always require the same level of individual tracking as advertising or behavioural profiling.

A review can identify whether current reporting needs can be met through a more limited collection of data.

This is particularly relevant as online discovery changes. Our article on zero-click searches and their effect on destination websites explains why traffic figures need to be interpreted in the context of actual visitor behaviour.

The Digital Omnibus also addresses data breaches

The Council's position covers more than online tracking.

It supports extending the deadline for notifying certain personal data breaches.

According to NicFab's legal analysis, its reading of the Council's mandate indicates a proposed increase from 72 to 96 hours for the relevant breach notifications.

The same analysis interprets the draft as changing the interval for requesting consent again following a rejection from 6 to 4 months.

These figures come from NicFab's interpretation of the negotiating text, rather than the Council's press release. They are not currently applicable legal changes.

The Council's official announcement also describes a proposed change to incident reporting arrangements.

Instead of the initially proposed single EU-wide entry point, there would be a national reporting entry point in each member state, supported by an EU-level information point.

The Council also maintains the existing definition of personal data while proposing an additional provision addressing pseudonymisation.

Businesses should therefore review their incident response arrangements without assuming that longer notification periods are already available.

What should website owners review today?

A basic technical inventory is more useful at this stage than replacing a consent management system in anticipation of future legislation.

This review can also reveal redundant services or scripts that can be removed independently of the proposed reforms.

There is no need to wait for new legislation to simplify unnecessary tracking.

When might the rules actually change?

The agreement reached on 21 October 2026 establishes the Council's negotiating mandate. It does not complete the legislative process.

The European Parliament must adopt its own position before negotiations between the institutions can proceed.

NicFab's analysis indicates that the Parliament's position is expected in early 2027.

That is not an implementation date.

The final legislation may differ from the current Council proposal, and businesses should not plan compliance changes around an assumed start date.

For now, keeping consent controls in place while improving the underlying tracking setup offers a more reliable approach.

Online retailers can also use the review to address other website obligations. Our guide to online shop accessibility requirements in Spain covers another area that should be included in ongoing digital maintenance.

What should you decide this week?

Keep your existing cookie consent arrangements and make an inventory of the tracking technologies your website actually uses. Review whether analytics can meet your reporting needs with less data collection, and confirm that a breach response procedure exists. Avoid spending money on changes based solely on a negotiating proposal. If you need to review consent settings or analytics across your website or online shop, tell us which tools you currently use so we can assess what should be retained or simplified.