What the Digital Omnibus Is

In November 2025 the European Commission published a package known as the Digital Omnibus, a set of proposals meant to simplify and align several EU digital rules. One part of it touches the rules publishers deal with every day: how websites and apps may store or read information on a user's device, and how that interacts with the GDPR.

It is important to be precise about status. The Omnibus is a legislative proposal. It has to pass through the European Parliament and the Council, and the text can change along the way. Until a final act is adopted and its application date arrives, the current ePrivacy and GDPR rules continue to apply as they do today.

Why Cookie Rules Are in Scope

Today, Article 5(3) of the ePrivacy Directive requires consent before information is stored on, or read from, a device, unless an exemption applies. The GDPR then applies separately to any personal data processed afterward. Publishers therefore deal with two overlapping regimes, enforced by different authorities in many member states. The Omnibus aims to reduce that overlap and the volume of banners users see.

The Main Ideas in the Proposal

As presented, the proposal contains several ideas that matter to publishers. Check the current text before relying on any of them:

• Personal-data processing moves under the GDPR. Where the information read from a device is personal data, the legal basis would be assessed under the GDPR rather than through the separate ePrivacy consent rule.
• A short list of low-risk purposes. Some narrow purposes, such as security or certain aggregated audience measurement, would be allowed without a banner.
• Easier refusal. A single-click way to refuse, and a pause before the user is asked again after declining.
• Machine-readable preference signals. Browsers and operating systems would be expected to offer a way to express choices that sites must respect, once standards exist.

What Probably Does Not Change

Even if the proposal is adopted largely as written, several things stay the same in practice:

• Advertising and cross-site profiling will still need a valid legal basis, and for most ad personalization that is consent.
• You will still need to know which tags and vendors run on each page.
• Records of consent will still matter if a regulator or a user asks what was agreed.
• Rules outside the EU, such as UK and US state laws, are unaffected by this proposal.

How to Prepare Without Over-Reacting

Do not rip out your current setup in anticipation. Instead, use the waiting period for work that pays off under any outcome:

1. Inventory your tags. Group them by purpose: strictly necessary, measurement, advertising, personalization.
2. Separate measurement from advertising. If low-risk measurement does get a lighter regime, you will want it already isolated.
3. Make sure refusal is as easy as acceptance. This is already expected by regulators and fits the direction of the proposal.
4. Plan for browser signals. You already may need to honor signals such as Global Privacy Control in some jurisdictions, so build a clear internal rule for what an automatic signal does to your tags.
5. Track the legislative calendar. Assign one person to check the status each quarter.

What It Means for Ad Revenue

If consent requirements for some measurement narrow while advertising keeps its consent requirement, the main effect on revenue will be on how much first-party measurement you can run without a banner interaction. Programmatic demand will still depend on a valid consent signal for personalized ads, so TCF and Google Consent Mode signals remain important for monetization.

How FlexyConsent Helps

FlexyConsent is a CMP certified by Google (CMP ID 317), IAB Europe and IAB Canada, with support for IAB TCF 2.4 and Google Consent Mode v2, and the banner is available in 57 languages. Whatever final shape the rules take, you can keep the consent signals your ad stack reads in one place while the legal text settles.

Key Takeaways

• The Digital Omnibus is a proposal, not yet the rule; current ePrivacy and GDPR obligations still apply.
• It targets overlap between ePrivacy and the GDPR and proposes easier refusal and browser-level signals.
• Advertising personalization is still expected to need consent.
• Use the wait to inventory tags, separate measurement from advertising and keep refusal easy.
• Check the legislative status regularly and rely on your legal advisers for final decisions.