Digital Omnibus: the end of cookie banners is not happening

For eight months, one headline has kept coming back: Europe is about to abolish cookie banners. The provision that carried this promise was withdrawn from the Council's position on June 18, 2026. Here is the real state of play, what remains, and what to conclude for a site in production.

Article up to date as of July 25, 2026. The file is evolving; we will update it as the steps unfold.

Where this reform comes from

The ePrivacy regulation, under negotiation since 2017, was formally withdrawn by the Commission in February 2025, for lack of agreement between co-legislators. The rules on trackers therefore remained governed by the 2002 ePrivacy directive, transposed in France by article 82 of the Informatique et Libertés law (the French Data Protection Act).

On November 19, 2025, the Commission presented the Digital Omnibus package, which proposes, among other things, to bring the cookie rules into the GDPR itself. The package is split into two texts: an artificial intelligence part, and a data and privacy part, which includes cookies.

The first moved quickly: a provisional agreement was reached overnight on May 6 to 7, 2026 on the simplification of the AI regulation. The second is progressing more slowly, as member states are divided on any change to the GDPR.

The browser signal, and its withdrawal

The most discussed provision provided for a mechanism of preferences expressed once and for all in the browser, which sites would have been legally bound to respect. It is what fueled the headlines about the disappearance of pop-ups.

The Council removed it from its position adopted on June 18, 2026. Germany, France and Poland were among the states in favor of the withdrawal. The association noyb attributes this reversal to lobbying by the advertising industry and reports a document submitted by Google to that effect.

The European Parliament has not yet taken a position, and negotiations with the Council continue; the trilogues were expected under the Irish presidency from July 1, 2026. noyb is calling on Parliament to reintroduce the provision. Nothing is therefore definitively settled, but the scenario of a quick abolition of banners has clearly receded.

What remains on the table

The cookie part is not limited to this provision. Other options remain under discussion:

• Broader exemptions for certain trackers considered low-risk (audience measurement, security, aggregated statistics) that would no longer require explicit consent;
• A minimum validity period for choices, to prevent a refusal from being asked again on every visit;
• Integration into the GDPR of the rules currently carried by the ePrivacy directive, with the harmonization between member states that this implies.

To this is added a distinct but converging text: the Digital Fairness Act, expected in the fourth quarter of 2026, which targets deceptive interfaces. Unbalanced cookie banners are explicitly cited in it as an example of a dark pattern. A Commission study noted in 2022 that 97% of the most-used websites and apps in the Union used at least one such practice.

The overall direction is therefore twofold, and often misread: fewer unnecessary banners on one side, more requirements on those that remain on the other.

What this changes for your site: nothing, today

This needs to be said plainly, because the confusion is widespread:

• No rule has changed. Article 82 applies in the same terms as in 2025, and the CNIL's recommendations (the CNIL is the French data protection authority) remain the reference.
• Inspections continue. More than a quarter of the sanctions issued by the CNIL concern cookies: setting them without consent, insufficient information, refusals not taken into account.
• The timeline is long. Even if adoption happened at the end of 2026, a later entry into application and a compliance period would have to be expected. 2027 at the earliest, and on a text whose final content remains open.

Delaying your compliance while waiting for the reform is therefore a losing bet: the risk is immediate, the benefit hypothetical and distant.

The underlying lesson

This withdrawal says something useful about the period. The idea of a single signal respected by everyone is popular with internet users, supported by privacy advocacy groups, and technically available for years, but it runs up against considerable economic interests. It will not come about through law in the short term.

This leaves room for voluntary action. The Global Privacy Control exists, it is sent by millions of browsers, and nothing prevents a publisher from respecting it right now. Consenteer does so by default, in every plan, not because a text requires it, but because an expressed refusal remains a refusal, whatever the channel through which it is expressed.

The best positioning while Europe makes up its mind is this one: do not wait.