On 21 October the Council of the EU agreed its negotiating position on the Digital Omnibus, the package the Commission unveiled in November 2025 to "simplify" the GDPR, the ePrivacy Directive, the Data Act and the AI Act. The press release talks about cutting compliance costs while maintaining high standards. What the member states actually deleted is more interesting than what they kept.
Gone is the machine-readable preference signal. The Commission's draft let users state once — in the browser, for example — whether they accept tracking, with websites obliged to honour that choice. Consumer organisations saw it as the best part of the package, because it would have made the cookie banner redundant for anyone who had already answered the question. The Council removed it, according to the c't privacy podcast Auslegungssache, against determined opposition from the German government. What remains are carve-outs: no consent is needed for cookies strictly required to provide a service, for audience measurement, or to check whether a user's device is secure — and a site that is refused may ask again after four months.
The AI-training provisions moved the other way too. The Council kept the GDPR's existing definition of personal data, rejecting the Commission's attempt to narrow it, which privacy regulators had warned would shrink the concept of personal data. But on training models with personal data it hardened the Commission's text: the unconditional right to object was struck. Member states added "clarifications" on lawful grounds and safeguards instead. They also made it easier for companies to reject manifestly unfounded or excessive access requests — a change German data protection officers, who see revenge requests regularly, welcome and consumer advocates do not.
The lobbying around the file has been intense; Lobbycontrol and the Corporate Europe Observatory documented a wave of tech-industry representations. Germany's vzbv, which keeps a Brussels office because more than 80 percent of consumer-protection law is now made there, wants the omnibus rewritten or at least the preference signals restored.
Next: the European Parliament aims to fix its position by February, then trilogue negotiations between Parliament, Council and Commission begin. Nothing is final, and the Parliament has historically been the more privacy-friendly of the three institutions. But the direction is set: the "clarification" is turning into a deregulation, and the one measure that would have given citizens a single, portable answer to cookie banners is no longer in the Council's text.
