The EU’s cookie consent rewrite has lost its browser-signal fix, for now
In this post
Where things stand
The EU’s plan to move cookie consent rules out of the ePrivacy Directive and into the GDPR is still under negotiation. Nothing in it is law. The Council of the EU has removed the provision that would have let a browser-level signal replace individual cookie banners. Parliament has not adopted its position, and trilogue negotiations have not started.
Until a final text is adopted and applies, Article 5(3) of the ePrivacy Directive, as transposed in each member state, continues to govern cookie consent.
How we got here
In its 2025 work programme, published on 11 February 2025, the European Commission announced that it would withdraw its proposed ePrivacy Regulation. The proposal had been stuck for about eight years without agreement between the co-legislators. On 19 November 2025 the Commission put forward the Digital Omnibus (COM(2025) 837, procedure 2025/0360(COD)). Among other things, it would add two articles to the GDPR on storing and accessing information on users’ devices.
Article 88a: what the proposal would require
Article 88a would keep consent as the default for storing or accessing information on a user’s device, and would list a short set of exceptions where consent is not needed. These include transmitting a communication over a network, providing a service the user has explicitly requested, aggregated audience measurement carried out by the service provider solely for its own use, and maintaining or restoring security.
Two of its rules matter most for how a consent interface behaves. A user must be able to refuse with a single click or an equivalent means. After a refusal, the controller may not ask again for consent for the same purpose for at least six months. Both rules turn into explicit legal requirements standards that European regulators already enforce on cookie banners under current law.
Reporting on the Council’s June 2026 compromise text says Article 88a is still in it, including the single-click refusal and the six-month rule.
Article 88b: the browser signal the Council dropped
Article 88b went further. It would have required controllers to respect automated, machine-readable choices that users set once in their browser or operating system, so that each site would no longer need to show its own banner.
The Council’s fifth compromise text, dated 18 June 2026, deleted Article 88b. The document is marked LIMITE and was first reported in the press. noyb has said that Germany, France and Poland were among the member states that supported deleting it, after lobbying by the online advertising industry. That account comes from noyb and press reporting, not from a public Council record.
Deletion from the Council text does not end the measure. On 10 September 2026, a coalition of 19 civil society and consumer organisations, including BEUC, EDRi and noyb, wrote to the Irish Council Presidency, to Parliament’s co-rapporteurs and to the Commission. They asked for Article 88b to be put back in the next compromise text. Parliament can still argue for it in trilogue.
What the regulators said
The EDPB and EDPS adopted Joint Opinion 2/2026 on the Digital Omnibus on 10 February 2026 and published it the following day. They strongly supported finding a regulatory solution to consent fatigue and the spread of cookie banners, in particular through automated, machine-readable indications of users’ choices, which is the Article 88b mechanism. They also pointed to the legal and technical difficulties of running two parallel regimes, one in the GDPR and one left in the ePrivacy Directive.
Separately, they firmly opposed the Omnibus’s proposed changes to the definition of personal data. That dispute runs across the whole package and is not specific to cookies.
The legislative state of play
In Parliament, the file sits jointly with the ITRE and LIBE committees. The co-rapporteurs are Aura Salla (EPP) and Marina Kaljurand (S&D). Their draft report was published on 22 June 2026, and more than 1,750 amendments were tabled after the joint committee discussion on 13 July. No committee vote has been reported.
In the Council, a COREPER vote on a negotiating mandate planned for 26 June 2026 was cancelled because member states had not resolved the open issues. The Irish Presidency, which took over the file on 1 July, has continued work at Antici Group level and has circulated revised compromise options since. At the time of writing, the Council has not adopted a mandate.
The separate AI Omnibus has already been adopted. Do not take that as a sign of the data protection file’s timing. Commentators do not expect the GDPR and cookie provisions to be finally adopted before late 2026 at the earliest, and the text could still change substantially.
What this means for a live consent implementation
Nothing changes in law today. The direction of travel is still useful for planning. Single-click refusal and a minimum interval before asking again appear in both the Commission proposal and the Council text. Supervisory authorities already treat a hard-to-find reject option as a consent defect under current law. A banner that meets those two standards now is unlikely to need rebuilding whatever happens to Article 88b.
Article 88b is the open question. If Parliament secures it in trilogue, sites would eventually have to read and respect browser- or OS-level signals instead of relying only on their own banner. Consent infrastructure should be built so that it can accept an external signal as an input.
Sources
- European Parliament Legislative Train, Digital Omnibus file (status, rapporteurs, draft report, Council mandate): europarl.europa.eu europarl.europa.eu
- Commission 2025 work programme and withdrawal of the ePrivacy Regulation proposal: Hunton Andrews Kurth hunton.com
- EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus: EDPB document, EDPB news release edpb.europa.eu
- Council deletion of Article 88b and noyb reporting: PPC Land ppc.land
- Civil society letter of 10 September 2026: PPC Land ppc.land
- Council negotiations, September 2026: Privacy Next privacynext.eu