EU Digital Omnibus draft would cut the cookie re-prompt wait from six months to four

EU member states’ ambassadors did not agree a negotiating mandate on the Digital Omnibus when they met on October 7, 2026. The item stalled over trade secrets under the Data Act, a dispute led by Germany, and the ambassadors were expected to take it up again on Sunday, October 11.

The text under discussion is a Council draft dated October 2, 2026. It would change how cookie consent is requested, when AI development can rely on legitimate interest, and how quickly a breach must be reported. The sources below describe the draft. As of October 12, none of them reports what the ambassadors decided on October 11.

Where the Council stands after the October 7 meeting

The ambassadors, meeting as the Council’s Permanent Representatives Committee, ended the October 7 session without a mandate. techUK reports that Germany, joined by France, pressed again for stronger trade secret protection under the Data Act, and that talks were expected to resume within days.

MLex reports that the ambassadors are expected to reconsider the package on Sunday, with a revised draft likely to be circulated beforehand. PPC Land gives October 11 as the date. The MLex article is paywalled after its opening paragraphs, so the rest of its detail could not be checked.

A Council mandate would allow the Presidency to open talks with the European Parliament. The sources reviewed do not say whether a mandate was adopted on October 11, so the draft should be read as a text under negotiation rather than an agreed position.

Cookie re-prompt wait
The October 2, 2026 Council text cuts the wait before a site asks again for cookie consent after a refusal from six months to four, according to PPC Land.

The cookie re-prompt wait would drop from six months to four

Under the Commission’s proposal, a website that receives a refusal to a cookie consent request must wait six months before asking the same visitor again for the same purpose. PPC Land reports that the September 3 Council text kept that six-month period.

Agence Europe reports that the Irish Presidency’s compromise, published in early October, cuts the wait to four months. PPC Land reports the same four-month figure in the October 2 text. Both reports describe the change in the same terms: the wait before asking again for the same purpose.

The two reports agree on the figure, but only two sources reviewed carry it. The draft would shorten the wait before a site asks again for cookie consent from six months to four, and the final figure depends on how the negotiations end.

A consent exemption for contextual ad measurement

PPC Land reports that the October 2 text adds a sixth purpose for which cookies could be placed without consent: measuring the display and performance of contextual advertising. The report says the purpose is new to the Council’s text. Iubenda had reported in May 2026 that a Council compromise dropped a proposed carve-out for contextual ad measurement, and the report says it is now back. Recital 44g covers frequency capping and advertising measurement cookies.

The report sets conditions. Measurement must be done by or for the service provider, and data must be pseudonymised after collection. The data may not be processed for another purpose, including profiling or providing programmatic advertising. The measurement also may not involve processing data on past or future activity, including activity across sites, apps or services.

No other source reviewed describes this exemption in detail, so these conditions rest on a single report and should be checked against the Council text.

AI training would rely on legitimate interest, with limits

According to PPC Land, the October 2 text would let AI development and operation rely on legitimate interest under Article 6(1)(f) of the GDPR. The provision keeps exceptions where consent is required and for children. It also refers expressly to the right to object under Article 21, which the report describes as narrower than the unconditional opt-out the Commission proposed.

A recital in the same text says that AI development does not in itself constitute a legitimate interest and must be assessed case by case. A new Article 9(2)(k) would permit incidental processing of residual data, where not intended by the controller, in AI development and operation, subject to safeguards.

These provisions appear in only one source reviewed. The wording is provisional, and the final version may differ from the October draft.

The draft would shorten the wait before a site asks again for cookie consent from six months to four.

Breach reporting, the browser signal and trade secrets

The October 2 text would extend the breach notification deadline from 72 hours to not later than 96 hours, for breaches likely to result in a high risk, according to PPC Land. The report says Germany had asked the Commission in October 2025 for a three-working-day deadline.

The browser-level consent signal, Article 88b in the Commission proposal, is no longer in the Council text. GDPRLocal reports that Germany, France, Poland and others supported removing it, and that the Council’s position paper published on June 18, 2026 did not include it. PPC Land reports that a September 10 open letter from 19 organisations asked for it to be reinstated. It also cites a Google-commissioned study estimating EUR 40 to 50 billion in annual costs for a browser signal, a figure that noyb disputed.

On the Data Act, Agence Europe describes a compromise that lets data holders refuse an access request if they demonstrate a high risk of unlawful use or disclosure by entities under third-country jurisdictions with insufficient protection. The Commission would issue guidance on assessing serious economic damage. Germany is described as among the states most concerned with trade secrets and with adapting the GDPR. Its proposed category of low-risk controllers is absent from the Presidency text, which instead provides for a future review of GDPR obligations by risk.

What remains unsettled

A Council mandate would be the first step before trilogue talks with Parliament. GDPRLocal reported in a June 24, 2026 post that Parliament had not yet published a position on the browser-signal article. PPC Land reports that the European Council’s March 2026 conclusions called for agreement on all pending Omnibus packages before the end of 2026.

Several points remain open. The Data Act trade-secret wording is the item that reportedly blocked the October 7 vote. The four-month wait, the measurement exemption and the AI-training provisions appear in the October drafts, but the sources do not report whether they will survive negotiation.

PPC Land also reports that the European Data Protection Board and the European Data Protection Supervisor opposed a change to the definition of personal data in February 2026. That objection is part of the record, and PPC Land reports that the Council text includes the change anyway.

Photo: Jimmykreislauf · CC BY-SA 4.0 · via Wikimedia Commons