EU ambassadors are expected to vote on Sunday, October 11, 2026 on a negotiating mandate for the Digital Omnibus, a 163-page draft that would rewrite parts of the GDPR and the ePrivacy Directive. For digital marketers, the headline is simple: the wait after a cookie consent refusal drops from six months to four, and a narrow consent-free lane opens for measuring contextual advertising.
Cookie consent moves back to four months
The Council’s October 2 text keeps cookie rules inside the ePrivacy Directive rather than folding them into the GDPR. Under the rewritten Article 5(3), a user can refuse with a single-click button or equivalent, and the provider cannot make a new request for the same purpose for at least four months. The Commission had proposed six months, and the Council’s own September draft still said six—so this is a late and meaningful softening for publishers.
There is a practical escape hatch. The draft allows a new request within that period if the purpose changes, if a new service is offered, or if the record of the refusal disappears for reasons beyond the provider’s control—for example if the user deletes cookies or browser storage expires. That storage exception matters because Safari and other browsers routinely clear or cap site data, which could restart the clock without any action by the publisher.
A conditional win for contextual ads
The sixth exemption in the draft is the one performance marketers should read closely. Recital 44g explains that simple contextual advertising—matched only to the immediate page or a single search query—typically does not require device access. Measuring display, performance and frequency capping can also run without consent, but with strict limits.
- Data must be pseudonymised after collection.
- It cannot be used for profiling or programmatic advertising.
- It cannot track past or future activity across sites, apps or services.
That last condition leaves an open question: frequency capping by definition remembers that a device has already seen an ad. The draft’s operative text targets cross-site activity, but supervisory authorities will likely have to interpret where a single-site cap sits.
Personal data becomes more relative
Beyond cookies, the Council keeps a Commission change to GDPR Article 4(1): information is not necessarily personal for every entity. A measurement vendor or clean-room operator that receives pseudonymised event data without any means to re-identify users could argue that, for it, the data are not personal. The European Data Protection Board and the EDPS opposed the change, but the Council has kept it anyway.
The draft also gives a narrow legitimate-interest path to develop and operate AI systems, with a right to object in Article 21 rather than an unconditional opt-out. Research definitions now explicitly allow a commercial interest alongside general knowledge, which widens the room for product research.
What to do now
None of this is law. After the Council mandate, the European Parliament still has to set its position and negotiate a final text. But the direction is clear enough to use as a planning scenario.
Start with three checks. Audit consent prompts against a four-month refusal memory; map contextual measurement flows against the pseudonymisation and no-bidding limits; and review analytics setups that pool data across sites, because they likely fall outside the first-party measurement exemption.
This vote is the start of a negotiation, not the finish line. But it shows where the Council is heading: less prompt fatigue, a tightly defined cookie-free lane for contextual measurement, and more room for pseudonymised ad data.
Source: PPC Land
