EU governments are close to a negotiating mandate that would give publishers a shorter consent memory. On Sunday, EU ambassadors are expected to vote on the Digital Omnibus draft. The 163-page Council text, dated October 2, keeps cookie rules inside the ePrivacy Directive but changes two details marketers will feel quickly: a refusal re-ask window shortened from six months to four, and a consent exemption for measuring contextual ads.
The cookie ask gets a four-month cooldown
Under the draft Article 5(3), a user who refuses consent cannot be asked again for the same purpose for at least four months. That is down from the Commission’s six-month proposal and the Council’s own September 3 text. The draft also keeps a single-click refusal requirement.
The text allows earlier re-asks when the processing purpose changes, a new service appears, there are substantial changes, or the stored refusal disappears outside the provider’s control, for example when a browser clears cookies.
For publishers, the practical effect is a cooldown timer, not a hard wall. If the refusal record vanishes, the clock effectively resets.
Contextual measurement gets a narrow pass
The consent exemption ad teams should read closely covers measuring the display and performance of contextual advertising, meaning ads matched to the immediate page content or a single search query.
The scope is deliberately tight. Measurement data must be pseudonymised after collection and cannot be used for profiling or programmatic advertising. The draft also bars processing past or future activity, including cross-site behaviour. Frequency capping is named, but it sits near a fuzzy line because remembering that a device has already seen an ad involves a form of past activity.
What else shifts underneath ad tech
The Council has removed the earlier plan to force browsers’ consent signals to be honoured. Cookie rules stay in the ePrivacy Directive, with GDPR authorities enforcing them, so implementation is likely to vary by member state.
On the GDPR side, the draft makes personal data relative: information is not personal for a company that cannot reasonably identify the person, even if another receiver could. That matters for measurement vendors, clean rooms and anyone receiving pseudonymised event data without a re-identification key. Data protection bodies have opposed the change, but the Council kept it.
AI processing also gets a legitimate-interest route, with the right to object. A broad research definition now accepts that commercial interests can co-exist with scientific research.
None of this is law yet. The European Parliament must adopt its own position, then negotiate a final text with the Council.
What to line up now
- Check how your consent management platform stores refusals, and whether that record survives browser clean-ups.
- Keep contextual measurement infrastructure separate from programmatic and profile-building pipes.
- Review pseudonymisation contracts: if a vendor gets tokenised data without a key, your data-processing terms may need to change.
The next checkpoint is parliamentary negotiations. The smart move is to treat the four-month window as directionally likely, not final, and build measurement workflows that can switch on quickly when the text firms up.
Source: PPC Land
