Digital Omnibus: What the EU Council Plans for Cookie Banners

On October 21, 2026 (updated October 22, 2026), EU member states agreed on a common Council negotiating mandate on the Digital Omnibus. The Digital Omnibus is an EU legislative package designed to simplify multiple digital regulations. It bundles targeted amendments to the General Data Protection Regulation (GDPR), the ePrivacy Directive, the Data Act, the AI Act, and cybersecurity incident reporting.

Crucial context (Status: October 26, 2026): The Council position is not yet binding law, but the member states’ mandate for upcoming negotiations. As reported by heise online, the European Parliament still has to adopt its own plenary position before the Council, Parliament, and European Commission negotiate the final legislative text in trilogue talks.

To reduce "cookie banner fatigue", the Council proposes ending the current split between the ePrivacy Directive and the GDPR: whenever storing or accessing terminal equipment data involves personal data, GDPR rules alone would apply, leaving the ePrivacy Directive to cover non-personal data (EU Council press release). Users must be able to withdraw consent with a single click, while small and medium-sized enterprises (SMEs) would benefit from simplified record-keeping obligations.

According to industry reports by PPC Land and UniConsent, the mandate text (Document 14756/26) outlines six consent-exempt purposes—including first-party audience measurement, security, and technical service delivery—along with a four-month waiting period before websites may ask again after a user declines. However, member states removed a mandatory obligation for websites to honor automated browser privacy signals (heise online report). Until a new EU regulation takes effect, Section 25 TDDDG remains in force in Germany.

For website operators, the most important rule is simple: do not disable your cookie banner prematurely. Until trilogue negotiations conclude and the final rules take effect, Section 25 TDDDG and the current GDPR remain fully enforceable. Removing consent banners for non-essential scripts today still exposes your business to legal warnings and regulatory fines.

Our assessment: Companies that prioritize a lean, privacy-first setup during a website relaunch already benefit from faster load times today and will need minimal changes once the reform passes. Our recommendation for the coming months:

Alongside privacy rules, website owners should note an important technical release: on October 14, 2026, the Next.js team published an official Next.js security update with patched versions 16.4.1 and 15.5.28, followed by patch release 16.4.3 on October 23, 2026 (Next.js GitHub Releases). The update resolves three vulnerabilities: a High-severity Denial of Service in Server Actions triggered by crafted multipart payloads (GHSA-673q-mjm6-r5xr), a Medium-severity Open Redirect in adapter routing (GHSA-2464-fhr4-w9xw / CVE-2026-96889, CVSS 5.3), and a Medium-severity bypass of dangerouslyAllowLocalIP in Image Optimization (GHSA-p3m5-59mp-jv5r).

Our assessment: Any production website using Next.js 15 or 16—especially sites using Server Actions for forms or bookings—should be updated promptly to prevent service disruption. As a studio for Next.js development in Berlin, we offer ongoing maintenance and technical support: we audit and update your Next.js website promptly.