European Cookie Rules: The ePrivacy Directive, the Withdrawn ePrivacy Regulation and the Digital Omnibus

The withdrawal of the proposed ePrivacy Regulation did not remove the cookie consent requirement. The ePrivacy Directive and national implementing laws continue to apply. The Digital Omnibus proposal concerning data and cookies remains a legislative project: the European Parliament procedure file still records an outstanding committee decision on 24 October 2026.

The article distinguishes the rules currently in force, a withdrawn proposal and a proposal still under discussion. Keeping current obligations separate from proposed changes prevents a consent banner from being rebuilt around rules that have not been adopted.

What applies today

Article 5(3) concerns storing information on a device and accessing information already stored there. The protection includes information without a personal character. The two exceptions cover storage or access for the sole purpose of transmitting a communication over an electronic communications network, and operations strictly necessary for an explicitly requested information society service. In Germany, section 25 TDDDG implements these requirements and expressly refers to transmission over a public telecommunications network.

Subsequent processing of personal data also needs to satisfy the GDPR. An exemption from device-access consent is therefore not a general exemption from data protection law. Conversely, an interest assessment under the GDPR cannot replace consent required for device access.

What was withdrawn

The Commission approved withdrawal of the 2017 regulation proposal on 16 July 2025; publication followed in Official Journal C/2025/5423 on 6 October 2025. The European Parliament records both dates. The intended replacement ended, while existing law remained applicable. That does not mean the directive has never changed or can never be amended.

What the original Digital Omnibus proposed

The Commission proposal of 19 November 2025 would place personal-data-related device access in new GDPR Article 88a. Non-personal information would remain under the directive. Proposed exceptions include limited audience measurement and security purposes. These are changes to the existing framework, not merely a restatement of its two exceptions.

The original proposal also envisages a six-month interval before a renewed consent request for the same purpose following refusal. Article 88b concerns consent choices in a form that software can read and process automatically. These mechanisms could reduce repeated prompts; neither amounts to a guarantee that every banner would disappear. References to these article numbers describe the Commission proposal, not an adopted final text.

The pending cookie/data file must also be distinguished from the separate AI Omnibus procedure. Adoption of another part of the simplification programme does not bring the proposed cookie rules into force. A future implementation timetable depends on the adopted text and its published application dates.

Why hosting location does not decide the analytics question

Self-hosted analytics is not automatically exempt, and use of an external processor does not automatically rule out an exemption. The assessment depends on which data is collected, why it is collected, who receives it and what else it is used for.

The French CNIL permits narrowly limited audience measurement under published conditions. A processor may serve several publishers when the data and trackers remain independent for each publisher. Some tools can be configured to disable the provider’s own reuse. These French criteria are not a blanket exemption under German law or a certification of every product carrying an analytics label.

A product name such as GA4 or Meta Pixel does not replace an inventory of actual operations. A useful inventory records each cookie or storage access, purpose, lifetime, recipient, configuration and legal justification. A generic declaration that all hosted testing crosses customer boundaries is insufficient.

What a consent interface needs now

Consent-dependent storage and access must remain blocked until valid consent. Acceptance, refusal and withdrawal must correspond to the actual behaviour of tags and requests. The EDPB cookie-banner taskforce found that a large majority of authorities regard missing refusal options alongside acceptance as incompatible with valid consent. The CNIL expressly requires refusal to be as easy as acceptance.

A practical verification covers a fresh visit, refusal, a later return, acceptance and withdrawal. The checks cover both information saved in the browser and data sent from the browser to servers. A visible banner alone does not demonstrate that tracking is blocked. These checks apply under current requirements; waiting for the Omnibus does not solve an existing consent defect.