European Cookie Rules: The ePrivacy Directive, the Withdrawn ePrivacy Regulation and the Digital Omnibus

Three things happened to European cookie law in eighteen months. A regulation that had been in preparation since 2017 was withdrawn. A package appeared that would move the consent rules into the GDPR. And in June the Council cut one of that package’s two relevant articles out of its own compromise text.

None of that changed what a website has to do. Sorting the three strands by whether they bind anyone takes one line each, and the sorting is worth doing before the next reorganisation of a consent layer.

What Binds a Site Today

The consent requirement lives in national law, because a directive is transposed rather than applied directly – in Germany section 25 of the TDDDG, elsewhere under other names and with genuinely different details. That is also why enforcement has always been national and why two supervisory authorities can reach different conclusions about the same banner.

What the Withdrawal Actually Withdrew

The proposal for an ePrivacy Regulation was published in 2017, spent eight years without agreement between the co-legislators, and was dropped. The Commission announced the intention on 11 February 2025, approved it on 16 July 2025, and published it in the Official Journal on 6 October 2025.

What ended was the replacement, not the rule. The regulation would have repealed the 2002 directive on the day it applied; withdrawing it means the directive keeps applying, unchanged and indefinitely. The reading that occasionally appears in vendor material – that ePrivacy has been abandoned – inverts what happened. The reform was abandoned. The law it was meant to reform is the reason cookie banners still exist.

What the Digital Omnibus Would Change

The package proposed on 19 November 2025 takes a different route: instead of replacing the directive it amends it and writes the consent rule into the GDPR as Article 88a. The directive is not repealed. Its Article 5(3) would go on governing storage and access that involves no personal data, while everything touching personal data would be handled by the GDPR alone.

The substance of Article 88a is mostly about the banner. Refusal has to be possible through a single-click button or equivalent means. Once consent has been refused, no new request may be made for the same purpose for six months. Once consent has been given, no further banner may appear for that purpose while it remains valid. None of this abolishes the banner; it constrains how often it may reappear.

The Exemptions, and Why Most Analytics Falls Outside Them

Article 88a(3) lists what may be stored or read without consent: what is necessary to transmit a communication, what is necessary to provide an explicitly requested service, audience measurement, and maintaining or restoring the security of a service.

The audience measurement exemption is the interesting one, and it is written narrowly. It covers aggregated information about the use of an online service, measured by the controller of that service, solely for that controller’s own use. A tool that operates across services, customers or platforms does not fit that description, and no configuration setting inside such a tool makes it fit.

Article 88a(3), applied to an ordinary stack

  basket session cookie          exempt    requested service
  CSRF token                     exempt    security
  language preference            exempt    requested service
  self-hosted analytics,
    own site only, aggregated    exempt?   audience measurement
  GA4                            consent   crosses services
  Meta pixel                     consent   crosses services
  hosted A/B testing             consent   crosses customers

  ? = the wording says solely for its own use, it has not been
      tested, and the reading is not settled

That table is worth building for a real site whatever happens in the trilogue, because the same distinction already decides the question under the directive. The categories are not new; the Omnibus would write them down more explicitly than Article 5(3) ever did.

What the Council Cut

Article 88b was the structural half of the proposal. It would have required a machine-readable consent signal – a preference expressed once in the browser or the operating system and honoured by sites – which is the only mechanism on the table that would have made per-site banners unnecessary rather than merely less frequent.

Reporting on the Council’s compromise text of 18 June 2026 says it removes Article 88b, after lobbying in which the advertising industry and Google were prominent. The Parliament has not settled its position, so nothing about this is decided. It is also worth being precise about what these documents are: compromise texts are negotiating drafts, they are not adopted law, and accounts of what a given version contains do not always agree with each other. The honest summary is that 88b is in trouble and that its fate is open.

What Follows for Today

Rebuilding a consent layer around Article 88a would be building on a draft, and a draft that has already lost one article can lose another. The application date offers no urgency either: 88a is meant to apply six months after the package enters into force, and the package has not entered into force.

Two things are worth doing anyway, because they cost little and pay off under every outcome. The first is the inventory above – which storage operation serves which purpose, and which exemption it would rely on. That question has an answer today under the directive, and having written it down is the difference between answering a supervisory authority in an afternoon and answering it in a month.

The second is the single-click refusal. Whether or not 88a survives, a banner that makes refusal as easy as acceptance is already the settled expectation of most supervisory authorities under existing law, and several have said so in decisions. Building it now is not anticipating a draft; it is complying with the lane that never stopped. What follows here is a description of the state of the texts and not legal advice – but the description alone is enough to show that the pending changes are not a reason to wait.