Digital Omnibus explained: GDPR, cookie and Data Act changes and status

The EU Digital Omnibus is a Commission package from 19 November 2025 that would rewrite parts of the GDPR, move cookie rules into the GDPR and fold several data laws into the Data Act. As of October 2026, only the AI half has become law; the data half, which contains the GDPR and cookie changes, is still at first reading in Parliament and has no agreed Council position. That means the current GDPR, national ePrivacy rules and the Data Act apply unchanged.

Status as of October 2026

Last updated: 16 October 2026.

• AI part (Digital Omnibus on AI): adopted and in force since 27 July 2026, according to the European Commission. It moved the high-risk deadlines of the AI Act to 2 December 2027 (Annex III systems) and 2 August 2028 (AI in Annex I products).
• Data part (procedure 2025/0360(COD)): the Legislative Observatory lists it as awaiting a committee decision. The joint ITRE–LIBE draft report was published on 22 June 2026, and more than 1,750 amendments were tabled in July.
• Council: a vote on a negotiating mandate planned for 26 June 2026 was cancelled, according to the Parliament's Legislative Train. Work moved to the Irish presidency. According to trade press reporting, ambassadors ended their 7 October 2026 meeting without a vote, with the Data Act among the open issues. At the time of writing, no Council mandate had been announced.
• Trilogues: not started, because Parliament has not adopted its position either. Nothing in the data part is law yet.

What the Digital Omnibus is

The Commission tabled two regulations under the "Omnibus VII" simplification label. One amended the AI Act and moved fast. The other, the Digital Omnibus Regulation (COM(2025) 837), covers data protection, cookies, data-sharing law and incident reporting. Its stated aim is to cut compliance costs and overlapping obligations without lowering the level of protection.

Parliament gave the data file jointly to two committees: ITRE, with Aura Salla (EPP, Finland) as rapporteur, and LIBE, with Marina Kaljurand (S&D, Estonia) as rapporteur. IMCO and JURI are preparing opinions.

Proposed GDPR changes

Definition of personal data and pseudonymisation

The proposal would make the definition of personal data relative to the entity holding it. Pseudonymised information would not count as personal data for a recipient that has no reasonable means to re-identify the people behind it, even if another party could. The European Data Protection Board and the EDPS warned in a joint opinion that this goes further than recent case law of the EU Court of Justice. The Commission would also gain power to set criteria for pseudonymisation through implementing acts.

AI training and legitimate interest

Controllers could rely on legitimate interest to process personal data for developing and operating AI systems and models, subject to safeguards and the right to object. This is one of the most contested elements in both Parliament and the Council.

Breach notification

Under today's Article 33 GDPR, controllers must notify the authority within 72 hours of most breaches. The Commission proposed:

• notifying the authority only when a breach is likely to result in a high risk, the same threshold that already applies to telling individuals;
• extending the deadline to 96 hours;
• a common EU notification template and a list of high-risk situations, prepared by the EDPB;
• a single entry point run by ENISA, so one incident could be reported once for the GDPR, NIS2, DORA and related regimes.

Other GDPR adjustments

The text also proposes EU-wide lists for when a data protection impact assessment is or is not required, and changes on access requests that are used abusively.

What would change for cookies

Today, storing or reading information on a user's device is governed by Article 5(3) of the ePrivacy Directive, applied through national law and often enforced by different authorities than the GDPR. The Commission proposed moving these rules into the GDPR, in new Articles 88a and 88b. The main points of the proposal:

• consent stays the default, but a closed list of purposes would not need it, such as transmitting a communication, providing a service the user asked for, first-party audience measurement and security;
• users must be able to refuse with a single click, and a refusal would have to be respected for six months before the site asks again;
• websites would have to honour automated, machine-readable consent signals sent by browsers or operating systems, with a longer lead time for this obligation;
• media service providers would be exempt from the browser-signal rule.

Where the Council is heading on cookies

Council drafts circulated under the Irish presidency take a different route. According to reporting on a 2 October 2026 compromise text, the presidency removed Articles 88a and 88b, kept cookie rules in the ePrivacy Directive with added exemptions, including contextual advertising measurement, and cut the waiting period before re-asking after a refusal to four months. The same reporting says the text keeps the 96-hour breach deadline. These are working drafts marked for limited circulation, not an adopted position, and may change.

Data Act consolidation

The data-sharing part would turn the Data Act, which has applied since 12 September 2025, into the main EU rulebook for non-personal and public-sector data. It would absorb:

• the Data Governance Act (including rules on data intermediaries and data altruism);
• the Free Flow of Non-Personal Data Regulation;
• the Open Data Directive on re-use of public-sector information.

It also proposes lighter cloud-switching duties for some smaller providers and custom-built services, and model contract terms for cloud contracts. The Data Act chapter has also been one of the sticking points among member states in the Council.

What happens next

1. The Council needs a negotiating mandate, agreed by ambassadors in Coreper.
2. ITRE and LIBE need to vote on their report, followed by a plenary mandate.
3. Trilogue negotiations start, then a provisional deal is formally adopted by both institutions.
4. The regulation is published in the Official Journal; individual provisions would apply after transition periods set in the final text.

No date for a final deal has been set. Until then, companies should keep running cookie banners, breach procedures and data-sharing contracts under the rules in force. For related timelines, see our EU AI Act timeline after the AI Omnibus and coverage in Policy and Cloud & Data.

Frequently asked questions

Has the Digital Omnibus changed the GDPR yet?

No. As of October 2026 the GDPR changes are still proposals in the data part of the omnibus, which has not passed Parliament or the Council. The GDPR applies in its current form.

Will cookie banners disappear under the Digital Omnibus?

Not entirely. The Commission proposal keeps consent as the default but adds exemptions and would require sites to respect browser-level consent signals, which could reduce the number of banners; the Council drafts take a narrower approach.

Is the GDPR breach notification deadline now 96 hours?

No. The 96-hour deadline is proposed but not adopted, so the 72-hour rule in Article 33 GDPR still applies as of October 2026.

What is the difference between the AI Omnibus and the Digital Omnibus?

Both were proposed on 19 November 2025. The AI Omnibus amended the AI Act and entered into force on 27 July 2026, while the Digital Omnibus Regulation covers the GDPR, cookies, the Data Act and incident reporting and is still being negotiated.

When will the Digital Omnibus GDPR changes apply?

No date is fixed. The Council and Parliament first need their own positions and a trilogue deal, and the final text would then set transition periods for each change.