The European Union has taken another step towards simplifying its digital regulatory framework, with EU governments agreeing proposed changes to cookie consent, data protection obligations and the reporting of cybersecurity incidents.
The Council of the EU adopted its negotiating position on 21 October as part of the Digital Omnibus legislative package.
The initiative is intended to reduce administrative requirements for businesses while retaining safeguards governing personal data and digital services.
For website operators, marketing teams, software companies and organisations processing customer information, the proposed changes could affect several familiar compliance procedures.
However, the Council’s decision does not immediately change the law.
The European Parliament must establish its own position before the two institutions can negotiate a final agreement.
Businesses must therefore continue complying with existing requirements until new provisions enter into force.
Cookie consent could become less intrusive
One of the most visible elements concerns cookie banners and online tracking technologies.
Under the current framework, websites generally need consent before storing or accessing information on users’ devices unless a recognised exemption applies.
This requirement has resulted in the widespread use of consent banners across European websites.
The Council proposes clarifying and expanding the circumstances in which consent would not be necessary.
These include certain cookies required to provide a requested service, protect the security of a device or conduct audience measurement.
The proposed exemptions could reduce the number of consent requests presented to website visitors.
However, they would not remove all obligations concerning cookies.
Advertising technologies, behavioural profiling and tracking systems used for purposes outside recognised exemptions would remain subject to applicable consent requirements.
Nor would an exemption under cookie rules automatically permit unrestricted processing of personal data under GDPR.
Organisations would still need to identify an appropriate legal basis for processing personal information and meet relevant transparency requirements.
For digital publishers and businesses operating online services, the eventual legislation could affect website design, analytics configuration and consent-management software.
The precise implications will depend on the final text, including any conditions attached to audience-measurement exemptions.
GDPR changes focus on legal clarity
The Council also supports amendments to the General Data Protection Regulation.
One proposal concerns clarification of the definition of personal data and the circumstances in which information may be considered pseudonymised.
Pseudonymisation involves processing information so that it cannot be attributed to an individual without additional data kept separately.
It is frequently used in research, analytics and information systems.
Greater legal clarity could help businesses distinguish between different forms of information processing and assess their responsibilities.
Other proposed changes address information obligations, certain requests from individuals exercising their data rights and the reporting of personal data breaches.
The Council also supports common templates for compliance and greater consistency in identifying processing activities that pose a high risk to individuals.
These measures are intended to reduce differences in interpretation and administrative practice.
However, their effect will depend on the final legislation and how data protection authorities implement it.
Cybersecurity incident reporting may become more coordinated
Organisations operating across the EU can face several reporting obligations when a cybersecurity incident occurs.
Depending on the incident and the organisation’s activities, requirements may arise under GDPR, the NIS2 Directive, the Digital Operational Resilience Act and other sector-specific legislation.
Different rules can involve different authorities, notification periods and information requirements.
The Commission originally proposed a common reporting mechanism at European level.
The Council’s negotiating position takes a different approach.
It supports establishing a national reporting entry point in each member state, together with an EU-level information point and arrangements for sharing information across borders.
The objective is to make reporting procedures more coordinated while maintaining the responsibilities of relevant authorities.
For companies, such a system could reduce duplication when the same incident triggers obligations under several pieces of legislation.
However, a common reporting channel would not necessarily mean that all substantive reporting requirements, notification deadlines or legal responsibilities become identical.
Businesses would still need procedures for identifying incidents, determining which obligations apply and notifying the appropriate authorities.
Trade secrets and business data enter the debate
The Digital Omnibus package also addresses the EU’s wider framework for accessing and reusing data.
The Council proposes streamlining provisions concerning data intermediaries and data altruism services.
It has also included safeguards concerning the disclosure of trade secrets, particularly where commercial information could be transferred to third countries.
For companies engaged in research, software development and international supply chains, the handling of commercially sensitive data is an important consideration.
These proposals reflect efforts to reconcile greater access to information with confidentiality and intellectual property protection.
The eventual rules could affect agreements between data holders, service providers and organisations seeking access to business information.
What businesses and communications teams should monitor
The proposed reforms have particular relevance for organisations that manage websites, customer databases, advertising campaigns and digital communications.
Changes to cookie exemptions could affect how audience analytics are implemented.
Revisions to GDPR could alter documentation and reporting procedures, while cybersecurity provisions may require organisations to update incident-response workflows.
However, companies should distinguish between regulations already applying and measures still under negotiation.
As QuestComms previously explained in its examination of EU political advertising rules, organisations conducting digital campaigns must assess their obligations according to the type of communication, its purpose and the information being processed.
Changes to general cookie or data-protection rules would not automatically remove separate obligations imposed by political advertising legislation or the AI Act.
The Council says negotiations will begin once the European Parliament has adopted its position.
The timetable for final adoption remains uncertain, although EU institutions have identified regulatory simplification as a priority through 2027.
For businesses, the immediate task is to monitor the legislative process rather than make premature changes to existing compliance arrangements.
The final agreement will determine whether the proposed simplifications produce a meaningful reduction in the administrative work involved in operating digital services across Europe.
