The European Union has taken a significant step towards revising its digital regulatory framework after member states agreed proposals to amend the General Data Protection Regulation (GDPR), simplify cookie consent requirements and overhaul cybersecurity reporting obligations.

The Council of the European Union adopted its negotiating position on Wednesday, 21st October, clearing the way for negotiations with the European Parliament once MEPs establish their position.

The measures form part of the European Commission’s Digital Omnibus package, introduced in November 2025, and represent one of Brussels’ most substantial attempts to simplify the regulatory obligations imposed on businesses operating across the single market.

Changes to GDPR and personal data rules

The proposed reforms would modify several provisions of the GDPR, which has governed the processing of personal data across the EU since May 2018.

Rather than replacing the legislation, the Council wants to clarify existing obligations, particularly those concerning pseudonymised information, requests for access to personal data and the use of information in scientific research.

The agreed position retains the existing definition of personal data while introducing provisions intended to clarify when pseudonymised information can be linked to an identifiable individual.

Companies would also benefit from simplified procedures for handling manifestly unfounded or excessive data requests and from reduced information requirements in certain low-risk circumstances.

Another proposed change would extend the deadline for notifying authorities of personal data breaches, while establishing more consistent reporting templates across the EU.

For multinational companies, which currently navigate different interpretations of data protection obligations by national authorities, these provisions could reduce compliance costs and administrative duplication.

However, the changes have raised concerns among European privacy regulators.

In a joint opinion published in February, the European Data Protection Board and European Data Protection Supervisor warned that parts of the Commission’s original proposal could create legal uncertainty and undermine existing protections.

They were particularly concerned about proposals affecting the definition of personal data and the Commission’s potential role in determining when pseudonymised information falls outside GDPR requirements.

The Council’s decision to retain the existing definition addresses part of that debate, although the final legislative text remains subject to negotiations.

Fewer cookie banners for internet users

One of the most visible changes would affect the consent notices encountered by Europeans when visiting websites.

Under the Council’s proposal, additional categories of cookies and similar tracking technologies could be used without obtaining explicit consent, provided the relevant legal conditions are satisfied.

The proposed exemptions include technologies necessary to deliver a service, maintain device security or conduct audience measurement.

For website operators, publishers and online businesses, the changes could reduce the number of consent requests displayed to visitors and simplify technical compliance.

The current system has generated extensive legal disputes over whether consent is genuinely voluntary and whether tracking technologies collect information beyond what users have authorised.

EU Today has previously examined the enforcement of these obligations, including a Belgian court ruling concerning the legality of the advertising industry’s consent framework.

The latest proposal would not abolish consent requirements for commercial tracking or behavioural advertising. Technologies falling outside the permitted exemptions would remain subject to the applicable privacy rules.

Cybersecurity reporting and artificial intelligence

The package also addresses the growing number of reporting obligations imposed on European businesses under overlapping cybersecurity legislation.

The Commission originally proposed a single European reporting mechanism for certain data and cybersecurity incidents.

Member states have instead agreed to establish national entry points, supported by an EU-level information system and provisions for coordinating cross-border notifications.

The Council’s position would also clarify the legal grounds for certain uses of personal data in artificial intelligence systems and introduce safeguards for processing sensitive information in specified circumstances.

These provisions follow increasingly complicated disputes over the application of European privacy legislation to AI development and automated decision-making.

As EU Today reported in its coverage of a major GDPR enforcement case involving Uber, automated processing already presents substantial compliance risks for companies operating within the bloc.

Competitiveness drives regulatory reform

The Commission estimates that its wider digital simplification initiative could save European businesses up to €5 billion in administrative costs by 2029.

The initiative reflects pressure from European governments and business organisations to reduce the regulatory fragmentation that makes operating across multiple EU jurisdictions more expensive.

The Digital Omnibus is part of a broader legislative programme influenced by the competitiveness reports produced by former Italian prime ministers Enrico Letta and Mario Draghi.

Under the Council’s negotiating mandate, several existing data-related rules would also be consolidated, while provisions governing the protection of trade secrets would be strengthened.

The European Parliament must now determine its negotiating position before formal discussions between the institutions can begin. Until the legislation is agreed and adopted, existing GDPR, cookie consent and cybersecurity requirements remain in force.

The European Commission is assessing changes to Google’s search engine and app-store practices after imposing two substantial fines in July. Regulators must now decide whether the company’s response satisfies EU competition requirements or leaves it exposed to further enforcement.

The European Commission is continuing discussions with Google over the company’s response to €890 million in penalties imposed under the Digital Markets Act, as Brussels examines whether changes to its search engine and app-store practices are sufficient to address infringements of European competition rules.

Commission spokesman Thomas Regnier confirmed on Wednesday, 14 October, that officials remained in dialogue with the American technology company. The Commission is assessing the measures Google has introduced, taking account of feedback from businesses affected by its services before reaching a conclusion on compliance.

The review follows two decisions adopted on 23 July, when the European Commission found Google in breach of the Digital Markets Act. A €460 million fine concerned preferential treatment for Google’s own services in search results, while a separate €430 million penalty addressed restrictions preventing app developers from freely directing customers towards alternative purchasing channels.

Search rankings remain under examination

The first infringement concerns Google’s treatment of competing online services offering hotel reservations, shopping comparisons, transport information and sports results.

Regulators concluded that Google had placed its own services in more prominent positions, sometimes providing them with enhanced visual features and search functions unavailable to competing businesses.

The Digital Markets Act prohibits designated gatekeepers from giving their own products preferential treatment when ranking services that compete with those offered by other companies.

Google has already modified its European search results in response to the Commission’s decision. The changes include revised presentations of commercial information and greater prominence for independent comparison services.

As EU Today reported following the introduction of the revised search format, Google has argued that the measures could make searches less convenient and increase dependence on intermediary websites.

The company maintains that direct information previously available through its search engine may become harder for consumers to obtain.

For competitors, however, the question is whether Google’s adjustments provide genuine commercial opportunities or merely alter the appearance of search results without changing the underlying distribution of traffic.

Google Play fees face scrutiny

The second case concerns the Google Play application marketplace, where developers have historically depended on Google’s infrastructure to distribute software and sell subscriptions.

Under the DMA, developers must be able to inform customers about alternative offers and direct them towards purchasing arrangements outside the platform, including their own websites.

The Commission found that Google’s restrictions and fees had limited that freedom.

Although the company may charge for certain services associated with acquiring customers, the Commission concluded that the level and duration of its steering-related charges exceeded what the legislation permits.

Google has since adjusted its external-offers arrangements. European officials are examining whether those changes provide developers with a commercially workable alternative to transactions processed through Google Play.

The issue has consequences for subscription services, digital publishers and software companies seeking to maintain direct relationships with their customers.

A formal ability to direct consumers elsewhere is of limited benefit if the financial conditions make such transactions uneconomic.

Enforcement enters a more demanding phase

The Digital Markets Act was designed to address market practices that conventional competition investigations often took years to resolve.

Rather than requiring regulators to establish a new infringement through lengthy proceedings in every instance, the legislation imposes specific obligations on companies designated as gatekeepers.

The Commission’s DMA enforcement framework allows regulators to examine whether those obligations are being followed and to impose financial penalties when they are breached.

Google’s July fines represented an important enforcement decision. The current review concerns the company’s subsequent conduct and the practical effects of its compliance measures.

The continuation of discussions does not itself establish a fresh infringement. Further penalties would require an additional regulatory determination.

Google also faces broader obligations concerning the sharing of search data with competing providers, an issue addressed in a separate Commission decision issued in July.

These obligations concern access to anonymised information about searches, rankings and user interactions that competing search engines may need to improve their own services.

Taken together, the measures represent a substantial intervention in how Google’s European business operates.

Transatlantic tensions complicate the dispute

The proceedings have acquired a political dimension because most of the largest companies affected by the DMA are American.

President Donald Trump has criticised European penalties against US technology companies and threatened trade measures in response to what his administration regards as discriminatory regulation.

Brussels maintains that the legislation applies according to market position and commercial conduct, regardless of nationality.

European regulators must nevertheless enforce their decisions in an environment where competition policy has become entangled with wider trade relations between the United States and the European Union.

Google’s financial exposure extends beyond the €890 million imposed in July. Continued non-compliance could lead to further regulatory proceedings, while changes to the company’s services may also affect advertising revenue and its relationships with commercial partners.

The immediate assessment will concentrate on whether competing search services receive fair treatment and whether application developers can direct customers towards alternative transactions without unjustified restrictions.

The Commission has not announced a date for its final assessment. Its decision will help establish how far Europe’s digital competition legislation can change the conduct of companies whose platforms occupy central positions in online commerce.

Google has asked the European Union’s General Court to suspend an order requiring it to make search data available to competing search engines and artificial-intelligence services while its wider legal challenge proceeds.

The application for interim measures follows Google’s challenge to a European Commission decision adopted in July under the Digital Markets Act. The company argues that implementation before the court rules on the main case could cause serious harm to the privacy of European users.

The Commission maintains that its requirements already contain safeguards for privacy, security and personal data.

At the centre of the dispute is Article 6(11) of the Digital Markets Act, which requires Google to give eligible rival search services access to anonymised ranking, query, click and viewing data on fair, reasonable and non-discriminatory terms.

The Commission opened specification proceedings in January and adopted binding measures on 16 July.

The rules explicitly allow AI chatbots offering search functions to qualify for access.

Brussels argues that Google has accumulated a quantity of search information which competitors cannot readily reproduce. User queries and interactions can improve search algorithms, reinforcing the position of an established provider and creating a substantial entry barrier for newcomers.

EU Today examined the issue in April, when the Commission first set out its proposed Google search-data sharing measures.

The final July decision turned those proposals into binding requirements.

The inclusion of AI services gives the case wider significance. Generative AI products increasingly answer questions directly rather than sending users through a conventional list of search results. That is putting AI developers and traditional search engines into increasingly direct competition.

The Commission’s data-access framework is intended to reduce the advantage obtained from data accumulated by designated gatekeepers and make it easier for competing services to enter the market.

Access will not be unrestricted.

Applicants must operate a genuine online search service in the EU and satisfy eligibility requirements. Established applicants generally need at least 50,000 average monthly EU users during the previous year, while newer companies can qualify under investment criteria.

They must also comply with security and data-protection requirements and undergo independent auditing. The Commission can exclude applicants presenting public-security risks, while the data must be processed within the European Economic Area or under arrangements providing equivalent protection.

Google argues that these safeguards do not remove the underlying privacy risk.

The company has therefore asked the General Court for an interim suspension while judges consider the legality of the Commission’s decision.

The case adds another front to an increasingly difficult relationship between Google and Brussels.

In July, the Commission imposed two Digital Markets Act fines on Google totalling €890 million. As EU Today reported following the penalties, one case concerned Google’s treatment of its own services in search results while another dealt with restrictions preventing app developers from directing users towards alternative offers.

The dispute subsequently developed into a wider transatlantic issue when President Donald Trump threatened a Section 301 trade investigation in response to the EU penalties, a development examined by EU Today.

Google has meanwhile begun altering some of its European services in response to regulatory pressure. Earlier this month it changed the presentation of European search results, while warning that the new format could make searches less useful.

The present case is different because it deals with access to the underlying information generated by searches rather than only the way results are displayed.

The Commission wants qualifying competitors to obtain data that could help them improve their own services. Google says opening those datasets creates privacy and security risks which cannot simply be reversed if it eventually wins the court case.

That is why the interim application is important.

Google is not asking the court merely to overturn the Commission decision at the end of the litigation. It wants implementation halted before the full case is resolved.

Unless judges intervene, the Commission timetable continues.

The wider dispute will determine how far Brussels can require a dominant digital platform to share data accumulated through its own users in order to encourage competition — an issue that is becoming increasingly important as search and generative AI converge.

France has called for money collected through European Union fines against Google to be used to reduce national contributions to the EU budget as governments negotiate the bloc’s next seven-year financial framework.

Europe Minister Benjamin Haddad said proceeds from penalties imposed on the US technology company should be treated as EU revenue and used to lower the sums governments must pay into the common budget.

The proposal comes as negotiations intensify over the 2028–34 Multiannual Financial Framework, for which the European Commission has proposed expenditure of almost €2 trillion.

Haddad referred to about €4.6 billion in revenue associated with Google penalties and interest.

The proposal is less radical in budgetary terms than it first appears because fines that become final already enter the EU budget as “other revenue”.

The Commission’s explanation of EU budget revenue states that gross national income-based contributions act as the balancing element of the budget after customs duties, VAT-based resources and other revenues — including fines on companies — are taken into account.

Higher income from definitive competition fines can therefore reduce the amount required from national governments.

France is pressing for that mechanism to be applied clearly to the Google proceeds at a time when governments are seeking ways to limit increases in their national payments.

Google has accumulated substantial EU penalties through both competition law and the Digital Markets Act.

In July, the European Commission fined Google €890 million under the Digital Markets Act in two separate decisions.

A €460 million penalty concerned the Commission’s finding that Google gave preferential treatment to its own services in search results. A further €430 million fine concerned restrictions affecting developers’ ability to direct users towards alternative purchasing channels outside Google Play.

Google has contested elements of the EU enforcement regime and has continued legal proceedings over Commission decisions.

EU Today has followed the dispute closely. In September, Google began changing European search results following the DMA enforcement action, while earlier Commission measures generated a wider dispute with Washington over European regulation of US technology groups.

The French budget proposal shifts the issue from regulation towards public finance.

EU governments are currently divided over the Commission’s proposed 2028–34 budget, which averages about 1.26 per cent of EU gross national income.

Germany, Denmark, Finland, the Netherlands and Austria are among governments seeking substantial reductions in the proposed spending level.

EU Today reported this month that five large net contributors were demanding cuts of several hundred billion euros from the Commission proposal.

France also faces a sharp increase in its projected contribution.

Against that background, governments are looking at both expenditure reductions and new revenue streams that could limit demands on national treasuries.

The wider negotiations cover possible EU “own resources” — revenue that flows directly or indirectly to the European budget rather than being provided through conventional national contributions.

Existing resources include customs duties, a VAT-based contribution, a plastics contribution and national payments calculated according to gross national income.

The Commission has also proposed additional sources linked to carbon pricing and other EU policies.

EU Today has previously examined how EU leaders are searching for new revenue sources for the €2 trillion budget while attempting to finance defence, competitiveness, migration, agriculture, cohesion programmes and support for Ukraine.

Company fines differ from permanent own resources because their size is unpredictable and depends on enforcement decisions and subsequent legal proceedings.

A large fine can provide a one-off boost to EU revenue, but it cannot readily finance recurring expenditure across a seven-year financial framework.

Definitive fines have nevertheless affected member-state contributions before. Commission budget amendments have explicitly incorporated competition penalties as additional revenue, reducing the amount that must be raised elsewhere.

France is now seeking to ensure that the Google proceeds are reflected directly in the sums demanded from national budgets.

The proposal comes before another round of negotiations over the Multiannual Financial Framework, where the size of the budget remains unresolved.

With agreement requiring unanimity among all 27 governments, even relatively small sources of additional revenue are becoming part of the bargaining over who ultimately pays for the EU’s expanding spending commitments.