Login
EU Moves to Rewrite GDPR and Cookie Rules in Major Digital Regulation Overhaul
The European Union has taken a significant step towards revising its digital regulatory framework after member states agreed proposals to amend the General Data Protection Regulation (GDPR), simplify cookie consent requirements and overhaul cybersecurity reporting obligations.
The Council of the European Union adopted its negotiating position on Wednesday, 21st October, clearing the way for negotiations with the European Parliament once MEPs establish their position.
The measures form part of the European Commission’s Digital Omnibus package, introduced in November 2025, and represent one of Brussels’ most substantial attempts to simplify the regulatory obligations imposed on businesses operating across the single market.
Changes to GDPR and personal data rules
The proposed reforms would modify several provisions of the GDPR, which has governed the processing of personal data across the EU since May 2018.
Rather than replacing the legislation, the Council wants to clarify existing obligations, particularly those concerning pseudonymised information, requests for access to personal data and the use of information in scientific research.
The agreed position retains the existing definition of personal data while introducing provisions intended to clarify when pseudonymised information can be linked to an identifiable individual.
Companies would also benefit from simplified procedures for handling manifestly unfounded or excessive data requests and from reduced information requirements in certain low-risk circumstances.
Another proposed change would extend the deadline for notifying authorities of personal data breaches, while establishing more consistent reporting templates across the EU.
For multinational companies, which currently navigate different interpretations of data protection obligations by national authorities, these provisions could reduce compliance costs and administrative duplication.
However, the changes have raised concerns among European privacy regulators.
In a joint opinion published in February, the European Data Protection Board and European Data Protection Supervisor warned that parts of the Commission’s original proposal could create legal uncertainty and undermine existing protections.
They were particularly concerned about proposals affecting the definition of personal data and the Commission’s potential role in determining when pseudonymised information falls outside GDPR requirements.
The Council’s decision to retain the existing definition addresses part of that debate, although the final legislative text remains subject to negotiations.
Fewer cookie banners for internet users
One of the most visible changes would affect the consent notices encountered by Europeans when visiting websites.
Under the Council’s proposal, additional categories of cookies and similar tracking technologies could be used without obtaining explicit consent, provided the relevant legal conditions are satisfied.
The proposed exemptions include technologies necessary to deliver a service, maintain device security or conduct audience measurement.
For website operators, publishers and online businesses, the changes could reduce the number of consent requests displayed to visitors and simplify technical compliance.
The current system has generated extensive legal disputes over whether consent is genuinely voluntary and whether tracking technologies collect information beyond what users have authorised.
EU Today has previously examined the enforcement of these obligations, including a Belgian court ruling concerning the legality of the advertising industry’s consent framework.
The latest proposal would not abolish consent requirements for commercial tracking or behavioural advertising. Technologies falling outside the permitted exemptions would remain subject to the applicable privacy rules.
Cybersecurity reporting and artificial intelligence
The package also addresses the growing number of reporting obligations imposed on European businesses under overlapping cybersecurity legislation.
The Commission originally proposed a single European reporting mechanism for certain data and cybersecurity incidents.
Member states have instead agreed to establish national entry points, supported by an EU-level information system and provisions for coordinating cross-border notifications.
The Council’s position would also clarify the legal grounds for certain uses of personal data in artificial intelligence systems and introduce safeguards for processing sensitive information in specified circumstances.
These provisions follow increasingly complicated disputes over the application of European privacy legislation to AI development and automated decision-making.
As EU Today reported in its coverage of a major GDPR enforcement case involving Uber, automated processing already presents substantial compliance risks for companies operating within the bloc.
Competitiveness drives regulatory reform
The Commission estimates that its wider digital simplification initiative could save European businesses up to €5 billion in administrative costs by 2029.
The initiative reflects pressure from European governments and business organisations to reduce the regulatory fragmentation that makes operating across multiple EU jurisdictions more expensive.
The Digital Omnibus is part of a broader legislative programme influenced by the competitiveness reports produced by former Italian prime ministers Enrico Letta and Mario Draghi.
Under the Council’s negotiating mandate, several existing data-related rules would also be consolidated, while provisions governing the protection of trade secrets would be strengthened.
The European Parliament must now determine its negotiating position before formal discussions between the institutions can begin. Until the legislation is agreed and adopted, existing GDPR, cookie consent and cybersecurity requirements remain in force.
