On October 21, 2026, EU member state ambassadors on the Permanent Representatives Committee (Coreper) agreed the Council's negotiating mandate on the Digital Omnibus, the Commission's package to simplify the GDPR, the ePrivacy Directive, the Data Act and incident reporting. The mandate would shorten the proposed cookie re-ask wait from six months to four, widen the list of purposes that need no cookie consent, and leave the GDPR definition of personal data untouched.
This is a negotiating position, not law. The European Parliament has not adopted its own position, trilogue talks between the institutions have not started, and the GDPR and the ePrivacy Directive apply today exactly as written. Nothing on your website needs to change this week.
Source: Council of the EU, document ST 14756/26, first page, captured October 31, 2026.
What the Council actually agreed
The Council document (14756/26, dated October 22, 2026) states that the annex is the text of the mandate for negotiations with the European Parliament, as agreed by Coreper on October 21, 2026. Changes compared with the Commission's November 2025 proposal are marked in the text itself, which makes it possible to read the differences directly.
The IAPP reports that the Council agreed to maintain the GDPR's existing definition of personal data and introduced an amendment outlining pseudonymization standards. The mandate text also contains safeguards on sensitive data for biometric verification and AI development.
Addleshaw Goddard's briefing adds detail on the AI points. Biometric verification would cover only a one-to-one comparison of data the person supplies, not a search across a database. On AI training, the Council drops the Commission's proposed GDPR amendment that would have named legitimate interest as a lawful basis, and adds a recital saying AI development is not itself a legitimate interest and must be assessed case by case.
What changes for a cookie banner, if adopted
The cookie rules would stay in the ePrivacy Directive, where Article 5(3) sits today, rather than moving into the GDPR. The mandate's text lists purposes where storing or reading information on a device would not need consent, including providing a service the user explicitly requested, maintaining the technical security of the service or device, and audience measurement under strict conditions: pseudonymised data, no tracking outside the measured service, and nothing shared with third parties that contains personal data. The Council also adds measuring the display and performance of advertising that is based only on the content currently on screen and involves no personal data.
Two consent mechanics would change too. A user must be able to refuse in an easy and intelligible way with a single-click button or equivalent. And if a visitor refuses, the site could not ask again for the same purpose for at least four months. The Commission's draft said six months, according to Addleshaw Goddard, and the Council text shortens it.
Current law, Commission proposal and Council mandate
| Current law | Commission | Council mandate | |
|---|---|---|---|
| Personal data definition | Article 4(1) as is | Narrowed | Kept as is |
| Cookie rules sit in | ePrivacy Directive | GDPR | ePrivacy Directive |
| Wait before re-asking after refusal | No fixed period | 6 months | 4 months |
| Audience measurement without consent | No dedicated exemption | Aggregated only | Yes, with conditions |
| Contextual ad measurement without consent | No dedicated exemption | Not listed | Yes, no personal data |
| Breach notice deadline | 72 hours | 96 hours | 96 hours |
Figure 1: Current law versus the Commission's November 2025 proposal versus the Council's October 2026 mandate. Sources: Council document ST 14756/26; Addleshaw Goddard; IAPP. Current-law column reflects the GDPR and ePrivacy Directive as in force.
The breach row is where the press coverage is loose. Some summaries describe a "longer breach deadline" as a Council change. The Council text itself keeps the Commission's 96 hours, up from the 72 hours in the GDPR today, and limits notification to breaches likely to result in a high risk. So the lengthening comes from the original proposal, which the Council retained.
Where this sits in the process
Figure 2: Legislative steps so far and what remains. Sources: Council document ST 14756/26; IAPP; Addleshaw Goddard.
After Parliament settles its position, the two institutions negotiate a compromise, and the final text can differ from both starting points. Addleshaw Goddard advises monitoring developments but not making premature changes to internal compliance frameworks until the amendments are formally adopted. The Council text also asks the Commission to report on how the GDPR and the ePrivacy Directive function, so this package is one stage in a longer review.
What to do now
Keep your banner and policy aligned with the rules in force. Your cookie disclosures should still list every cookie category and purpose, and refusal should stay as easy as acceptance. If you want a baseline to measure against, see how a cookie policy differs from a consent banner, how ePrivacy cookie fines vary by country, and what consent rates look like by industry.
When you next update your disclosures, a Cookie Policy Generator keeps the category and purpose list in one place, so a future change to consent-free purposes means editing a few lines, not rewriting a page. Revisit the question when Parliament adopts its position and trilogues open.
One limit on this reporting: the Council's own press release and the ppc.land coverage of the four-month figure blocked automated access when this was written, so the facts above come from the Council document itself, the IAPP and Addleshaw Goddard.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
