On October 21, 2026, EU ambassadors agreed the Council's position on the Digital Omnibus, a package that amends the GDPR and the ePrivacy rules. Buried in its 179 pages is a line every website owner should read: anonymous, first-party audience measurement could run without asking for consent.
In other words, simple analytics may no longer need a cookie banner. But there is a catch, and a long timeline.
What the Council agreed
The Council kept cookie rules where they are today, in the ePrivacy Directive. Consent stays the general rule. What changes is the list of exceptions: device access without consent would be allowed only when it is strictly necessary for one of six purposes.
One of those purposes is anonymous, aggregated audience measurement of your own service. It can be run by you or by a provider on your behalf, as long as the data is:
- anonymous and aggregated
- used only to measure your own service
- not shared with third parties
- not combined with third-party data
- not reused for any other purpose
The mandate also requires a one-click way to refuse cookies, and bars sites from asking again for at least four months after a refusal. The Commission had proposed six.
What still needs consent
The exemption is narrow on purpose. Consent is still required for:
- cross-site tracking
- advertising profiles
- analytics that merges your stats with outside data
- anything that is not anonymous and aggregated
So the cookie banner is not dead. It is simply no longer meant for basic "how many people visited" analytics.
When it would actually apply
Nothing changes today. Here is the path ahead:
| Step | Status |
|---|---|
| Council mandate agreed by Coreper | Done, Oct 21, 2026 |
| European Parliament adopts its position | Not yet, as of Oct 24, 2026 |
| Council and Parliament negotiate the final text | Starts after Parliament's position |
| Member states transpose the cookie changes | 24 months after adoption |
The EU wants its simplification packages done by the end of 2027, so legal analysts expect the cookie changes to take effect around 2028 at the earliest. Until then, current GDPR and ePrivacy rules apply in full.
Why it matters anyway
Even before it becomes law, the direction is clear. Europe is drawing a line between analytics that measures your own site and analytics that tracks people. The first is being made easier. The second keeps its friction.
For developers and founders, that means the less your analytics collects, the less it will cost you, both in legal work and in the visitors you lose to consent pop-ups.
I'm building Ilytics, a small analytics tool, around the same idea, so I'll be watching how Parliament's position turns out.
This article summarizes public reporting on a draft legislative position. It is not legal advice.
Top comments (0)