EU governments agreed their negotiating position on the Digital Omnibus on October 21, and the agreed text went to delegations a day later as Council document 14756/26. Four published accounts of that mandate tell the same story about cookie banners. They tell two different stories about the definition of personal data, and the split tracks which document each writer worked from.
That second question matters more to a marketing data team than the banner rules do. Cookie consent decides how often a visitor sees a prompt. The personal data definition decides whether a pseudonymised audience file sitting with a measurement partner or a clean room vendor falls inside the GDPR at all.
What the four accounts agree on
PPC Land, IAPP, the NicFab blog and the agency Relevant Audience each describe the same cookie architecture. The Commission’s November 2025 proposal had moved cookie consent into the GDPR as a new Article 88a, with an Article 88b that would have obliged sites to honour consent signals sent by the browser. The Council kept the rules in the ePrivacy Directive instead, as a rewritten Article 5(3), and dropped the browser signal. We covered that browser signal proposal in September in The Browser Signal That Could End the Cookie Banner.
The rewritten article keeps consent as the default for storing or reading anything on a device and then lists six purposes that would no longer need it: transmitting a communication, providing a service the user asked for, first-party aggregated audience measurement, media audience measurement under the European Media Freedom Act, technical security, and measuring the display and performance of contextual advertising. The Council document sets each one out with its own conditions on pages 156 and 157 of the annex.
All four accounts also report the consent mechanics. Users must be able to refuse with a “single-click button or equivalent means,” and after a refusal a provider may not ask again for the same purpose for “at least four months.” Relevant Audience notes that the Commission had proposed six months, which the struck-through text in the Council document still shows. The mandate would also hand cookie enforcement to each country’s GDPR supervisory authority, a change the NicFab blog describes as new in member states where a telecoms or consumer regulator handles cookies today.
On the cookie side, then, the coverage agrees, and the agreement is itself a finding. A marketing team can plan against a closed list of six exempt uses with reasonable confidence that this list is the Council’s position going into talks with the European Parliament.
Where the accounts split: personal data
IAPP reported that “the council agreed to maintain the GDPR’s existing definition of personal data” and added a pseudonymisation amendment. The NicFab blog wrote the same thing in its own words: “The Council maintains the current definition of personal data,” and it described the pseudonymisation provision as a clarification. NicFab told readers that its analysis drew on the Council press release, the EU Law Tracker timeline and the October 2 draft of the mandate, document 13886/26, as reconstructed by the specialist press.
PPC Land worked from the agreed 179-page text and reached the opposite reading. It reported that Article 4(1) of the GDPR gains three sentences from the Commission’s proposal, kept by the Council, including one stating that information is not personal for an entity that cannot identify the person it relates to. It then reported a new Article 25a written into the regulation itself. On the Board’s role, PPC Land concluded: “The Council has changed it and given the Board the job of explaining how it applies.”
The Council document supports the PPC Land reading on what the text contains. The Article 4(1) amendment in the annex carries the sentences on information that “is not necessarily personal data for every other person or entity,” and the pseudonymisation article states that “Pseudonymised data shall not be considered personal data for third party” when that third party cannot identify the person. A second paragraph treats onward transfer to a party that can re-identify as processing of personal data, and a third says data handled by a processor for a controller stays personal data for that processor.
In our reading, the IAPP and NicFab accounts describe what the Council said in its announcement, and PPC Land describes what the Council wrote in the mandate. Both are reporting accurately on their source. A data team that relies on the press release version would conclude the definition is untouched; a team that reads the annex would see that the Commission’s relative definition survived, with tighter limits on processors and onward transfers.
A second split: when the cookie rules would apply
The accounts also differ on timing. NicFab flagged what it called a technical paradox: 24 months for national transposition alongside a provision that the ePrivacy amendment applies six months after publication in the Official Journal. PPC Land reported that the six-month sentence is struck through in the agreed mandate, leaving the new Article 17(3) of the directive as the only clock, under which member states adopt and apply their laws 24 months after the regulation is adopted. The Council document carries the Article 17(3) wording.
Because the cookie rules stay in a directive, they would arrive country by country, two years after adoption, on the PPC Land reading. Nothing in any of the four accounts sets a date for the Parliament vote that has to come first. PPC Land reported that the file has drawn more than 1,000 amendments in Parliament.
Emphasis: who the mandate moves closer to
The two longest accounts also weigh the outcome differently. NicFab argues that the mandate sits closer to the European Data Protection Board and the European Data Protection Supervisor than the Commission’s proposal did, pointing out that the contextual advertising exception is one the Board had itself recommended. PPC Land stresses that the Board and the Supervisor urged lawmakers in February to leave the definition of personal data alone, and that the Council changed it anyway.
The ministers who steered the file framed it as a cost measure. “These measures will reduce compliance costs and boost competitiveness and innovation,” Thomas Byrne, Ireland’s Minister of State for European Affairs, said in the Council’s statement, as quoted by IAPP.
What it means for the marketing leader
Three practical points come out of reading the four accounts together.
Map your tags to the six purposes now
Relevant Audience walks through purpose (c), first-party aggregated audience measurement, and concludes that a standard analytics tag feeding identifiers into an ad platform, building remarketing audiences or linking sessions across unrelated sites would fall outside it. It adds that “The text does not name any product,” so no vendor can yet claim its tool qualifies. Audit which tags on your sites do only aggregated first-party counting and which feed advertising. That audit is useful whichever version becomes law, and it fits the identity changes browsers are already making, covered in Apple Explains Safari’s Identity Resolution Block in a WebKit Post.
Ask your consent platform about the four-month rule
PPC Land points out that the mandate says nothing about consent management platforms or the IAB Transparency and Consent Framework, which would have to record a refusal for at least four months. It also reports that recital 45 lets a site ask again when the refusal cookie is deleted for reasons outside its control. Ask your CMP vendor how it would store a refusal, how it would handle a cleared cookie and how it would separate the six exempt purposes from consented ones.
Read the annex before you change a data contract
If a clean room, measurement or identity vendor tells you pseudonymised data will fall outside the GDPR, check which role it plays. Under the Council text a processor working for you gets no benefit from the new pseudonymisation rule; only an independent third party without the means to re-identify does. The rewrite of ad tech’s privacy rulebook we covered in August turned on the same question of who holds the keys to re-identify. Hold contract changes until the Parliament position is known, and base any legal review on the agreed text, document 14756/26, rather than on a summary of the announcement.
Source: Council of the European Union, document 14756/26, mandate for negotiations on the Digital Omnibus
