The Council of the EU has agreed its position on the Digital Omnibus, a legislative package that could loosen parts of GDPR, cookie consent rules and AI obligations. The key caveat is that nothing here is law yet. For anyone trying to follow the EU Digital Omnibus GDPR changes, the useful question is not "what has been scrapped?" but "what is proposed, what can still move, and what protects me today?"
What the Council has agreed so far
A Council position is a negotiating stance, not a finished regulation. It sets out what EU member state governments want from the package as talks continue. The European Commission unveiled the Digital Omnibus on November 19, 2025, framing it as a way to recalibrate and simplify the bloc's digital rulebook. The Council's agreement is one step along the way, and it does not by itself change any obligation for companies or any right for individuals.
That distinction matters because early coverage of big EU packages tends to blur "proposed" and "adopted." Until the institutions agree a final text and it is formally adopted and published, the rules you live under are the ones already in force.
How GDPR, cookies and AI rules could change
Analysts and compliance commentators have pointed to several areas of the package. Treat these as proposals under negotiation, since details may shift before any final text.
GDPR definitions and legal bases. Commentary on the package says one change would clarify that pseudonymised data is not personal data in the hands of parties that cannot re-identify it. Another reported element is a new legal basis provision, referred to as Article 88c, tied to legitimate interest. Some summaries also describe an explicit legal basis for AI training and looser breach notification requirements. Critics, including Renew Europe in a warning reported in November 2025, have argued the reforms risk weakening the data protection framework. Supporters frame the same changes as reducing friction for businesses.
Cookies and consent. The package touches cookie consent rules, which is where most people feel privacy law in daily life. The stated aim of simplification is fewer intrusive banners, but the practical outcome depends on the final wording and on how much control browsers and users keep over their choices.
AI obligations. Coverage describes the Digital Omnibus as delaying AI Act high-risk rules. For readers, that means some AI-related safeguards could arrive later than originally planned, even if the Act itself remains on the books.
It is worth noting that the same package is being described in sharply different terms depending on who is talking. One side calls it simplification; another has accused the Commission of a "massive rollback" of digital protections. Both framings are about the same text, which is why reading the actual legislative language, once final, matters more than headlines.
What is not yet law and what happens next
A Council position is only part of the process. The EU's ordinary legislative procedure generally requires the Council and the European Parliament to align on a final text. That means the Parliament's stance, and any compromise between the institutions, could change the provisions above. Some proposals could be softened, narrowed or dropped, and others could be added.
Several practical points follow:
- Current GDPR rights stay in force. Access, deletion, objection and the other rights you have today are not altered by a negotiating position.
- Timelines are uncertain. Even after agreement, new rules typically include transition periods before companies must comply.
- Final wording is what counts. Definitions such as what counts as personal data can have large downstream effects, so small drafting changes can matter a lot.
If you want a refresher on the rights you can use right now, our explainer on data privacy laws in 2026 and what GDPR and DPDP mean for you covers the current baseline.
How to protect your privacy while the rules shift
The Digital Omnibus debate is a reminder that legal protections can change, and that relying on them alone is a weak strategy. A few habits make you less dependent on any single rulebook.
- Use your rights while they exist. Submit access and deletion requests to companies holding data you no longer want them to have.
- Take control of consent. Review cookie choices instead of clicking through banners, and consider browser privacy settings or tracker-blocking tools that apply regardless of what a banner says.
- Limit what you hand over. Data that is never collected cannot be re-identified, leaked or reused for AI training. Use aliases, minimal profiles and separate emails for sign-ups.
- Be cautious with AI tools. Check what a service says about using your inputs for training, and avoid pasting sensitive personal or work data into tools that do not clearly limit it.
- Protect your traffic. A VPN can hide your browsing from your network and internet provider, but it does not replace data protection law. It will not stop a company you log into from processing your data.
Deregulation pressure is not unique to Brussels. For a comparison, see our report on Reform UK's pledge to scrap UK GDPR rules, which shows a similar argument playing out in a different political setting.
What This Means For You
Nothing about your day-to-day rights has changed because the Council agreed a position. What has changed is that the direction of travel is clearer: governments are weighing how far to relax parts of GDPR, cookie consent and AI rules in the name of simplification. Whether that lands as modest tidying or a meaningful reduction in protection depends on negotiations still to come.
Key takeaways
- Nothing is law yet. The Council position is a step in a longer process, and your current GDPR rights remain intact.
- Watch the details. Definitions of personal data, legal bases for AI training and breach notification rules are the areas to follow in the EU Digital Omnibus GDPR changes debate.
- Use your rights now. Exercise access, deletion and objection requests while the current framework is fully in force.
- Reduce your exposure. Share less data, manage consent actively and treat laws as one layer of protection, not the only one.
To understand exactly what you can do today, start with our guide to data privacy laws in 2026, and keep an eye on how the Digital Omnibus evolves as the Parliament and Council negotiate a final text.
