The European Union's Digital Omnibus is being presented as a simplification package, and one of its most visible promises is fewer cookie banners. But the EU Digital Omnibus GDPR changes go well beyond pop-ups. According to the coverage we reviewed, the proposal would touch cookie rules, the way personal data is defined and how AI systems can be trained. Here is a plain-language look at what is on the table, what the Council has proposed so far, and when any of it could take effect.
What the Digital Omnibus would change
The Digital Omnibus is a package of proposed amendments that the European Commission presented on 19 November 2025. It bundles changes to several digital laws, including the General Data Protection Regulation (GDPR), the rules on cookies and device access, and the timeline for high-risk AI obligations. The stated aim is to reduce overlap and compliance burden, especially for smaller companies.
Legal analyses of the package highlight three areas that matter most for everyday privacy: the question of when data counts as personal, the use of personal data for AI training, and the handling of cookies and similar tracking tools. Other reported elements are more administrative, such as cutting redundant breach reports and adjusting registration requirements for some exempted AI systems.
It is important to remember that this is a proposal. Nothing described here is law yet, and the text can change as the Council and Parliament negotiate.
Fewer cookie banners, weaker protections?
The Commission's pitch is that people should be able to express real choices and keep their devices safe, without clicking through endless consent prompts. In practice, the package would move the key provision on accessing information stored on your device out of the ePrivacy framework and into the GDPR.
Critics, including the digital rights group EDRi, argue that this shift weakens the ePrivacy framework. They note that consent would remain necessary for most uses, so the change is not a blanket removal of consent. The debate is over the exceptions and over how much room companies would have to read or store data on your device without asking.
A second concern is the definition of personal data. Analyses of the proposal say some data would no longer be subject to the GDPR, depending on whether a given organization can realistically identify a person from it. That matters because the same dataset could be personal data for one company and not for another. For readers, the practical risk is that information about you could fall outside GDPR protections even though it feeds into profiles or tracking.
The Council's side of the story is covered in our earlier report on how the EU Council is nearing a deal to loosen GDPR for 450M users, which explains how the negotiations are shaping what the law actually protects.
How AI training on personal data could work
The proposal would also clarify when personal data can be used to train AI models. Legal commentary describes this as relying on legitimate interest as a basis, rather than requiring consent in every case. Supporters say it gives developers legal certainty. Privacy advocates worry it opens the door to large-scale use of personal information, including material scraped from the web, with fewer checks.
Special category data, such as health information or political opinions, is generally prohibited from processing under Article 9 of the GDPR. Reporting on the Omnibus says it still suggests some changes in this area, so it is worth watching how any exceptions are drafted and what safeguards remain.
The package also proposes a conditional timeline for high-risk AI rules, which would shift when some obligations start to apply.
When it could become law and what you can do now
The Omnibus must still pass through the EU legislative process. The Council is working on its position, and the European Parliament will weigh in before any final text is agreed. We have not seen a confirmed date for adoption in the material reviewed, so any timeline you read should be treated as an estimate. Even after adoption, new rules typically come with transition periods.
That gives you time to prepare and to follow the debate.
What This Means For You
- Expect fewer prompts, but check the fine print. Fewer banners could be convenient, but the trade-off is less visible control over what is stored on your device.
- Your data may be treated differently. If the personal data definition narrows, some information about you might sit outside GDPR rights such as access and deletion.
- AI training is a bigger question. Content you post publicly could be more easily used to train models if legitimate interest becomes the accepted basis.
- Nothing changes today. Your current GDPR rights remain in force while the proposal is debated.
Practical takeaways
- Review your browser's cookie settings and clear or block third-party cookies where you can.
- Turn on your browser's built-in tracking protection.
- Check privacy settings on platforms you use, including options to opt out of AI training where offered.
- Keep using your GDPR rights to request access to or deletion of your data while they apply in full.
- Follow the legislative process. For deeper context on the fight over the rules, read our coverage of the EU Council's GDPR negotiations.
The EU Digital Omnibus GDPR changes are still a work in progress, and the final shape of the cookie, data definition and AI provisions will determine how much privacy Europeans keep. Staying informed and tightening your own settings now is the most reliable way to stay in control.
