Article 88a: Does Your SaaS Analytics Skip Consent?

The most consequential line in the EU's Digital Omnibus for SaaS analytics is not the headline about killing cookie banners — it is a narrow carve-out most summaries skip. The revised draft introduces an aggregated audience measurement exception in Article 88a that would let you read from and write to a user's device without consent, provided the measurement is aggregated, about your own service, and used solely by you. For a privacy-conscious SaaS team, that single clause decides whether your analytics needs a consent banner at all.

This is not a legal-recap post. The question that matters operationally is narrower and more useful: would your specific analytics setup plausibly qualify, and if not, what would you change to put it on the right side of the line? The answer turns almost entirely on how your data flows — where events go, who else touches them, and what they are used for. Those are instrumentation decisions, which means this is a measurement problem you can act on now, well before the rule is law.

What Article 88a actually says

The Digital Omnibus folds the old ePrivacy cookie rules directly into the GDPR through a new Article 88a, so the consent question for analytics stops living in a separate directive and becomes part of the regulation itself. The aggregated-measurement limb — circulating as Article 88a(3)(c) — exempts "creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use." Read it slowly, because every clause is a condition: aggregated, about one online service, by that service's own controller, solely for that controller's use.

That wording is deliberately tighter than "analytics is now fine." It describes first-party, self-serving audience measurement and nothing else. The October 2, 2026 revised draft kept this exemption while also shortening the waiting period before a site can re-ask for consent — two different mechanisms, often conflated. The waiting-period change is about banners you still show; the aggregated-measurement exception is about measurement you can run without a banner at all. This post is about the second one, because it is the one that changes what you instrument.

The qualification test: four conditions, all required

Whether your setup qualifies is not a matter of which vendor's logo is on the dashboard — it is whether your data flow satisfies four conditions at once. First, the measurement must be aggregated, not held at user level for the exempt purpose. Second, it must concern a single online service, not a profile stitched across many sites or domains. Third, it must be performed by that service's own controller — you, measuring you. Fourth, and the one most setups fail, the data must be used solely for your own use, with no sharing to a third party that reuses it.

Run your own stack through those four. If events leave your boundary into an advertising ecosystem, a condition breaks. If an analytics vendor processes your data for its own purposes rather than purely on your instruction, the "solely for its own use" condition breaks. If you measure across several properties as one audience, the single-service condition breaks. If you keep user-level records to power the measurement, the aggregation condition is strained. The test is conjunctive: failing any one of the four pulls the whole setup back under consent, which is why a clean first-party boundary is worth more than any single feature.

Why standard GA4 does not qualify

A default GA4 configuration fails the test on multiple conditions, which is why commentators asking whether GA4 qualifies for the exemption keep landing on "no." Out of the box, GA4 feeds Google's advertising systems, supports cross-property and cross-domain measurement, and permits the data to be used for personalisation and ad purposes beyond counting your own audience. Each of those is a direct breach of the "single service, solely for its own use, no sharing" conditions. The tool is architected for an ecosystem, and the exemption is architected against exactly that.

You can harden GA4 — disable Google Signals, remove Ads linking, switch off data-sharing settings, confine it to one property — and move closer to the boundary, but the burden of proof sits with you to show the configuration never leaves first-party territory, and that is a fragile thing to defend as settings and defaults drift. This is the same structural mismatch covered in how the Digital Omnibus cookie rules reshape SaaS analytics: the exemption rewards tools built as first-party, self-contained measurement, and first-party or self-hosted analytics are the natural fit rather than an ad-platform analytics product bent into compliance.

Draw the first-party boundary — and make it auditable

The practical work is to draw a hard line around a first-party measurement pipeline and keep everything exempt inside it. Audience measurement for your own service lives in a stack you control, scoped to your own domains, with no outbound flow to advertising systems or to processors that reuse the data for their own ends. Anything that needs to leave that boundary — ad activation, cross-site profiling, enrichment — runs in a separate pipeline that you treat as consent-dependent, because it is. The point is to stop contaminating exempt measurement with a non-exempt purpose, which is the quiet way most setups disqualify themselves.

Separating the measurement pipeline from the activation pipeline is also just good data hygiene, and it connects to a principle this blog has argued independently of any regulation: a decision-backward tracking plan that minimises what you collect leaves you collecting less, aggregating earlier, and sharing nothing you do not need to — which is exactly the posture Article 88a rewards. The regulation and the discipline point the same way: collect for a purpose, keep it first-party, and do not let the data sprawl into uses that drag it back under consent.

What qualifying buys you: the consent-decline data gap

The reason this exemption is worth engineering toward is not compliance for its own sake — it is data completeness. Under current consent rules, every visitor who declines the banner vanishes from your analytics, and that consent-decline rate punches a hole in your acquisition funnel precisely at the top, where you can least afford to be blind. If aggregated first-party measurement no longer needs a banner, that hole closes: you measure your real audience, not the consenting subset, and your funnel maths stops being quietly biased by who happened to click "accept."

That is the same accuracy argument behind cookieless analytics producing more accurate acquisition data, now reinforced by a legal basis rather than only a technical one. Teams already running privacy-first, single-service measurement inherit both benefits at once — a defensible exemption claim and a complete dataset — which is why the setups built for data ownership through self-hosted analytics look increasingly like the aligned architecture rather than the idealistic one.

What to do this sprint

Do not rewrite anything for a rule that is not yet law — but do map your exposure now, because the map is useful regardless of the Omnibus's final shape. Draw your current analytics data flow end to end: what is collected, where each event goes, which third parties touch it, and what it is used for beyond counting your own audience. The moment you draw it honestly, the disqualifying flows become obvious — the export into the ad platform, the vendor reusing your data, the cross-property stitch — and each one is a decision you can revisit on its own merits.

Then separate the exempt pipeline from the non-exempt one in your architecture, even before the law forces it, so that if and when Article 88a lands six months after adoption you are already measuring your own audience inside a clean first-party boundary and can switch off the analytics banner with a documented basis. Keep the paperwork light but real: a one-page data-flow diagram and a note on why the measurement is aggregated, single-service, and unshared is the artefact that turns "we think we qualify" into something you can defend. The rule is still a proposal; the instrumentation that would satisfy it is worth having either way.

Frequently asked questions

The questions below cover what the Article 88a aggregated-measurement exception says, whether GA4 qualifies, the current legislative status, what disqualifies an analytics setup, and what to instrument now to prepare.