EU Digital Omnibus: Cookie Rule Changes for SaaS Teams

For years, EU cookie compliance has been governed by a tangle of the ePrivacy Directive and the GDPR, interpreted differently across member states and bolted onto every website as a consent banner. The European Commission's Digital Omnibus, published on 19 November 2025, is the most significant attempt yet to simplify that tangle — and it has direct consequences for how SaaS teams collect analytics. Before going further: this is a proposal, not enacted law. It is still moving through the legislative procedure and is not something you must comply with today. But the direction it sets is worth understanding now, because it rewards exactly the kind of measurement privacy-conscious teams should already be moving toward.

What the Digital Omnibus actually proposes

The package is a broad simplification effort spanning the GDPR, ePrivacy, NIS2, DORA and the AI Act, but the part that matters for analytics is the cookie and tracking overhaul. The proposal would integrate cookie rules directly into the GDPR through a new Article 88a, replacing the current reliance on the ePrivacy Directive, with a companion Article 88b governing how consent, refusal and objection are technically expressed — including through automated, machine-readable signals. In plain terms: the rules that currently force a banner would move into the GDPR itself and gain a standardized, browser-level way of expressing a user's choice.

Alongside that, the proposal introduces single-click accept/reject mechanisms with equal prominence, prevents sites from re-requesting declined consent for six months, and carves out exemptions for certain low-risk uses. As Osborne Clarke's analysis frames it, the Digital Omnibus "reshapes EU cookie rules but leaves banner fatigue largely intact". That nuance matters: the headlines promising the death of the cookie banner are overstated, but the underlying mechanics — how consent is captured, refused and signalled — are genuinely being rewritten.

The audience-measurement exemption that favors privacy-first analytics

The single most relevant clause for analytics teams is the proposed exemption for aggregated audience measurement. One amendment would exempt the consent requirement for storing or accessing data on a user's device when it is strictly necessary to create aggregated audience measurement, provided the website controller carries out that analytics for itself. Read carefully, this is a regulatory nod toward first-party, aggregate, privacy-first measurement — and away from third-party tracking that stitches identities across sites.

For a SaaS company, that distinction is the whole ballgame. Analytics that builds cross-site behavioral profiles is exactly what regulators and browsers are squeezing. Analytics that counts visits, funnels and events in aggregate, on your own infrastructure, for your own decisions, is what the exemption is designed to permit. If your measurement already looks like the latter, the proposed rules are a tailwind rather than a threat. This is the same logic that pushes teams toward cookieless analytics — the architecture and the regulation are converging on the same place.

Machine-readable signals: consent moves into the browser

Article 88b's provision for automated, machine-readable signals is easy to skim past, but it is a structural change. Today, consent is expressed per site, click by click, through whatever banner each site happens to ship. Under the proposal, browser-level preference signals would carry a user's choice, and websites would be required to honor them. That moves the locus of consent from a thousand individual banners to the browser itself — closer to how Global Privacy Control and Do Not Track were always meant to work, but with legal force behind it.

The practical implication for SaaS teams is that your analytics stack will eventually need to read and respect these signals automatically, rather than relying on a consent management platform to interpret a click. Tools that already operate without persistent personal identifiers have a head start here, because there is far less to gate behind a signal in the first place. If you are building or buying measurement in 2026, the ability to cleanly honor a machine-readable preference should be on your checklist, even though the requirement is not yet in force.

Enforcement is already happening — the proposal doesn't change that

It would be a mistake to read the Digital Omnibus as a reason to relax. While the proposal works its way through Brussels, regulators are actively enforcing the rules that exist today. TrustArc's rundown of 2026 enforcement traces most actions back to operational failures — misconfigured consent tools, broken opt-outs, and tracking cookies dropped before consent is given. Matomo's review of the year's changes describes regulators as "looking under the hood", with the UK's ICO expanding scrutiny to the top 1,000 websites.

The throughline is that both today's enforcement and tomorrow's proposed rules punish the same thing: fragile, banner-dependent, profile-building tracking. A SaaS team whose analytics requires a perfectly configured consent stack to stay legal is exposed on both timelines. A team whose analytics needs little or no consent in the first place is insulated from both. The Digital Omnibus doesn't grant amnesty for sloppy setups — it rewards teams that have already simplified. For the deeper mechanics of GA4's specific constraints here, see our breakdown of GA4 privacy and server-side tracking.

A no-regret checklist for SaaS analytics teams

Because the proposal is not final, the smart move is to make changes that pay off regardless of the exact wording that emerges. First, shift toward first-party, aggregate measurement that you run yourself — the architecture the audience-measurement exemption is written to protect. Second, make your reject path exactly as easy as your accept path; equal prominence is both current best practice and a proposed requirement, so there is no version of the future where a buried "reject all" helps you.

Third, design your stack to honor machine-readable browser signals rather than fighting them, since that is where consent is heading. Fourth, keep a written tracking plan so that as rules change you can reason about exactly what data you collect and why — which also keeps your activation funnel measurable through any migration. None of these steps depend on the Digital Omnibus passing in any particular form. They simply make your analytics more defensible, more complete, and more aligned with where both the law and the browser are clearly going.