The EU Council has agreed what it wants to negotiate on the Digital Omnibus. That is a meaningful legislative step, but it does not by itself replace the GDPR or remove a website's consent obligations.
The Council's October 21 announcement, updated October 22, describes its position on proposed changes to data protection, privacy and cybersecurity reporting. The attached document 14756/26 is expressly a mandate for negotiations with the European Parliament.
Read the text with that status attached. “The Council proposes” and “the law now requires” are different claims, even when the document contains legal language that looks ready to apply.
What is in the Council's position
The Council's summary covers changes to GDPR provisions, cookie rules under the ePrivacy Directive, data legislation and incident reporting. It says the mandate retains the current definition of personal data and adds a provision addressing pseudonymisation and identification.
The summary also describes safeguards around proposed sensitive-data exceptions for biometric verification and AI development and operation. Those descriptions are not a blanket permission to use anyone's personal information for any AI purpose. For an actual processing decision, the scope and conditions of the relevant provision matter.
The Council characterises the package as simplification while maintaining strong protection. That is its stated policy position. This report does not independently establish that every proposed change would preserve the same protection in practice.
The breach deadline example shows the stakes
The mandate's proposed replacement for GDPR Article 33, on page 137, uses a 96-hour period where feasible and a high-risk threshold for notifying a supervisory authority. Both the timing and the threshold deserve attention.
By comparison, the Commission's current obligations guide describes notifying the authority without undue delay and within 72 hours when a breach is likely to pose a risk to individuals' rights and freedoms. It separately explains informing affected people when the risk is high, subject to specified protective-measure exceptions.
Do not combine those two current duties into one rule, or substitute the Council's proposed wording into an incident plan today. If an organisation is handling a real incident, the negotiating mandate is not authority to wait longer before reporting.
The useful comparison asks two questions separately: which incidents would need a notification, and how quickly would it be due? Looking only at the headline number of hours would miss part of the proposal's effect.
Fewer banners does not mean unrestricted tracking
The mandate text sets conditions around proposed audience-measurement exemptions. Its discussion of aggregated measurement restricts further purposes and combining data across services. Other measurement provisions have their own conditions.
A site owner should therefore inventory the actual technology and purpose before assuming a proposed exemption would fit. Ask whether a tool measures a service, builds individual profiles, combines activity across services, or sends information to other parties. A marketing label such as “analytics” does not answer those questions.
This is a practical reading method, not a determination that a particular installation qualifies under current law or a future version of the package.
What to watch before changing a policy
At the time of its announcement, the Council said negotiations would start once Parliament adopted its own position. That statement describes the release's procedural status; it is not a claim that this article has independently established every later parliamentary development.
For subsequent updates, keep a short change record: the institution issuing the document, its date, whether it is a proposal or adopted act, the provision affected, and any entry-into-force and application dates. Read amendments in context rather than treating every line in a marked-up negotiation document as agreed law.
Teams can use this period to map data flows and identify procedures a final text might affect. They should retain a clear distinction between planning for a possible change and implementing a new legal requirement. For readers exercising privacy rights, the same distinction prevents a premature headline about “new GDPR rules” from becoming a reason to abandon an existing request.