EU Council Backs Digital Rule Changes: What the Cookie and Breach-Reporting Proposals Would Do

The Council of the EU has agreed its negotiating position on changes to privacy, data protection and cyber-incident reporting. The package could reduce some cookie prompts and reporting duplication, but it is still a legislative proposal and does not replace existing obligations today.

The European Union has moved another step towards changing parts of its digital rulebook, with the Council agreeing a negotiating position on October 21 and publishing an updated announcement on October 22. The package covers data protection, online tracking and the reporting of cybersecurity incidents. Its immediate significance is institutional: member states have a position from which to negotiate, while a final law still requires agreement with the European Parliament. Council announcement.

For people confronting consent prompts and organisations managing overlapping reporting systems, the proposals concern familiar frustrations. The difficult question is how to remove unnecessary administrative work while preserving protections that serve a substantive purpose. Fewer forms or fewer banners can be useful outcomes, but the number alone does not establish whether a reform improves privacy or security.

A negotiating mandate is an intermediate step

The Council’s explanation of the ordinary legislative procedure sets out the basic sequence: the Commission proposes legislation, the Council and Parliament examine and may amend it, and adoption requires agreement on the same text. A negotiating mandate equips one institution to enter that process. It is not equivalent to the final adoption of every provision it contains. How EU legislation is adopted.

That distinction should govern the language used about the October agreement. A proposal may seek a longer reporting period or a narrower category of consent prompts without making those changes available immediately. The text can also change during negotiations. Businesses following the debate therefore need to distinguish a potential future operating model from the requirements under which they currently operate.

The Council says negotiations will begin once Parliament adopts its own position. Its announcement also distinguishes this file from the separate AI-related part of the wider package. Treating all measures described as the Digital Omnibus as one completed law would obscure both the procedural stages and the different subjects involved. Next steps and scope.

Why the Commission proposed a simplification package

The Commission presented its digital package on November 19, 2025. Its stated objective was to reduce the cost of applying existing rules while maintaining their policy goals. Its proposal page describes technical amendments across a large body of digital legislation, aimed at businesses, public administrations and citizens. That is the origin of the process now reaching the Council-negotiation stage, rather than a new proposal invented this week. Commission proposal background.

The Commission’s original announcement also placed the measures alongside a Data Union Strategy and European Business Wallets. Those initiatives are related in the broader simplification agenda, but their combined headline ambitions should not be presented as measured savings already achieved by this particular Council position. A projected benefit and an observed result are different forms of evidence. November 2025 package announcement.

For a practical assessment, the useful question is where duplication actually occurs. An organisation may collect the same incident information for several reporting channels, for example, while each authority still has a different responsibility. A simpler submission route could reduce repeated work without eliminating the need to identify those responsibilities accurately.

Cookies: the conditions matter more than the slogan

The Council says its approach keeps cookie and tracking rules within the ePrivacy framework while clarifying and adding purposes for which consent would not be required. Its examples include necessary service functions, audience measurement and device security. That is more specific than saying that cookie banners are being abolished. Council explanation of online tracking changes.

The published mandate provides important detail behind the shorthand. Its audience-measurement provisions include restrictions on using collected information for unrelated purposes and on tracking people outside the service or media content being measured. These conditions are central to the proposal: an exemption for a defined measurement activity should not be read as a general permission to profile a person across the web. Council mandate, audience-measurement provisions.

An illustrative distinction is a service counting visits to understand whether a page is used, compared with building an individual profile across unrelated services for advertising. Both may involve measurement, but that shared word does not make their data practices identical. The final text, its conditions and the actual implementation would determine the significance of any exemption.

Breach reporting: a proposed change, alongside current guidance

The mandate proposes a 96-hour notification period after awareness for a personal-data breach likely to create a high risk to individuals, retaining a requirement to act without undue delay. It also proposes national entry points to support incident reporting. These are elements of the negotiating text, not an instruction to start using a new deadline now. Published negotiating text.

Current Commission guidance explains that a reportable breach posing a risk to individual rights and freedoms must be notified to the supervisory authority without undue delay and within 72 hours of awareness. It separately discusses informing affected people when the risk is high. That distinction between notification to an authority and communication to individuals remains important when reading reform headlines. Commission guidance on existing obligations.

The European Data Protection Board’s practical guidance also explains that incomplete information need not prevent an initial notification within the applicable period: additional information can follow in stages. This illustrates why a response process needs to work while an investigation is still developing. A clock alone does not determine whether an organisation has an effective way to discover, assess and communicate an incident. EDPB breach-notification summary.

The debate over personal data has a history

The European Data Protection Board and European Data Protection Supervisor issued a joint opinion on the original proposal in February. They supported some simplification measures but strongly opposed the proposed changes to the definition of personal data, arguing that those changes could narrow protection and introduce uncertainty. Their intervention predates the Council mandate and should not be described as a new assessment of its October text. February 11 joint response.

The same response welcomed certain harmonisation measures, including common templates, and supported changes to breach-reporting thresholds and timing. This was a differentiated position, rather than a rejection of simplification as a whole. It shows why the debate is best examined provision by provision instead of being reduced to a choice between regulation and innovation.

The Council now says it preserves the current personal-data definition while addressing pseudonymisation separately. A change in that direction is relevant to the earlier concerns, but it does not establish that every disputed question has been resolved. The appropriate comparison is between the original proposal, the regulators’ dated opinion and the later mandate, rather than treating all three as one document.

Reporting routes and responsibilities are different questions

A national entry point could make an incident easier to submit across reporting frameworks. It would still be necessary to determine what happened, which entities are involved and what information the relevant authorities need. A common doorway is an administrative arrangement; it does not automatically mean that every incident has the same legal significance.

Consider a hypothetical service interruption with no evidence yet that personal information has been exposed. The security team would need to establish the incident’s scope before drawing conclusions about data protection. Conversely, an accidental disclosure could matter for privacy even when the service remains available. Simplification is most useful when it preserves those distinctions while reducing repeated collection of the same facts.

The EDPB defines a personal-data breach broadly enough to include accidental or unlawful destruction, loss, alteration, disclosure or access. Its guidance underlines that organisations must document and handle breaches appropriately. That existing foundation is a useful reference point for evaluating proposals concerned with the mechanics of notification. EDPB explanation of personal-data breaches.

For readers evaluating the negotiations, three questions offer a concrete way to follow progress. Does the new text make the relevant responsibility easier to identify? Does it reduce repeated work without concealing information a person or authority needs? Does it explain the conditions under which a permission or exemption applies? A provision can perform well on one question and poorly on another.

Those questions also help separate the political case for simplification from its practical implementation. A clearer form can be an improvement without changing the underlying protection. A changed threshold can have substantive effects even if the document describing it is shorter. The final agreement needs to be read for both kinds of change, with its application dates kept visible.

What to watch as negotiations continue

The next meaningful developments are Parliament’s position, negotiations over a common text and any final adoption and application dates. Announcements should be checked for which institution is acting and which version of the text is being described. A political agreement, publication of a regulation and the date particular provisions begin applying are not necessarily the same event.

Our report on Walmart’s shopping-agent controls concerns a company’s proposed permissions and product rollout. The EU process operates at a different level, but both stories illustrate why clear limits and implementation details matter as much as a promise of convenience.

As of October 22, member states have advanced their negotiating position. The proposal’s value will ultimately depend on the agreed provisions and how they work in practice: less duplication where it serves no purpose, understandable rights for individuals and reporting systems that still support timely protection when something goes wrong.