Skip to main content

EU Digital Omnibus: The End of Cookie Banner Fatigue?

· 7 min read
Rafa Jimenez
Rafa Jimenez
Founder of Sealmetrics

Cookie banners cost EU businesses €1.64 billion annually. EU users waste 334 million hours per year clicking through them. And yet, 54% of users randomly accept without reading, while 26% randomly reject—undermining the very goal of informed consent.

On November 19, 2025, the European Commission published a proposal that could change everything: the EU Digital Omnibus Regulation (COM(2025) 837).

What Just Happened?​

The Digital Omnibus is the EU's most ambitious simplification of data regulation since the GDPR came into force in 2018. It consolidates five separate data laws into two and introduces fundamental changes to how cookie consent works.

The headline: Cookie banners will disappear for an estimated 60% of websites.

But there's more to the story.

Current Reality: A Broken System​

Since the ePrivacy Directive of 2009, nearly every website in the EU has been forced to ask for cookie consent. The result:

  • 41% of websites display cookie banners
  • Average user encounters multiple banners daily
  • Users suffer from "consent fatigue" and make uninformed decisions
  • Businesses spend €1.64 billion annually on compliance

The system protects no one. Users are annoyed. Businesses are burdened. Privacy is undermined.

The New Framework: Articles 88a and 88b GDPR​

The Omnibus repeals Article 5(3) of the ePrivacy Directive and brings cookie consent under the GDPR framework through two new articles:

Article 88a: Defines when consent is needed and when it's not.

Article 88b: Requires websites to respect browser-level privacy signals.

The Game-Changing Exemption​

Here's the breakthrough. Article 88a(3)(c) creates a consent exemption for:

"Creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use"

Translation: First-party analytics for your own use = NO CONSENT NEEDED.

Requirements:

  • ✅ Data must be aggregated (not individual user tracking)
  • ✅ Processing by the controller (website owner)
  • ✅ For the controller's own use only (no sharing or selling)

What this means in practice:

You CAN do without consent:

  • Measure total page views and visitors
  • Understand traffic sources
  • Analyze popular content
  • Track conversions in aggregate
  • Optimize user experience

You CANNOT do without consent:

  • Third-party tracking across sites
  • Individual user profiling
  • Sharing analytics data with advertisers
  • Retargeting and behavioral advertising

Impact on Web Analytics​

Winners​

Consentless analytics providers like Sealmetrics, Plausible, and Fathom are validated. These platforms already operate under privacy-first principles:

  • No cookies or cookieless design
  • First-party data only
  • Aggregated measurement
  • No cross-site tracking
  • No data sharing

Result: These tools will be explicitly compliant with Article 88a(3)(c) and can operate without consent banners.

Website operators using first-party analytics will benefit from:

  • No cookie banner costs (€400-€5,000/year savings)
  • Complete traffic data (no loss from consent denial)
  • Better user experience
  • Simplified compliance

Losers​

Third-party tracking networks and advertising platforms that rely on cross-site tracking will:

  • Still require consent (no exemption)
  • Face lower consent rates when browser signals arrive
  • Need to restructure or adapt business models

Consent Management Platforms (CMPs) face a contracting market:

  • 60% of websites may no longer need banners
  • Smaller addressable market
  • Pressure on pricing

What About Google Analytics?​

It depends on configuration.

  • GA4 with no data sharing, no advertising features, first-party use only: Likely exempt under Article 88a(3)(c)
  • GA4 with advertising features or cross-site tracking: Consent required

The key question: Is data used solely for your own audience measurement, or is it shared with Google for their purposes (advertising, benchmarking)?

Recommendation: If uncertain, switch to a clearly exempt platform or consult privacy counsel.

Browser Signals: The Next Frontier​

Article 88b introduces a requirement for websites to accept machine-readable consent preferences from browsers.

Timeline:

  • 24 months: Websites must support browser signals
  • 48 months: Browser vendors must provide user controls

What this means:

Users will eventually set privacy preferences once in their browser (think: "reject all tracking by default"). Websites must respect these settings.

Exception: Media service providers (news sites, publishers) are exempt and can still ask for consent directly.

Impact: Consent rates for tracking may drop to 10-30% when browsers deploy default-reject settings. First-party analytics, being exempt, will be unaffected.

What Sealmetrics Users Should Know​

Sealmetrics is designed precisely for the Article 88a(3)(c) exemption:

✅ Aggregated measurement: No individual user tracking across sessions.

✅ First-party data only: Data belongs to you, not shared with third parties.

✅ For your own use: Sealmetrics acts as your processor; data is used solely for your audience insights.

Result: Sealmetrics users can confidently operate without cookie banners under the new framework.

Advantages post-Omnibus:

  • Legal certainty with explicit GDPR basis
  • Complete data (no consent-denial data loss)
  • Cost savings (no CMP, no banner)
  • Better UX (no interruptions)
  • Future-proof for browser signals (exempt analytics unaffected)

Timeline and Next Steps​

Now (November 2025): Commission proposal published

2026: European Parliament and Council negotiation

Expected adoption: Late 2026 or early 2027

Entry into force: 20 days after publication

Operational dates:

  • Cookie exemptions: Mid-2027
  • Website browser signal support: 2028-2029
  • Full browser controls: 2029-2030

Prepare for the New Framework​

For Website Operators​

1. Audit your analytics

  • Which tools do you use?
  • Are they first-party and aggregated?
  • Do they share data with third parties?

2. Identify consent requirements

  • First-party analytics for own use: No consent
  • Third-party tracking, advertising: Consent required

3. Consider switching to consentless analytics

  • Evaluate Sealmetrics, Plausible, Fathom, or similar
  • Calculate savings: CMP costs + complete data vs. partial data

4. Update privacy policies

  • Reference Article 88a(3)(c) exemption
  • Document your legal basis
  • Be transparent about data use

5. Plan for browser signals

  • Monitor standardization efforts
  • Prepare infrastructure for Article 88b (24 months)

For Analytics Providers​

If you're first-party focused:

  • Market your Article 88a(3)(c) compliance
  • Emphasize no-consent-needed positioning
  • Help customers eliminate banners

If you're third-party/ad-tech:

  • Prepare for browser signals impact
  • Consider restructuring to first-party models
  • Optimize consent UX (single-click refuse, 6-month cooldown)

The Bigger Picture​

The Digital Omnibus does more than eliminate cookie banners. It:

  • Consolidates 5 data laws into 2 (GDPR + Data Act)
  • Clarifies GDPR ambiguities (personal data definition, AI processing, research)
  • Raises breach notification threshold to "high risk" (fewer trivial reports)
  • Saves businesses €1 billion annually by 2029

But the cookie consent reform is the most visible change—and for good reason. It directly affects every website, every user, every day.

Conclusion: A Privacy-First Future​

The EU Digital Omnibus recognizes a fundamental truth: not all data processing is equally invasive.

First-party audience measurement for your own use is benign. It helps you understand your visitors, improve your content, and optimize your service. It doesn't track users across the web or build invasive profiles.

Third-party tracking and cross-site profiling is different. It follows users everywhere, builds detailed dossiers, and powers surveillance advertising. That deserves consent.

By distinguishing between the two, Article 88a(3)(c) promises to eliminate consent fatigue while preserving meaningful privacy protections.

For Sealmetrics users, this is validation. You're already ahead of the curve with privacy-first analytics. When the Omnibus becomes law, you'll have legal certainty, cost savings, and a competitive advantage.

For the industry, this is a turning point. The future belongs to consentless, first-party, privacy-respecting analytics.

The cookie banner era isn't ending overnight. But it's beginning to end.

Learn More​

Questions about how the Omnibus affects your analytics? Reach out to our team or explore the detailed documentation above.