---
title: "EU Digital Omnibus Regulation"
description: "Complete guide to the EU Digital Omnibus Regulation (COM(2025) 837) simplifying GDPR, ePrivacy, and data legislation"
canonical_url: "https://docs.sealmetrics.com/compliance/omnibus"
lang: "en"
date_generated: "2026-08-09T18:18:16.203Z"
source_hash: "4e9c56c1b19f4b68ab01d9bd71b941d5015b39c2db140d7d2f96f65970c4525f"
content_type: "trust-and-legal"
owner: "legal"
llm_priority: "critical"
source_file: "compliance/omnibus/index.md"
publisher: "Sealmetrics"
---

# EU Digital Omnibus Regulation

Canonical page: https://docs.sealmetrics.com/compliance/omnibus

The **EU Digital Omnibus Regulation** (COM(2025) 837) represents the most significant simplification of European data law since the GDPR came into force in 2018. Published on November 19, 2025, this comprehensive reform consolidates five separate data regulations into two, eliminates cookie banners for 60% of websites, and promises to save businesses €1 billion annually.

## What is the Digital Omnibus?

The Digital Omnibus is part of the European Commission's broader simplification agenda to reduce regulatory complexity while maintaining strong protections for citizens and businesses.

**Official designation**: COM(2025) 837 final

**Published**: November 19, 2025

**Current status**: Under review by European Parliament and Council

**Goal**: Simplify the EU data regulatory framework by:
- Reducing the number of overlapping regulations
- Eliminating contradictions and ambiguities
- Lowering compliance costs
- Maintaining high standards for data protection and privacy

---

## Current Legislative Status

**Info:**
This section reflects the current state of the legislative process. Check official EU sources for the latest developments.

**Tip:**
On February 10, 2026, the European Data Protection Board and European Data Protection Supervisor published their [Joint Opinion 2/2026](./edpb-edps-opinion.md) on the Digital Omnibus. They support simplification goals but raise concerns about personal data definition changes and request stronger AI safeguards. This consultative document may influence the final text during Parliament/Council negotiations.

### Committee Assignments

The Digital Omnibus proposal (procedure 2025/0360(COD)) has been assigned to **joint committee responsibility**:

| Committee | Role |
|-----------|------|
| **ITRE** (Industry, Research and Energy) | Joint lead committee |
| **LIBE** (Civil Liberties, Justice and Home Affairs) | Joint lead committee |

**Rapporteurs**: Not yet appointed (as of January 2026)

### Open Feedback Periods

The Commission has opened post-adoption feedback opportunities:

| Consultation | Deadline |
|--------------|----------|
| Digital Omnibus feedback | **9 March 2026** |
| Digital Fitness Check | **11 March 2026** |

Organizations can submit feedback through the [Have Your Say portal](https://ec.europa.eu/info/law/better-regulation/have-your-say_en).

### Expected Timeline

| Milestone | Expected Date |
|-----------|---------------|
| Committee rapporteur appointments | Q1 2026 |
| Parliament/Council positions | Q2 2026 |
| Trilogue negotiations | Summer 2026 |
| Final adoption | Mid-to-late 2026 |
| Entry into force | ~Q3 2027 |

**Note**: Timeline may shift based on negotiation complexity and political priorities.

---

## The Great Consolidation: 5 Laws → 2 Laws

### Laws Being Amended (Not Repealed)

#### General Data Protection Regulation (GDPR)
**Status**: Amended with targeted improvements

The GDPR remains the cornerstone of EU data protection but receives important updates:
- Personal data definition clarified
- Cookie consent rules integrated (new Articles 88a, 88b)
- AI processing provisions (new Article 88c)
- Breach notification threshold raised
- Research exemptions expanded
- Information requirements simplified

See: [GDPR Amendments in Detail](./gdpr-changes.md)

#### Data Act
**Status**: Becomes consolidated framework for data sharing and access

The Data Act absorbs provisions from:
- Data Governance Act
- Open Data Directive
- Free Flow of Data Regulation (partially)

**Result**: Single comprehensive regulation for data access, sharing, and portability across sectors.

### Laws Being Repealed or Merged

#### 1. Platform-to-Business Regulation (EU 2019/1150)
**Status**: Fully repealed

**Reason**: Superseded by the Digital Services Act (DSA) and Digital Markets Act (DMA), which provide more comprehensive and effective rules for platform governance.

**What this means**: No separate P2B compliance regime; platform obligations now governed by DSA/DMA.

#### 2. Free Flow of Data Regulation (EU 2018/1807)
**Status**: Mostly repealed; core provisions merged into Data Act

**Provisions retained:**
- Freedom of data flows within the EU
- Restrictions on data localization requirements
- Portability of non-personal data

**Why consolidate**: Avoids fragmentation between personal data (GDPR) and non-personal data (Free Flow) rules.

#### 3. Data Governance Act (EU 2022/868)
**Status**: Merged into Data Act

**Key provisions integrated:**
- Data intermediation services
- Data altruism organizations
- Public sector data re-use
- Governance structures for data sharing

**Benefit**: Single coherent framework for data governance instead of overlapping regulations.

#### 4. Open Data Directive (EU 2019/1024)
**Status**: Merged into Data Act

**What's integrated:**
- Public sector information re-use
- High-value datasets
- Transparency requirements
- Charging principles

**Result**: Public and private data sharing governed by unified rules.

### The Final Landscape

**Before Omnibus (2024):**
- GDPR
- Data Act
- Data Governance Act
- Open Data Directive
- Free Flow of Data Regulation
- P2B Regulation

**Total**: 6 major data regulations

**After Omnibus (2026+):**
- GDPR (amended)
- Data Act (consolidated)

**Total**: 2 major data regulations

**Plus**: DSA and DMA continue to govern digital platforms

## Key Changes Overview

### 1. Cookie Consent Reform

**The biggest change**: Article 5(3) ePrivacy Directive repealed for personal data; cookies brought under GDPR framework.

**New regime (Articles 88a, 88b GDPR):**
- Audience measurement for own use: **NO CONSENT NEEDED**
- Third-party tracking: **CONSENT REQUIRED**
- Single-click refuse button mandatory
- No re-asking for 6 months after refusal
- Browser signals for machine-readable consent (24-48 month timeline)

**Impact:**
- First-party analytics for own use: **NO CONSENT NEEDED**
- Third-party tracking: **CONSENT STILL REQUIRED**
- €820M/year projected business savings
- €500M/year projected user productivity gains

**Note:**
While the Commission projects significant banner reduction, legal analysts note that information obligations and third-party tools will maintain some form of notification for many websites. Full banner elimination applies mainly to sites using **only** first-party, aggregated analytics.

**Learn more**: [Cookie Consent Reform](./cookies-eprivacy.md)

### 2. GDPR Clarifications

**Personal data definition:**
- "Reasonably likely to be used" standard codified
- Entity-specific determination
- Pseudonymization clarity

**AI processing:**
- New Article 88c: Legitimate interest for AI development
- Safeguards for special category data
- Unconditional right to object

**Breach notifications:**
- Threshold raised from "risk" to "high risk"
- Single entry point via ENISA
- EDPB to create common template

**Research exemptions:**
- Expanded definition (includes tech development)
- Further processing compatibility
- Legitimate interest basis

**Learn more**: [GDPR Amendments](./gdpr-changes.md)

### 3. Single Incident Reporting Point

**Current problem**: Businesses must report security incidents to multiple authorities under different regulations.

**Omnibus solution**: ENISA (European Union Agency for Cybersecurity) operates a **single entry point** for incident reporting.

**Benefits:**
- One report satisfies multiple obligations
- Consistent format and process
- Better coordination across authorities
- Reduced administrative burden

### 4. SME/SMC Extended Exemptions

**SMEs (Small and Medium Enterprises)** and **SMCs (Small and Medium-Sized Companies)** receive:
- Extended exemptions from certain Data Act obligations
- Reduced fees for certifications
- Simplified compliance pathways
- Proportionate requirements based on size

**Estimated savings**: €5-19M annually across the SME sector.

## Economic Impact

### Cost Savings for Businesses

| Category | Annual Savings |
|----------|---------------|
| Cookie banner elimination | €820 million |
| Data intermediation simplification | €6 million |
| SMC fee exemptions | €5-19 million |
| Custom cloud contracts (one-off) | €1.015 billion |
| B2G scope narrowing | €19.7 million/year |
| **Total business savings by 2029** | **≥€5 billion** |

### Cost Savings for Public Sector

| Category | Annual Savings |
|----------|---------------|
| Cookie banner elimination | €320 million |
| Data governance consolidation | Significant (TBD) |
| Simplified compliance | Significant (TBD) |
| **Total public authority savings by 2029** | **€1 billion** |

### User Benefits

**Time savings**: 334 million hours/year currently wasted on cookie banners will be reclaimed.

**Productivity value**: €500 million/year in user time savings (200 million users × reduced banner interactions).

**Better experience**: Fewer interruptions, clearer choices, more respectful web browsing.

## Timeline

### Legislative Process

**November 19, 2025**: Commission proposal published (COM(2025) 837)

**2026**: European Parliament and Council negotiation (ordinary legislative procedure)

**Expected adoption**: Late 2026 or early 2027

**Entry into force**: 20 days after publication in Official Journal

### Implementation Deadlines

**Article 88a (cookies)**: 6 months after entry into force

**Article 88b (browser signals):**
- Websites: 24 months after entry into force
- Browser vendors: 48 months after entry into force

**Estimated operational dates:**
- Cookie exemptions: Mid-2027
- Website browser signal support: 2028-2029
- Full browser controls: 2029-2030

## Who is Affected?

### Website Operators

**All EU websites:**
- New cookie consent rules apply
- Opportunity to eliminate banners for audience measurement
- Browser signal support required (24 months)

**Action required:**
- Audit analytics and tracking tools
- Identify exempt vs. consent-required processing
- Update privacy policies
- Prepare for browser signals

### Analytics and Ad Tech Providers

**First-party analytics:**
- Clear legal basis without consent
- Competitive advantage

**Third-party tracking:**
- Consent still required
- Browser signals will impact consent rates
- Need to adapt business models

**Learn more**: [Impact on Web Analytics](./impact-analytics.md)

### AI Developers

**New legal basis:**
- Article 88c provides legitimate interest for AI development
- Must implement safeguards
- Respect right to object
- Avoid special category data

### Data Controllers and Processors (General)

**Simplified framework:**
- Fewer regulations to navigate
- Clearer rules
- Reduced overlaps

**New obligations:**
- Browser signal support
- Updated GDPR compliance
- Adapted data governance practices

## Documentation in This Section

### Core Documents

- **[Cookie Consent Reform](./cookies-eprivacy.md)** - Detailed analysis of Articles 88a and 88b, cookie banner elimination, and browser signals
- **[GDPR Amendments](./gdpr-changes.md)** - Personal data definition, AI processing, breach notifications, research exemptions
- **[Data Law Consolidation](./data-consolidation.md)** - How 5 separate data laws are merged into 2
- **[Data Intermediation Services](./data-intermediation.md)** - Voluntary regime for trusted data sharing platforms

### Implementation & Compliance

- **[Timeline and Implementation](./timeline-implementation.md)** - Key dates, deadlines, and preparation phases
- **[SME and Small Mid-Cap Exemptions](./smes-small-midcaps.md)** - Extended protections for companies with up to 749 employees
- **[Single Entry Point for Incident Reporting](./incident-reporting.md)** - Unified cybersecurity and data breach reporting via ENISA

### Industry Impact

- **[Impact on Web Analytics](./impact-analytics.md)** - How the Omnibus affects analytics providers and website tracking
- **[AI Act Amendments](./ai-act-amendments.md)** - GDPR-AI intersection and Article 88c legitimate interest

### Regulatory Positions

- **[EDPB-EDPS Joint Opinion](./edpb-edps-opinion.md)** - Official position of European data protection authorities on the Digital Omnibus proposal

## Key Differences from Current Law

| Aspect | Current Law | Digital Omnibus |
|--------|-------------|-----------------|
| **Number of data regulations** | 5-6 separate laws | 2 consolidated laws |
| **Cookie consent** | Article 5(3) ePrivacy (separate from GDPR) | Article 88a GDPR (unified) |
| **Audience measurement** | Consent required (limited exemptions) | No consent if aggregated, own use |
| **Browser signals** | Not addressed | Must be supported (Art 88b) |
| **Breach notification** | "Risk" threshold | "High risk" threshold |
| **Personal data definition** | CJEU case law | Codified "reasonably likely" standard |
| **AI processing** | Unclear legal basis | Article 88c legitimate interest |
| **Incident reporting** | Multiple entry points | Single ENISA entry point |
| **Research exemptions** | Limited definition | Expanded (tech development) |

## Frequently Asked Questions

### Does the Omnibus repeal the GDPR?

**No.** The GDPR is **amended**, not repealed. It remains the foundational data protection regulation but receives targeted improvements.

### When will cookie banners disappear?

**Partial reduction starting mid-2027** (6 months after entry into force, estimated).

**First-party analytics** for aggregated, own use will no longer need consent.

**Third-party tracking** (advertising, cross-site) will still require consent.

**Reality check**: Cookie banners will reduce but not fully disappear for most websites. Information obligations and third-party tools will maintain some form of notification. Sites using **only** first-party analytics (like Sealmetrics) have the clearest path to banner-free operation.

### What happens to the ePrivacy Directive?

**Article 5(3) is repealed** for personal data processing. Cookie consent moves to GDPR (Articles 88a, 88b).

**Rest of ePrivacy Directive** remains in force for:
- Non-personal data cookies
- Electronic communications confidentiality
- Marketing communications rules

**Long-term**: ePrivacy Regulation (currently stalled) may eventually replace the entire ePrivacy Directive.

### Do I still need a cookie banner?

**It depends on what you're doing:**

**No banner needed if:**
- ✅ First-party analytics only
- ✅ Aggregated measurement
- ✅ For your own use only
- ✅ Functional cookies for requested services

**Banner still needed if:**
- ❌ Third-party tracking
- ❌ Advertising pixels
- ❌ Cross-site profiling
- ❌ Selling or sharing data

**See**: [Cookie Consent Reform](./cookies-eprivacy.md) for detailed guidance.

### How does this affect my GDPR compliance?

**Mostly simplifies:**
- Personal data definition clearer
- Breach notification threshold higher (fewer reports needed)
- Information requirements more flexible (Article 13 exemption)
- Research exemptions broader

**New requirements:**
- Cookie consent under GDPR framework (Articles 88a, 88b)
- Browser signal support (24 months)
- AI processing safeguards (Article 88c)

**Overall**: Compliance becomes clearer and less burdensome for most organizations.

### What should I do to prepare?

**Immediate steps:**

1. **Audit analytics and tracking**
   - What tools do you use?
   - Which need consent vs. are exempt?

2. **Review data processing inventory**
   - Update for Article 88a framework
   - Identify browser signal impact

3. **Update privacy policies**
   - Reference new legal bases
   - Explain exempt processing

4. **Plan infrastructure changes**
   - Browser signal support
   - Consent management updates

5. **Consider switching to consentless analytics**
   - Sealmetrics, Plausible, Fathom, etc.
   - Eliminate banner costs
   - Gain complete data

**Timeline**: Finalize plans by late 2026, implement by mid-2027.

## Additional Resources

### Official EU Documents

- [COM(2025) 837 final - Proposal](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2025:837:FIN) (when published)
- Staff Working Document (Impact Assessment)
- European Data Protection Board guidelines (forthcoming)

### Related Regulations

- **GDPR** (EU 2016/679) - Data protection foundation
- **Data Act** (EU 2023/2854) - Data sharing and access
- **Digital Services Act** (EU 2022/2065) - Platform governance
- **Digital Markets Act** (EU 2022/1925) - Gatekeeper regulation
- **ePrivacy Directive** (2002/58/EC, as amended) - Electronic communications privacy

### Regulatory Opinions

- [EDPB-EDPS Joint Opinion 2/2026](https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal_en) - Official position on the Digital Omnibus
- EDPB guidelines on Articles 88a and 88b (expected after adoption)
- National DPA guidance on cookie exemptions (expected after adoption)
- European standardisation bodies: Browser signal standards

## Conclusion

The EU Digital Omnibus represents a pragmatic evolution of European data law. By consolidating five regulations into two, eliminating cookie banners for benign processing, and clarifying ambiguities in the GDPR, the Omnibus promises to reduce compliance costs by €1 billion annually while maintaining the EU's world-leading privacy standards.

For website operators, the message is clear: privacy-respecting, first-party analytics will become the norm, while invasive tracking faces increasing barriers. Organizations that embrace consentless analytics and first-party data strategies will gain competitive advantages in compliance simplicity, data quality, and user experience.

The transition period (2026-2030) provides ample time to adapt. Those who prepare early will reap the greatest benefits.

---

**Stay Updated**: This documentation will be updated as the Omnibus proceeds through the legislative process and implementing acts are adopted.

**Questions?** Explore the detailed analyses linked above or consult with privacy counsel on your specific situation.

## Related documentation

- [Cookie Consent Reform: The End of Banner Fatigue](/compliance/omnibus/cookies-eprivacy) — how Article 88a moves cookie consent under the GDPR.
- [Impact on Web Analytics and Tracking](/compliance/omnibus/impact-analytics) — what the Omnibus means for consentless measurement.
- [EDPB-EDPS Joint Opinion on the Digital Omnibus](/compliance/omnibus/edpb-edps-opinion) — the regulators' position on the proposal.
- [Compliance Overview](/compliance/compliance-overview) — how Sealmetrics maps to GDPR, ePrivacy, CCPA, and PECR today.
- [Why Sealmetrics Can Measure Without Consent](/security-privacy/why-no-consent) — the technical basis for consentless analytics.