GDPR reform: These are the planned changes to cookie banners

November 13, 2025

Categories:

Article by Aristotelis Zervos, Data protection in Europe

Aristotelis Zervos

Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protectionIT compliance and AI regulation.

As part of its „Digital Omnibus“ initiative, the EU Commission is planning a far-reaching reform of the General Data Protection Regulation, which particularly affects the rules for online tracking and cookie banners. The aim is to curb the flood of consent banners and simplify the legal framework. Data protection should still be guaranteed. We present the most important changes.

Waiver of the consent requirement for Cookies

A central element of the reform proposal is a new legal framework for Cookies and tracking services. To date, the EU ePrivacy Directive does not allow necessary Cookies only with prior express Consent of the user can be set and read (opt-in obligation). The Commission now wants to lift this strict consent requirement.

Instead of focusing exclusively on Consent any GDPR-compliant legal basis for cookie tracking should be permitted, including the legitimate interest of website operators. Specifically, tracking cookies could be set in future without a prior banner, provided that the Responsible persons can invoke another legal basis, e.g. its legitimate business interest. For users, this would mean a shift from opt-in to opt-out: Cookies would be set by default and Affected parties would have to object retrospectively instead of agreeing in advance. This would also mean a shift in the burden of proof.

At the same time, this amendment is intended to eliminate the current double regulation by GDPR and ePrivacy. The plan is to implement the cookie rules directly in the GDPR (through a new Article 88a GDPR). This would create a uniform, consistent legal framework for online tracking in the EU, which should eliminate overlaps and uncertainties caused by dual-track supervision (data protection authorities vs. telecoms regulators).

Fewer cookie banners thanks to automated browser preferences

One of the Commission's declared aims is to counteract the flood of cookie banners and user „consent fatigue“. In future, users should therefore be able to transmit their data protection preferences automatically and in machine-readable form instead of having to click through countless pop-ups. Technically, the plan is for browsers or operating systems to send standardized privacy signals to websites. These signals tell the website whether a user Cookies accepts or rejects cookies for certain purposes. For example, the browser automatically sends the information „Advertising and tracking cookies not wanted“. The website must read and respect this preference without the user having to manually click on „Reject“ each time. Website operators would be obliged to automatically respect such user preferences.

However, implementation depends on all parties involved agreeing on common technical standards. The Commission would like to mandate standardization organizations accordingly and, if necessary, require browser manufacturers to provide such setting options.

As soon as the technical standards have been defined, a short transition period is planned. A period of around six months is being discussed. After that, all providers would have to accept the automatic do-not-track signals on a binding basis.

Disadvantage: Until such standards and solutions are available in practice, the usual banners will remain for the time being. The desired automation requires industry-wide implementation, which will take time.

Special regulation: exception for media providers

A significant exception in the reform project is provided for journalistic online media and news portals. Media providers are to be excluded from the automatic consideration of browser preferences described above.

The EU Commission justifies this with the special role of independent journalism in democracy and its financing: Many news websites are dependent on advertising revenue, which is often generated by personalized Advertising takes place. If general „do-not-track“ signals were strictly enforced, these portals would not be able to provide personalized Tracking which could jeopardize their advertising revenues and thus their economic basis.

In practice, this exception means that even if a user has preset „no tracking cookies“ in their browser, a news website, for example, may still display its own cookie banner and ask for consent to personalized advertising. Advertising ask. The user's general default setting would not have to be accepted automatically in this particular case.

Reading tip: EU partially repeals supply chain law - omnibus to relieve companies

Further technical adjustments at a glance

In addition, the draft contains further changes that are intended to facilitate cookie and tracking management from a company perspective. The most important points are

Aggregated Usage data without Consent: The use of Cookies for purely statistical purposes (e.g. to measure reach), without individual Profiling, without prior Consent be permissible. In particular, security and reach analysis cookies could be used without banners as long as only aggregated, anonymized information is collected. For website operators, this would mean that visitor numbers or general usage statistics could be collected without consent in future, provided that no personal profiles are created.
„One-click“ cookie banner (reject all button): In order to make remaining banners more user-friendly, a simplified consent mechanism is to be prescribed. Users must Cookies accept or reject with just one click. In particular, a clearly visible „Reject all“ button will be mandatory, equivalent to the current „Accept all“ button. Manipulative designs, such as hidden rejection options, would not be permitted. This „single-click“ principle is intended to ensure that the rejection of unnecessary Cookies is just as simple as consent, which increases effective user protection.
Browser signals as ContradictionAs described above, privacy preference signals (machine-readable opt-out signals) should be explicitly recognized as a valid Contradiction to GDPR be recognized. For example, if a user generally sets „Tracking prohibit“, this is deemed to be an exercised right of objection that prevents data processing. In future, websites would have to automatically evaluate such Do-Not-Track headers and refrain from processing data accordingly. This automates the enforcement of user preferences and relieves Affected parties from manually exercising their right to object on each page. It is important for companies to implement technical solutions at an early stage in order to receive and heed such signals.

Outlook: When will the new cookie rules come into force?

The formal proposal from the EU Commission was presented on November 19, 2025. It will then go through the standard EU legislative process: the European Parliament and the Council of Member States will discuss the draft and finally adopt it. Further adjustments to the proposals are likely, as controversial discussions are already underway and data protectionists are warning against a watering down of data protection.

It is currently not possible to give a specific date for when the new rules will apply. Optimistic scenarios assume that the reform could be adopted by the end of 2026. It could then come into force in 2027 at the earliest, depending on how the negotiations progress. There are also likely to be transitional periods. For example, an implementation period of around six months is planned for the introduction of browser preference signals once the technical standards have been defined.

Source: Omnibus bill on Data Act and GDPR (PDF)

Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with profound expertise in data protection, GDPRIT compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR compliance and risk management. You can find out more about him on his Author profile page.