Startup Blog for First Time Entrepreneurs who Bootstrap

EU Governments Back Fewer Cookie Banners and Simpler GDPR Rules. What Changes for Small Businesses, and What Still Applies Today

TL;DR: is the EU getting rid of cookie banners and simplifying the GDPR?

It’s one step closer, but nothing has changed yet. On 21 October 2026 EU governments, meeting as the Council of the EU, agreed their negotiating position on the Digital Omnibus, the package that rewrites parts of the GDPR and the cookie rules. They want more cookies to be allowed without consent (for example for audience measurement and security), easier handling of abusive data requests, a longer deadline for reporting data breaches, and EU-wide templates. They also kept the current definition of personal data, which the Commission wanted to narrow. Status: Proposed. The European Parliament has no position yet, so today’s GDPR, including the 72-hour breach deadline, still applies. Start with our GDPR guide for European startups.
If you run a small online business in Europe, you probably have a cookie banner you didn’t design, a privacy notice you copied from a template, and a vague fear of what happens if you get a data breach. Brussels has spent a year promising to make all of that simpler.
On Wednesday, EU governments took the step that matters most so far: they agreed what they want. Here’s what is in their version, how it differs from the Commission’s plan, what still applies today, and what to do with your website this month.

What happened on 21 October

At 17:30 on 21 October the Council announced that it had agreed “its position on the proposal to simplify certain rules on data protection, privacy and cybersecurity, while maintaining strong levels of protection for personal data.” According to Agence Europe, EU ambassadors signed off the text that day, after attempts earlier in October had stalled.
The proposal is the digital half of the Commission’s seventh simplification package, “Omnibus VII”. The other half, which delays parts of the AI Act, is already law: it was adopted on 29 June 2026, and the high-risk AI rules now apply from 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into products.
Ireland, which holds the Council presidency, negotiated the deal. Its minister for foreign affairs and trade, Helen McEntee, said: “Simplifying and streamlining the EU’s digital rulebook will make it easier for businesses to operate across Europe, reducing administrative burdens while maintaining high standards for data privacy and citizens’ rights.” Minister of State Thomas Byrne added: “These measures will reduce compliance costs and boost competitiveness and innovation.”

What EU governments want to change

The Council’s position covers five laws. These are the parts that matter most for a small business:
  • Cookies. The rules stay in the e-privacy directive, but with “clearer and additional purposes where consent will not be required”, the Council says, “thus reducing the number of cookie banners”. Its examples: cookies needed to provide a service, audience measurement, and device security.
  • Personal data. The current definition stays. A new provision on pseudonymisation is meant to help companies tell when someone can be identified.
  • Data requests and privacy notices. Simpler rules for “unfounded or excessive requests” and for informing people in “specific low risk circumstances”.
  • Data breaches. The Council backs the Commission’s plan to give businesses more time to report a breach.
  • Templates. One EU-wide list of processing that is “likely to result in a high risk”, and common templates for your paperwork.
  • AI and data. Clarifications on when you may use personal data to develop and run AI, plus safeguards for a new exception covering sensitive data.
  • Incident reports. Instead of one EU-level entry point, each country would set up its own entry point for reporting cyber and data incidents under different EU laws.
  • Platform rules. Provisions of the platform-to-business (P2B) regulation would be repealed.
Agence Europe also reported that the final text asks the Commission for a report on how proportionate the GDPR’s obligations are for small and medium-sized businesses and for organisations whose data processing is low-risk.

Commission vs. Council: what each version would mean for you

The Commission proposed the Digital Omnibus on 19 November 2025. EU governments kept most of its business-friendly parts but dropped or rewrote the most controversial ones.
TopicToday (law)Commission proposalCouncil position
Reporting a data breachTo your authority within 72 hours, unless it’s unlikely to be a riskOnly if it’s likely to be a high risk; within 96 hoursBacks a longer deadline
Cookie consentConsent needed except for strictly necessary cookies (national rules)Rules move into the GDPR; consent-free audience measurement and security; one-click refuseRules stay in e-privacy; more consent-free purposes
Asking again after a refusalNo EU ruleNot for at least 6 months4 months in the 2 October draft (reported)
Browser privacy signalsNo EU ruleWebsites must respect themDropped (reported)
Definition of personal dataCurrent GDPR definitionNarrower: not personal data for a firm that can’t identify the personCurrent definition kept
Platform-to-business rulesP2B regulation appliesMostly repealedProvisions repealed
Status: today’s rules are Adopted; both other columns are Proposed. Sources: Council of the EU, 21 October 2026; Commission proposal COM(2025) 837. The re-ask period and the browser signal come from the Council’s 2 October draft (document 13886/26), as reported by PPC Land; the Council’s press release doesn’t mention them.
The cookie savings are real money. The Commission’s Q&A on the digital package says the cookie changes “will generate more than €800 million in savings for businesses annually”. It also says the exemption from some privacy-notice duties will help “small operators, such as crafts persons that use personal data to contact their clients”. Overall, the package should save “up to €5 billion in administrative costs by 2029”, according to the Commission’s press release.

Why the definition of personal data matters

The Commission wanted to say that information is not personal data for a company that has no “means reasonably likely to be used” to identify the person. Privacy regulators pushed back hard. In February, the European Data Protection Board and the European Data Protection Supervisor urged lawmakers “not to adopt the proposed changes to the definition of personal data as they go far beyond a targeted or technical amendment of the GDPR.”
EU governments listened. For a small business, that means less uncertainty: the definition your privacy policy, your contracts and your email list are built on stays the same. The same watchdogs did support the longer breach deadline and the higher threshold for reporting.
Consumer groups want less change overall. On 30 September, BEUC director general Agustín Reyna said: “The discussions around simplifying the EU rulebook too often focus on the cost of regulation, while ignoring the cost of no regulation.” BEUC also cites research it commissioned that “approximately 60% of small businesses close their doors within six months of a data breach.” Parliament’s position: Debated, with no vote yet.

The catch: Parliament hasn’t decided

The Council says its presidency “will start negotiations with the European Parliament once the latter adopts its own negotiating position”. That could take a while. In Parliament, two committees share the file: industry (ITRE), with rapporteur Aura Salla (EPP), and civil liberties (LIBE), with rapporteur Marina Kaljurand (S&D). The draft report came out on 22 June 2026 and amendments were tabled on 27 July. The procedure file still says “Awaiting committee decision”.
In July, Agence Europe reported that a committee vote was “envisaged at the beginning of 2027”. After that come negotiations between Parliament and Council, formal adoption and entry into force. In the Commission’s draft, the cookie rules would apply only 6 months after entry into force. The presidents of the Council, Parliament and Commission have pledged to finish all simplification packages by the end of 2027.
StepWhoStatus on 22 Oct 2026
ProposalEuropean CommissionDone, 19 November 2025
Negotiating positionCouncil (EU governments)Done, 21 October 2026
Negotiating positionEuropean Parliament (ITRE and LIBE committees)Pending; committee vote expected early 2027
Final deal (trilogue)Parliament, Council, CommissionNot started
Rules apply to your businessEveryoneNot before the law is adopted and in force

What this means for you

Nothing changes legally today. But you now know which way the rules are moving, and you can avoid wasting money on the wrong fixes.
  1. Keep your breach plan on 72 hours. The longer deadline is only proposed. If a supplier leaks your customer data, you still have to act fast; see our news on the Ogi Networks data breach and our cybersecurity essentials for non-technical founders.
  2. Don’t remove your cookie banner. National cookie rules apply until the new law is in force and, for the e-privacy part, written into national law. Make sure Reject is as easy as Accept.
  3. Audit your analytics. In the Commission’s version, consent-free audience measurement covers only aggregated statistics made by the site itself, “solely for its own use”. Tools that share data for advertising may still need consent. Our website analytics basics explain what to track.
  4. Log data requests. Simpler rules for “unfounded or excessive” requests will only help you if you can show the pattern. Keep a simple log with dates and answers; templates are in our legal templates and resources.
  5. Save your platform terms. If you sell on marketplaces or app stores, the P2B rules may be repealed. Keep copies of the terms you sell under and of every change notice.
  6. Follow the rest of the EU agenda. The same simplification push covers the EU Inc company form and the packaging representative rule. Our overview of EU policy changes for women founders pulls it together.
Building your first online business on a bootstrap budget?

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder, so you set up your website, data and customer processes right the first time.

👉 Start the game

What to watch next

  • Parliament’s committee vote: whether MEPs keep the browser signal, the 6-month re-ask period and the narrower definition of personal data that governments dropped.
  • The breach deadline: 96 hours is the Commission’s number; the final figure is decided in the talks.
  • The SME report: whether the Commission is asked to look at lighter GDPR duties for small, low-risk businesses.
  • The Digital Fairness Act: Brussels’ next consumer-protection proposal, separate from this package, which could bring new rules on online design.

FAQ: the Digital Omnibus and your business

Has the EU abolished cookie banners?

No. On 21 October 2026 EU governments agreed their position on rules that would let more cookies run without consent, such as for audience measurement and security. The European Parliament still has to agree, so current cookie rules apply.

What did the Council agree on 21 October 2026?

Its negotiating position on the Digital Omnibus: changes to the GDPR, the e-privacy cookie rules, incident reporting and the platform-to-business regulation. It keeps the current definition of personal data and backs a longer breach-reporting deadline.

Is the data breach deadline now 96 hours?

No. The Commission proposed 96 hours and only for breaches likely to be high-risk, and the Council backs a longer deadline. Until the law changes, you must report to your authority within 72 hours.

Does the Council change the definition of personal data?

No. The Council kept the current GDPR definition and added a provision on pseudonymisation. The Commission had proposed a narrower definition, which EU privacy regulators opposed.

When will the new rules apply?

There is no date. Parliament must adopt its position, then negotiate with the Council, and the law must be adopted and enter into force. Some parts, like the cookie rules, would apply later still.

What should a small business do now?

Keep complying with the current GDPR and your national cookie rules: a working Reject button, a 72-hour breach plan, a log of data requests and an up-to-date privacy notice. Check whether your analytics is first-party and used only by you.
2026-10-22 06:23 Startup News and Trends