Start free
Menu
FeaturesPricingPrivacyInstallDocsSupportDashboardLog in

The Digital Omnibus and web analytics: what changes

What the Digital Omnibus is

The Digital Omnibus is a proposal the European Commission made on 19 November 2025 (COM(2025) 837) to simplify several EU digital laws at once, among them the GDPR, the ePrivacy Directive, the Data Act and the rules on reporting cyber incidents.

For cookies and similar techniques the Commission would move the consent rule out of article 5(3) of the ePrivacy Directive into a new article 88a of the GDPR.

The EU governments, in the Council's mandate of 21 October 2026, keep the rule in article 5(3) and rewrite it there instead.

Both texts list purposes that need no consent. The Commission names four: carrying a communication, a service the visitor asked for, aggregated audience measurement by the provider for its own use, and security. The Council names six: it adds audience measurement of media under the European Media Freedom Act and the measurement of contextual advertising, and lets a third party measure on the provider's behalf.

After a visitor refuses, a site may not ask again for the same purpose for six months (Commission) or at least four months (Council), and refusing must take a single click.

What changes for analytics

Both texts exempt creating aggregated information about the usage of an online service to measure its audience. The Council's text says anonymous aggregated information, made by the provider of the service or by a third party on its behalf, and only when the data is not processed for another purpose, not shared with third parties and not combined with data from third parties. The EU's data protection authorities read aggregated as insight into the performance and use of the service in a general manner, not relating to a specific person.

What falls under it

  • Counting visits, pages, countries, sources and devices of your own site, as totals
  • Measurement by a tool that works for you and keeps the data for your site only
  • Reports that contain no personal data

What does not

  • Profiles of individual visitors, or recognising a person over months
  • Tracking across sites, or combining your data with data from other sites or from a third party
  • Using the data for advertising or any other purpose
  • Session recordings and heatmaps of one visitor's behaviour: they are not aggregated information

Who would qualify, and who would not

Read against the Council's text of 21 October 2026, which is the latest stand. Each row names its source.

ToolNeeds no consent?Why
Nvivio, privacy modeYesNo cookie, nothing on the device, the IP address never stored, a visitor code that changes every day, reports as totals, no profiles. (nvivio.com)
Nvivio, cookie modeNoPlaces one first-party cookie to recognise a visitor over months. That needs consent, and Nvivio says so. (nvivio.com)
Google Analytics 4, as it shipsUnlikelySets the cookies _ga and _ga_<id> for two years to tell users apart, so the information is not aggregated only; commentators read the exemption as too narrow for analytics tools that work across services. (support.google.com)
Google Analytics 4 with consent modeNoConsent mode adapts Google's tags to the consent a visitor gave. It is consent, not an exemption from it. (developers.google.com)
Matomo, Plausible or Fathom without cookiesYesLike Nvivio in privacy mode: no cookies and no persistent identifier, when set up that way. (plausible.io)
Heatmaps and session recordingsNoThey record what one visitor did. That is not aggregated information about the usage of the service. (edpb.europa.eu)

Timeline

  1. 19 November 2025Commission proposal
  2. 10 February 2026Opinion of the EDPB and the EDPS
  3. 21 October 2026Council mandate
  4. pendingParliament position
  5. pendingTrilogue
  6. pendingAdopted and published
  7. pendingIn force, written into national law

What to do today

If you run a website

  1. Check in which mode you measure, and whether your tool stores anything on the visitor's device.
  2. Say in your privacy notice what you measure and why: the GDPR applies whatever happens to the cookie rule.
  3. Until a change is adopted and written into national law, follow today's rules of the countries your visitors live in.

If you build sites for clients

  1. Make an inventory per client: which tools store an identifier, and which produce totals only.
  2. Prefer measurement that produces aggregated information only; it is exempt in every version of the text.
  3. Note the status date on this page and look again after the Parliament has taken its position.

Belgium and the national rules

Belgium has no exemption for audience measurement today: every storing of or access to information on the device needs consent there. The Omnibus, as the Council wrote it, would give every member state the same list of purposes, written into national law within 24 months after adoption. The rules per country today

Frequently asked questions

Is the Digital Omnibus already law?

No. The Commission proposed it in November 2025 and the Council agreed its position in October 2026; the European Parliament has not taken its position yet, after which the three negotiate. Entry into force is not expected before 2027, and the cookie rule would then still have to be written into national law.

Can my cookie banner go?

Not yet. Once the change is in force, a banner is no longer needed for aggregated audience measurement; it stays needed for everything else that stores or reads information on the device without an exemption, such as advertising.

Does it apply to Google Analytics 4?

As it ships, most likely not: it sets cookies that tell users apart for two years, and the exemption is written for aggregated information only. Google could change how it works; this page follows the texts, not the products.

What about consent mode v2?

Consent mode makes Google's tags behave according to the consent a visitor gave. It is a way to collect consent, so it does not take a site out of the consent rule.

What does aggregated mean?

Information about the use of the service as a whole, such as how many people visited which pages from which countries, that does not relate to a specific person. The EU's data protection authorities read it as anonymous aggregated information, not combined with data from other services and not shared further.

Does anything change for Nvivio users?

No. In privacy mode Nvivio stores nothing on the device, never stores the IP address and produces totals; that is what the exemption describes. In cookie mode consent stays needed, as it is today.

What if the trilogue drops the exemption?

Then today's rules stay: consent where a country asks for it, and the national exemptions for privacy-friendly measurement that several countries already have. Nvivio in privacy mode needs no banner under those either.

Where do I read the source texts?

The sources at the bottom of this page link to the Commission's proposal, the Council's mandate and the opinion of the EDPB and the EDPS, each with the day it was published and the day we checked it.

Sources

Changes to this page

  • 4 November 2026: First version, with the Council's mandate of 21 October 2026.

This page explains the proposal; it is not legal advice.

Related pages