Digital Omnibus — changes to GDPR, cookies and the Data Act (proposal)
The data part of the Digital Omnibus would amend GDPR (e.g. a clearer legitimate interest for AI training, a narrower definition of personal data), move cookie rules into GDPR and simplify the Data Act. It is still a proposal.
What it means for AI
Many articles already describe these changes as if they applied. They do not: as of September 2026 the Parliament and the Council are still negotiating (the Council has no negotiating mandate yet). Until then, GDPR applies unchanged.
What you must do
- No duties yet. Follow the negotiations; do not rely on the proposed relief.
Examples
Only under the current GDPR test (necessity, balancing, opt-out) — the proposed clarification is not law.
Key dates
The Commission publishes the proposal.
Council working party discusses a new compromise text; no mandate yet.
General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 29 Sep 2026.