Digital Omnibus — changes to GDPR, cookies and the Data Act (proposal)
The data part of the Digital Omnibus would amend GDPR (e.g. a clearer legitimate interest for AI training, a narrower definition of personal data), move cookie rules into GDPR and simplify the Data Act. It is still a proposal; in its October 2026 position the Council keeps today’s definition of personal data.
What it means for AI
Many articles already describe these changes as if they applied. They do not: the Council agreed its negotiating position only on 21 October 2026, the European Parliament has not yet adopted its own, and negotiations between them (trilogues) can start only after that. Until a final text is adopted and published, GDPR applies unchanged.
What you must do
- No duties yet. Follow the negotiations; do not rely on the proposed relief.
Examples
Only under the current GDPR test (necessity, balancing, opt-out) — the proposed clarification is not law.
Key dates
The Commission publishes the proposal.
Council working party discusses a new compromise text; no mandate yet.
The Council agrees its negotiating position (mandate); talks with the Parliament can start once the Parliament adopts its own.
General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 2 Nov 2026.