TL;DR
- Coreper agreed the Council's Digital Omnibus negotiating mandate on 21 October 2026; the Council published it as document ST 14756/26 on 22 October 2026.
- The rewritten ePrivacy Article 5(3) lists six consent-free purposes: transmission, requested service, first-party aggregated audience measurement, EMFA audience measurement, technical security, and contextual ad measurement.
- Users must be able to refuse with a single-click button, and after a refusal the provider may not re-ask for the same purpose for at least four months; the Commission's November 2025 text said six months.
- Member states would get 24 months after adoption to transpose; the European Parliament has no position yet, so nothing is law.
- RA's reading: Thai relevance is low; it affects Thai sites serving EU users or running EU-targeted campaigns.
The Council of the European Union published its negotiating mandate on the Digital Omnibus on 22 October 2026 (Council document ST 14756/26), one day after the Permanent Representatives Committee (Coreper) agreed the text on 21 October 2026. The mandate rewrites Article 5(3) of the ePrivacy Directive, the rule behind every EU cookie banner. It keeps consent as the default for storing or reading anything on a user's device, but lists six purposes that would no longer need consent, including first-party aggregated audience measurement and the measurement of contextual advertising under strict conditions. It also requires a single-click refusal and bans re-asking the same user for the same purpose for at least four months after a refusal. None of this is law yet: it is the Council's position for talks with the European Parliament, which has not adopted its own position.
What the Council agreed on 21 October 2026
Council document 14756/26, dated Brussels 22 October 2026 and filed under interinstitutional file 2025/0360 (COD), is an "Outcome of Proceedings" that carries "the text of the mandate for negotiations with the European Parliament" as "agreed by the Permanent Representatives Committee at its meeting on 21 October 2026". The Digital Omnibus itself is a wider proposal from the European Commission that amends the GDPR, the Data Act, the AI Act and several other acts at once. The cookie rules sit in Article 5 of the annex, which amends Directive 2002/58/EC, the ePrivacy Directive.
The Council's published mandate replaces the current Article 5(3) with a new paragraph. The opening sentence keeps the principle: storing information, or gaining access to information already stored, in a user's terminal equipment "is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679". That reference ties the consent standard for cookies to the GDPR definition (freely given, specific, informed, unambiguous).
The second sentence then opens the exceptions. Storing or accessing information without consent, "and subsequent processing of personal data for the same purpose, shall be lawful to the extent it is solely related to and strictly necessary for the following purposes". Six purposes follow, labelled (a) to (f).
The six consent-free purposes, quoted from the Council text
The table below lists the six purposes as they appear on page 157 of the Council document, with the condition that each one carries. The wording is the Council's, shortened only where noted.
| Purpose | Condition in the Council text |
|---|---|
| (a) "carrying out the transmission of an electronic communication over an electronic communications network" | No further condition. This is the existing communication exemption carried over. |
| (b) "providing a service, including its functionality, explicitly requested by the subscriber or user" | No further condition. This is the existing strictly-necessary exemption carried over. |
| (c) "Creating anonymous aggregated information about the usage of an online service to measure the audience of that service" | Must be done by the service provider or a third party on its behalf; the data "are not processed for another purpose, shared with third parties or combined with data from third parties". |
| (d) "performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083" | Personal data must be pseudonymised after collection, not processed for another purpose, no tracking "outside of the service or the media content to be measured", and anything shared with outside third parties must not contain personal data. |
| (e) "maintaining or restoring the technical security" of the service or of the terminal equipment used for it | Limited to means "strictly necessary" for providing a service the user requested. |
| (f) "measuring the display and performance of advertising that is based solely on the immediate content displayed" during "an individual visit or on the basis of a single search query" | Must not involve processing of personal data, profiling, or data on "past or future activity, including activity across sites or services"; done by or on behalf of the provider; data pseudonymised after collection and not reused. |
Purpose (c): first-party analytics without a banner
Purpose (c) is the one that touches web analytics most directly. It covers anonymous aggregated audience measurement of a single online service, done by the provider of that service or by a third party acting on its behalf. The condition is tight: the information stored or accessed, and the data collected to aggregate it, must not be processed for another purpose, shared with third parties, or combined with third-party data. A standard analytics tag that feeds the same identifiers into an advertising platform, builds remarketing audiences, or links sessions across unrelated sites would not sit inside purpose (c). A self-contained, aggregated first-party audience count would. The text does not name any product, so it does not say whether any specific analytics tool, in any specific configuration, qualifies.
Purpose (f) and recital 44g: contextual advertising measurement
Purpose (f) is new ground. It allows contextual advertising measurement without consent, defined as measuring "the display and performance of advertising that is based solely on the immediate content displayed on a subscriber or user's online interface during an individual visit or on the basis of a single search query". Recital 44g of the same document explains the reasoning: contextual advertising "is placed solely on the basis of the immediate content displayed" and "does not involve the processing of personal data", but "the effectiveness of such advertising often relies on the possibility to measure the display and the performance of the advertisement displayed such as capping cookies and advertising measurement cookies". The recital says such measurement "should be lawful without the consent of the user" when carried out by or on behalf of the provider, with data "pseudonymised after collection, as a key security measure, and are not processed for another purpose including profiling or providing programmatic advertising".
Read together, Article 5(3)(f) and recital 44g draw a line between contextual ads (allowed to be measured without consent, including frequency capping) and behavioural or programmatic advertising (still gated by consent). Anything that depends on a profile, on cross-site activity, or on what the user did before or after the visit stays on the consent side of that line.
Single-click refusal and the four-month cookie re-ask period
After the list of purposes, the Council text adds three sentences on how consent must be requested. First, the user "shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means". Second, if the user gives consent, "the provider shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent". Third, and this is the sentence that will shape banner design, "If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least four months."
The four-month cookie re-ask period is shorter than the Commission asked for. The Commission's November 2025 proposal (Commission document 15698/25) placed the cookie rules in a new GDPR Article 88a, and that struck-through text in the Council document still shows the original wording: "if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months". The Council also chose to keep the rule inside the ePrivacy Directive rather than move it into the GDPR, which is why the amendment appears as a replacement of Article 5(3) instead of a new GDPR article.
The three headline differences between the Commission's text and the Council's text, as they can be read from the marked-up document, are these.
| Element | Commission proposal (November 2025) | Council mandate (21 October 2026) |
|---|---|---|
| Where the cookie rule lives | New GDPR Article 88a | Rewritten ePrivacy Article 5(3) |
| Waiting period after a refusal | "at least six months" | "at least four months" |
| Supervision of the rule | Under the GDPR framework | Member States designate the GDPR supervisory authority for Article 5(3), via a new Article 15a(5) |
Timeline: 24 months to transpose, 12 months for a Commission report
Because the Council keeps the rule in a directive, member states would have to transpose it. A new Article 17(3) of the ePrivacy Directive says member states "shall adopt and publish, by [24 months after the adoption of this Regulation] the laws, regulations and administrative provisions necessary to comply with Article 5(3)" and "should apply those measures from" the same 24-month point. A new Article 18 paragraph asks the Commission to report "no later than [12 months after the adoption of this Regulation]" on privacy-enhancing technologies for storing or accessing information on devices, with proposals to update the rules if appropriate.
The square brackets are deliberate. The dates run from adoption of the final regulation, and adoption cannot happen until the European Parliament agrees a position, trilogue negotiations between the Council, the Parliament and the Commission conclude, and both co-legislators vote the result. The Council document gives no target date for any of those steps. Cookie banners in the EU would therefore not change under this text until at least two years after an adoption that has not been scheduled.
What the Council text does not say
- It does not name any analytics product, tag manager, consent platform or browser, so it does not confirm that any specific tool is covered by purpose (c) or (f).
- It does not define "single-click button or equivalent means" beyond those words, and it does not say whether a "reject all" link below an "accept all" button counts.
- It does not say how the four-month refusal memory should be stored. Remembering a refusal would itself involve storing information on the device, and the text does not state which purpose covers that.
- It does not set a date. All timings run from an adoption that has not been scheduled.
- It does not reflect the European Parliament's view. The Parliament has not adopted a negotiating position, and the Council text can change in trilogue.
- The Parliament's Legislative Observatory lists procedure 2025/0360(COD) as "Awaiting committee decision".
What this means for Thai marketers
For most businesses in Thailand, the honest answer is: nothing changes today, and the direct effect, if the text survives trilogue, is limited to two groups. The first is any Thai site or app that serves users in the EU, whether a hotel taking European bookings, an exporter with EU buyers, or a SaaS product with EU customers. The second is any Thai business running EU-targeted campaigns through a consent management platform or a tag setup built around EU rules, because those vendors will redesign their banners and consent signals around whatever the final text says.
The indirect effect is a signal about direction. The Council's draft separates aggregated first-party measurement and contextual ad measurement, which it treats as low risk, from behavioural tracking, which it keeps behind consent. If that holds, the practical lesson for any GA4 setup is: separate the configuration that only counts audience from the configuration that feeds advertising, so that each can be switched on under its own legal basis.
None of this is a reason to change a Thai consent banner now. It is a reason to keep analytics and advertising tags separable, and to watch the Parliament's position when it comes.
FAQ
Is the four-month cookie rule already law in the EU?
No. The Council's mandate of 21 October 2026 is a negotiating position for talks with the European Parliament, and the Parliament has not adopted its own position, so no trilogue has started and nothing has been adopted. Even after adoption, member states would have 24 months to transpose the ePrivacy change.
Which analytics would not need a cookie banner under the Council text?
Only anonymous, aggregated audience measurement of a single service, carried out by that service's provider or by a third party acting on its behalf, where the data are not reused, shared with third parties, or combined with third-party data (purpose (c)). Audience measurement under Article 24 of the European Media Freedom Act is covered separately (purpose (d)). The text does not name any product.
Does the Council text let advertisers measure ads without consent?
Only contextual advertising, meaning ads placed solely on the content of the current page or a single search query, and only measurement that involves no personal data, no profiling and no cross-site or past-activity data, with data pseudonymised after collection (purpose (f)). Recital 44g names "capping cookies and advertising measurement cookies" as the kind of measurement intended. Behavioural and programmatic advertising measurement still needs consent.
How is this different from what the European Commission proposed?
The Commission's November 2025 proposal moved the cookie rules into a new GDPR Article 88a and set a waiting period of "at least six months" after a refusal; the Council keeps the rules in ePrivacy Article 5(3) and cuts the waiting period to "at least four months". The Council also assigns supervision to the GDPR authority in each member state.
Does a Thai website need to do anything now?
No. The text applies only to users in the EU, is not adopted, and would take at least two years after adoption to apply. The useful preparation is structural: keep audience measurement and advertising tags configurable separately so that a later change in either jurisdiction can be applied without rebuilding the setup.
If your analytics setup mixes measurement and advertising signals in one tag and you want it untangled before either regulator asks, our GA4 migration and measurement service covers consent-aware configuration for Thai and international traffic.
