EU Digital Omnibus Stalls; Current GDPR Rules Still Apply

The Agence Europe account of the 11 October 2026 meeting says EU ambassadors did not discuss or vote on the Irish presidency’s Digital Omnibus compromise at Coreper II in Brussels. The Council therefore remains without a negotiating mandate for the proposal. Germany’s objections to its Data Act trade-secret provisions remain unresolved.

The setback followed an earlier postponement. The techUK account of the 7 October vote says Germany and France sought stronger trade-secret safeguards, preventing ambassadors from adopting a Council position then. For organizations serving people in the EU, the missed vote changes no live consent setting or personal-data obligation: the proposed GDPR, cookie and measurement amendments remain drafts.

Why the Council mandate is stuck

A connected product’s sensor and closed service access point represent the unresolved Data Act trade-secret sharing dispute.

The dispute concerns data generated by connected products and related services. The Data Act gives a product’s user a route to access data generated through its use or ask the data holder to share that data with a chosen third party. Such requests can involve commercially sensitive information, so the conditions for protecting trade secrets matter to manufacturers, service providers and those seeking access.

Germany wants sharing of trade-secret-protected data to depend on an explicit agreement between the data holder and the user seeking access. That demand goes beyond a minor wording change: it concerns when a holder can resist disclosure under rules designed to give users control over data they help generate. The Irish presidency may consult national delegations again, but the latest missed vote leaves the member states without a common position.

The privacy provisions are caught in the same legislative package. A Council mandate would authorize negotiations with the European Parliament over a Council position; it would not itself amend the GDPR, ePrivacy rules or Data Act. The distinction matters because a draft can describe a future exception in precise terms while conferring no present permission to change a production system.

Current obligations versus the proposed changes

The NEMO Europe status account describes a proposed four-month wait before asking again after certain cookie refusals and a proposed exemption for contextual-advertising measurement under defined conditions. It also reports that no new vote date had been set. Both measures remain negotiating text, so their possible effect belongs in planning rather than live configuration.

Consent and repeat prompts. Now: consent systems must follow the ePrivacy rules and national requirements applicable to the EU audience they serve, including how a refusal is respected. Draft: the compromise discusses a minimum interval before another request in specified circumstances. Do not shorten a consent platform’s existing re-prompt interval solely because the draft contains a different period.
Advertising measurement. Now: assess whether a method stores information on, or accesses information from, a user’s device and whether subsequent processing involves personal data. Draft: a limited exemption for measuring contextual advertising is under discussion. Do not make analytics, conversion tracking or advertising measurement generally consent-free by treating that proposed exception as enacted law.
Trade-secret sharing. Now: handle connected-product data requests under the Data Act’s existing access and confidentiality provisions. Draft: governments are debating stronger conditions for sharing data protected as a trade secret. Do not replace current request handling with Germany’s proposed requirement for an explicit agreement.

Keeping current consent rules does not mean requiring permission for every cookie. The EU’s online privacy guidance distinguishes cookies used solely to transmit a communication or provide a service explicitly requested by the user from tracking and behavioural-advertising uses that require prior consent. It also says users must receive clear information about cookies requiring consent and be able to withdraw that consent as easily as they gave it. The Omnibus postponement adds no new exception to those categories.

The trade-secret position has a similarly concrete baseline. The European Commission’s Data Act explainer says a data holder and user or third party may agree on confidentiality measures, and sharing may be withheld or suspended if those measures are not respected. A holder may refuse disclosure on trade-secret grounds only where it can demonstrate that serious economic damage is highly likely; the decision can be challenged. Those existing safeguards remain the operative framework while governments debate a different threshold.

What must happen before the rules change

EU Council and European Parliament buildings represent the legislative stages still ahead for the Digital Omnibus.

The next legislative step is for the Council to return to the file and agree on a negotiating mandate. That would settle the member states’ position for talks with the European Parliament, whose agreement on a final text would still be needed. Adoption and the legal start of any amendments would come later. A future Council vote should therefore be read as progress in negotiations, not as the date on which a proposed cookie setting becomes lawful.

Organizations can identify which consent prompts, measurement methods and connected-product data requests a later text might affect without changing how those systems operate today. This applies equally to UK-based services when they serve users in the EU: the relevant EU-facing activity must still be assessed against the rules currently applicable to it. The next Council decision will show whether governments have resolved the trade-secret dispute; until an amending law takes effect, existing GDPR, ePrivacy and Data Act requirements continue to govern those operations.