The Council of the European Union did not vote on the Digital Omnibus data and cookie proposal at its scheduled October 11, 2026, consideration, according to post-meeting reports from NEMO Europe and QUASA. The four-month wait before asking for cookie consent again therefore remains a reported draft proposal, not an adopted Council position. A separate amendment to the AI Act is already in force.
Two legislative tracks, two different statuses
The European Commission’s Digital Omnibus covers a proposed package of data and digital-rule changes alongside a separate amendment to the AI Act, as set out in the Commission’s overview. Their legal status is different:
| Legislative track | Subject | Status in October 2026 |
| Data and digital rules | Proposed changes involving the GDPR, ePrivacy and other EU rules, including cookie provisions | Still under negotiation; post-meeting reports said the Council did not vote on October 11 |
| AI Act amendment | Changes made by Regulation (EU) 2026/1744 | In force since July 27, 2026 |
What happened to the cookie proposal
Reports published after the scheduled October 11 Coreper consideration said the item was removed from the agenda without discussion or a vote. They reported no Council negotiating mandate. That leaves the proposal short of an agreed Council position; the existing rules were not changed by this missed consideration.
The Irish presidency’s October 2 draft was reported to propose a wait of at least four months after someone refused consent before a website could ask again. It also reportedly included a narrow exception for measuring contextual advertising, with pseudonymized data and restrictions on profiling and tracking across different websites or services. These are reported draft terms, not rules now in force. Coverage of the draft describes those provisions.
The AI amendment is already law
Regulation (EU) 2026/1744 entered into force on July 27, 2026. Its AI Act changes include specified restrictions on providers placing on the market or putting into service systems that generate or manipulate non-consensual intimate material or child sexual abuse material, and on deployers using systems for those purposes. The provisions have defined scope and exceptions; they do not amount to a general ban on image-generation tools. The regulation’s text sets the legal terms.
The regulation also sets different application dates for specified high-risk AI systems: December 2, 2027, for the Annex III category, and August 2, 2028, for the Annex I category. Those dates apply to the categories named in the regulation, not to every AI system.
