Cookie consent explained: it’s about tracking, not cookies

Do I need a cookie banner?

The rule comes from Article 5(3) of the ePrivacy Directive. It covers “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user”. A cookie is one way to do that. Local storage, a tracking pixel and a script that reads your screen size are others.

It applies whether or not the information is personal data. The European Data Protection Board, where the EU’s data protection regulators meet, says so in its Guidelines 2/2023 (para 10), quoting the EU Court of Justice in Planet49.

The directive has only two exceptions: storage or access that is needed to carry a communication over the network, and what is strictly necessary to provide a service the visitor explicitly asked for, such as keeping a visitor signed in. Everything else needs the visitor’s consent first. Each EU country writes the rule into its own law. In the Netherlands it’s article 11.7a of the Telecommunicatiewet.

The GDPR is a different law, and the two are often mixed up. The ePrivacy rule decides when you need consent to store or read something on the device. The GDPR applies on top of it whenever you process personal data, and it sets what valid consent looks like: freely given, specific, informed and unambiguous (Article 4(11)). So “cookies need a banner” is both too broad and too narrow. The real questions are what your site stores or reads on the device, and why.

Do I need a cookie policy on my website?

Article 5(3) of the ePrivacy Directive allows storage or access with consent only once the visitor has been “provided with clear and comprehensive information … inter alia, about the purposes of the processing”. It doesn’t say where that information goes or what it is called. The directive that added the words, Directive 2009/136/EC, only asks that “the methods of providing information and offering the right to refuse should be as user-friendly as possible” (Recital 66). National law says the same: the Dutch article 11.7a of the Telecommunicatiewet asks for “duidelijke en volledige informatie”, and the UK’s PECR, Schedule A1 for “clear and comprehensive information about the purpose of the storage or access” (para 2).

How much is enough? The EU Court of Justice said in Planet49 that the information must be “sufficiently detailed so as to enable the user to comprehend the functioning of the cookies employed” (para 74), and that it includes “the duration of the operation of cookies and whether or not third parties may have access to those cookies”. The UK’s Information Commissioner’s Office lists the same points: the technologies you use, their purposes, any third parties, and how long the information is stored. It adds that vague references to “partners” or “third parties” aren’t enough.

When the cookies involve personal data, the GDPR adds its own list (Article 13): who you are and how to reach you, the purposes and the legal basis, who receives the data, how long you keep it, and the visitor’s rights, including the right to complain to a regulator. The GDPR names cookie identifiers among the online identifiers that can be used to profile and identify people (Recital 30), so a cookie is often personal data, and then that list applies too.

Where the information goes

Regulators describe layers. The Article 29 Working Party’s guidelines on transparency, which the EDPB endorsed in 2018, recommend layered privacy notices for websites, with “the entirety of the information” also available “in one single place or one complete document” (para 17). They add that every website should publish a privacy statement with a direct link to it “clearly visible on each page” (para 11). The EDPB’s Guidelines 05/2020 on consent call layered information “an appropriate way” to be both complete and understandable (para 69).

France’s CNIL wants the purposes in the banner itself, with a fuller description one click away, and the list of companies responsible for the cookies reachable at any time, for example from a link at the top or bottom of the page (recommendation, §2.1 and §2.2). In its guidelines it adds that a mere reference to your terms of use isn’t enough (para 23). The ICO leaves the format to you, “whether it is appropriate to use layers or panels”.

So the banner carries the key facts, and the rest lives on a page it links to. Whether that page is a separate cookie statement or a cookie section in your privacy statement is your choice.

Does the Meta Pixel need cookie consent?

The European Data Protection Board explains this in its Guidelines 2/2023 on the reach of the ePrivacy rule. A tracking pixel is “a hyperlink to a resource, usually an image file” that “usually fulfils no purpose related to the requested content itself” (para 47). Sending it to the browser “does constitute storage, at the very least through the caching mechanism”, so the rule applies “even if this storage is not permanent” (para 50). And adding tracking information to URLs or pixels “constitutes an instruction to the terminal equipment to send back the targeted information” (para 51).

The Meta Pixel is a script plus an image pixel. Loading it stores something on the device, and its script sends identifiers, the page address and device details back to Meta. Reading details such as the browser and the screen to recognise a visitor is fingerprinting, which the same guidelines also bring under the rule (para 43). So turning off the pixel’s first-party cookie doesn’t change the answer.

Nor does an exemption fit. Advertising and retargeting are neither needed to carry the communication nor strictly necessary for a service the visitor asked for. So you need consent before the pixel loads.

Regulators have acted on the Meta Pixel, though under the GDPR rather than the cookie rule. Those cases show what else goes wrong when a pixel runs on sensitive pages:

• On 10 June 2025, Norway’s Datatilsynet issued four decisions under the GDPR, on the lawfulness of the processing and on telling visitors about it. It fined Kristiansand kommune NOK 250,000 for the Meta Pixel and Snap Pixel on 116111.no, a helpline for children and young people. It reprimanded Apotek For Deg, which ran the pixel on pages for pregnancy tests and emergency contraception, Norsk Helseinformatikk and Kirkens Bymisjon. The Norwegian cookie rule was enforced by another regulator when the sites were inspected, so the decisions didn’t assess it.
• On 29 August 2024, Sweden’s IMY fined the pharmacies Apoteket SEK 37 million and Apohem SEK 8 million under the GDPR’s security rules. A Meta Pixel feature had sent details of customers’ purchases, including health-related ones, to Meta.

Do analytics need cookie consent?

Analytics aren’t strictly necessary to give visitors the page they asked for, so the two exceptions in the ePrivacy Directive don’t cover them. Whether you can skip consent depends on the country’s own law and its regulator:

• The Netherlands exempts measuring the quality or effectiveness of your site, “mits dit geen of geringe gevolgen heeft voor de persoonlijke levenssfeer”: provided it has no or only minor consequences for the visitor’s privacy (Telecommunicatiewet, article 11.7a(3)(b)). The Dutch regulator, the Autoriteit Persoonsgegevens, names Matomo, Apache Superset, Plausible Analytics and OpenPanel as tools that need no banner if they’re set up properly.
• France, Spain and Italy have no exemption in statute, but their regulators accept audience measurement without consent under strict conditions. The CNIL and the AEPD ask that it serves only the site owner, produces only anonymous statistics, and isn’t combined with other data, passed to third parties or used to follow visitors across sites. The Garante asks for aggregated statistics for one site, with no combining or passing on by the provider, and as a rule masks part of the IP address.
• Germany, Belgium, Ireland and Denmark have no analytics exemption. § 25 TDDDG has only the two exceptions of the directive. Belgium’s Gegevensbeschermingsautoriteit says there is none, “zelfs niet als het gaat om ‘eerstepartij’ cookies” (not even for first-party cookies). Ireland’s Data Protection Commission says analytics cookies need consent, though first-party analytics are unlikely to be an enforcement priority. Denmark’s Datatilsynet says visitor statistics need consent.
• The UK added an exemption for statistics to PECR, Schedule A1, in force since 5 February 2026. It covers collecting statistics on how your site is used in order to improve it, with clear information and a simple, free way for visitors to object. Without that way to object, the ICO says the exemption doesn’t apply.

So the Dutch rule doesn’t travel. Which country’s law applies to your site is its own question. Germany’s law, for one, also covers providers established elsewhere who provide services in Germany (§ 1(3) TDDDG), and it has no exemption at all.

A worked example: this site

fleetorix.com runs Ahrefs Web Analytics on every page and shows no cookie banner. Ahrefs sets no cookies and stores nothing on the device, but that alone isn’t the test: its script (https://analytics.ahrefs.com/analytics.js) reads the screen size, the pixel ratio and the browser’s languages and sends them to Ahrefs. Under the EDPB’s guidelines (para 33), that is gaining access to information on the device.

What makes it exempt is the Dutch rule. Fleetorix is established in the Netherlands, and Ahrefs counts visitors with a hash whose salt is deleted every 24 hours, so a visitor’s days and sites can’t be linked. We consider that to have no or only minor consequences for privacy. The same set-up would likely fail the Spanish, Italian and UK tests, because Ahrefs reuses aggregated data for its own service and offers visitors no way to object.

Exempt isn’t silent: we still list Ahrefs and what it reads in our cookie statement (in Dutch), with the full reasoning.

Do strictly necessary cookies need consent?

The ePrivacy Directive exempts storage or access that is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service” (Article 5(3)). The test is the visitor’s request, not your business: a cookie that keeps someone signed in serves what they asked for, an analytics or advertising cookie doesn’t.

The EU’s data protection regulators, then meeting as the Article 29 Working Party, gave examples in Opinion 04/2012: cookies that authenticate a signed-in user, and security cookies that protect the login system from abuse. The same opinion draws one line people often miss: a persistent “keep me signed in” cookie that lasts across browser sessions isn’t exempt, and it suggests a “remember me” checkbox to get consent for it. The Dutch regulators, the Autoriteit Persoonsgegevens and the ACM, say cookies that remember login details are functional and need no consent, without drawing that line. In the Netherlands the exemption is in article 11.7a(3) of the Telecommunicatiewet.

Be ready to explain why each cookie you call necessary really is. The EDPB’s Cookie Banner Taskforce says site owners must be able to show regulators the “essentiality” of the cookies they list as essential (para 28).

Exempt isn’t silent

The exemption lifts more than consent. The directive that wrote it into Article 5(3), Directive 2009/136/EC, calls it one of the “exceptions to the obligation to provide information and offer the right to refuse” (Recital 66). National law reads the same way. The Dutch exemption switches off the whole rule, the duty to inform included. France’s CNIL notes that French law “n’impose pas d’informer” visitors about cookies that need no consent: doesn’t require telling them. And the UK’s exemption in PECR, Schedule A1 (para 4) has no information condition, unlike the consent rule beside it.

Regulators still tell you to inform. The CNIL recommends mentioning exempt cookies and their purposes, for example in your privacy policy, “afin d’assurer une transparence pleine et entière”: to be fully transparent.

And when a cookie holds or leads to personal data, such as a session that knows who is signed in, the GDPR applies on top, and it has no such exemption. Article 13 requires you to tell people, when you collect their data, who you are, why you process it and on what legal basis, who receives it, how long you keep it, and whether it leaves the EU. The UK’s Information Commissioner’s Office says so in terms: these transparency requirements apply “even if you are making use of a PECR exception”, naming the “strictly necessary” one. Only a cookie that holds no personal data is outside both duties. The CNIL’s example is a cookie that stores nothing but the visitor’s preferred language. A cookie statement and a privacy statement that list your strictly necessary cookies cover both.

How often do you have to ask for cookie consent again?

Neither the GDPR nor the ePrivacy Directive says how long consent lasts. The EDPB’s Guidelines 05/2020 on consent say “There is no specific time limit in the GDPR for how long consent will last” (para 110) and recommend, as best practice, that consent “should be refreshed at appropriate intervals” (para 111). The Dutch Autoriteit Persoonsgegevens sets no interval either.

Some national regulators do name a number, as advice:

• 6 months. France’s CNIL calls keeping a choice, consent and refusal alike, for 6 months good practice, judged case by case. Ireland’s Data Protection Commission says to ask visitors to reaffirm their consent no later than six months after you stored it. Belgium’s Gegevensbeschermingsautoriteit calls 6 months reasonable in principle for the cookie that remembers the choice. The UK’s ICO recommends six months as a general guideline.
• Once a year. Denmark’s Datatilsynet says renewing consent once a year will often be appropriate, and that asking visitors who said no again once a year is most appropriate too.
• At most 24 months. Spain’s AEPD calls it good practice for a consent to last no longer than 24 months, without asking again on every visit in the meantime.

After a visitor says no

Asking again straight away wears visitors down until they give in. Italy’s Garante says not to show the banner again to someone who refused until at least 6 months have passed, unless the conditions of the processing change significantly. The ICO says to ask someone who declined again only after a reasonable amount of time, with six months as its general guideline. Both, and the Danish guidance, expect you to ask again sooner when what you do changes, for example when you add new kinds of cookies or new third parties. The EU’s Digital Omnibus, a proposal and not law on 18 October 2026, would make it a rule: no new request for consent for the same purpose for at least six months after a visitor declines, a line the Council’s latest draft of 3 September 2026 keeps.

Where “13 months” comes from

The 13 months that many banners use isn’t a rule about consent. The CNIL and the AEPD recommend that the trackers of analytics that are exempt from consent live only as long as is needed to compare audiences over time, with thirteen months as their example, not extended on later visits, and that the data they collect is kept for at most 25 months. It says nothing about how often to ask for consent. Nor does the AP’s remark that a retention period of “six months or more will often be too long”: that is about how long a tracking cookie lives on the device, not about the stored choice.

How long should you keep consent records?

Article 7(1) of the GDPR says that where processing is based on consent, “the controller shall be able to demonstrate that the data subject has consented”. It doesn’t say for how long. The EDPB fills in the shape, not the number, in its Guidelines 05/2020 on consent (para 107): the duty to demonstrate lasts as long as the processing does, and after that the proof should be kept no longer than strictly necessary to meet a legal obligation or to establish, exercise or defend legal claims. No regulator we checked, in the EU or the UK, gives a number of months or years.

So the question becomes: for how long could someone still hold a consent against you? In the Netherlands, two periods answer it. The power to impose an administrative fine of more than EUR 340 lapses five years after the violation (Awb articles 5:45 and 5:53). A claim for damages lapses five years after the injured person learns of the damage and who is liable (BW article 3:310). Five years covers both. It’s an inference from those statutes, not a figure a regulator has endorsed.

Shorter periods leave gaps. The Autoriteit Persoonsgegevens decided its first cookie fine, against the company behind Kruidvat.nl, on 2 May 2024, for tracking cookies set without valid consent between April and October 2020 (AP decision). A log kept for 12 or 24 months would have been gone long before then.

Keep the right things, too. The EDPB expects information on the session in which consent was given, the consent workflow at the time, and a copy of what the visitor was shown. It adds that “it would not be sufficient to merely refer to a correct configuration of the respective website” (para 108).

Must Reject be as easy as Accept, and are cookie walls allowed?

Both rules follow from what consent is. Under the GDPR it must be “freely given, specific, informed and unambiguous” (Article 4(11)). Article 7 adds that you must be able to show a visitor consented, and that, when judging whether consent was freely given, it matters whether a service was made conditional on consent it doesn’t need (Article 7(4)).

A banner that makes saying yes easy and saying no hard pushes visitors towards yes. The EDPB’s Cookie Banner Taskforce, where the EU’s regulators compared their views on real banners, reported in January 2023 that most of them consider a banner non-compliant when a layer with an Accept button has no way to refuse (paras 6 to 8). The Dutch regulator, the Autoriteit Persoonsgegevens (AP), spells it out in its rules for clear cookie banners: put Accept and Reject on the same, first layer, don’t make refusing take more clicks than accepting, and don’t hide Reject or make it harder to see, for example as a faint text link or below the fold.

A cookie wall leaves visitors a take-it-or-leave-it choice: agree to tracking, or don’t see the site. The AP says cookie walls aren’t allowed under the GDPR, because a visitor who can’t refuse without losing access hasn’t consented freely. The EDPB reaches the same conclusion in its Guidelines 05/2020 on consent: access to a service must not depend on agreeing to the storing of information on the device, and consent given that way isn’t valid (paras 39 to 41).

How do visitors withdraw their cookie consent?

The rule is Article 7(3) of the GDPR. Visitors can withdraw their consent at any time, and they must be told so before they give it. Then: “It shall be as easy to withdraw as to give consent.” Withdrawing doesn’t make what happened before it unlawful, but from then on whatever needed consent has to stop.

The European Data Protection Board reads this literally in its Guidelines 05/2020 on consent: “when consent is obtained via electronic means through only one mouse-click, swipe, or keystroke, data subjects must, in practice, be able to withdraw that consent equally as easily” (para 114).

So when saying yes took one click on the banner, an email address to write to, or a cookie statement that explains how to clear cookies in each browser, falls short of that. Visitors need a way back to the same choice, where they can change it.

Does Google Consent Mode v2 replace a cookie banner?

Consent Mode is a set of signals, such as ad_storage and analytics_storage, that your site sets to “granted” or “denied”. Google’s tags read them and change what they store and send. Version 2 added two more, ad_user_data and ad_personalization, for sending personal data to Google for advertising and for personalised ads.

The signals only pass on a decision. Something else has to ask the visitor, and that is the job of the banner. Google says so itself. For sites that use its advertising and measurement tags with visitors in the EEA, Google Ads Help says “you must collect consent for use of personal data from end users based in the EEA and share consent signals with Google”. Google’s EU user consent policy, which covers visitors in the EEA, the UK and Switzerland, asks for legally valid consent to cookies or other local storage where the law requires it and to personalised ads, for records of that consent, and for clear instructions on withdrawing it.

Google offers two ways to set it up. In basic mode, Google’s tags don’t load until the visitor has made a choice on the banner, so nothing reaches Google before then. In advanced mode, the tags load straight away and, “while consent is denied, the Google tags send measurements without cookies”. Whether those measurements are allowed before consent is a question for the device rule, not for a Google setting.

What will the EU Digital Omnibus change for cookie consent?

Status on 18 October 2026: a proposal, not law. The rules on this page are the ones in force. The ePrivacy Regulation that was meant to replace the ePrivacy Directive was withdrawn in 2025, and the Omnibus is the current attempt to change the cookie rules.

The Commission’s proposal (COM(2025) 837, 19 November 2025) would move the cookie rules into the GDPR, as a new Article 88a. Among other things it would:

• require that visitors can refuse with a single click;
• forbid a new request for consent for the same purpose for at least six months after a visitor declines (Article 88a(4)(c));
• let a site measure its own audience without consent, by creating aggregated information about the use of the site, solely for its own use (Article 88a(3)(c));
• and, in a new Article 88b, make sites accept consent and refusal sent automatically, for example by the browser.

The Council, where the member states negotiate, has changed course since. A Presidency compromise of 4 June 2026 keeps the cookie rules in the ePrivacy Directive instead of moving them into the GDPR, and a week later the Presidency dropped the article on automatic browser signals. The latest Council text found, the compromise of 3 September 2026, still says that if a user refuses, “the provider shall not make a new request for consent for the same purpose for a period of at least six months”, and lists purposes that need no consent, audience measurement among them.

In the European Parliament, the responsible committees had a draft report of 22 June 2026 but hadn’t voted on it. The EDPB and the European Data Protection Supervisor, in their joint opinion of February 2026, asked the lawmakers to also set a maximum period for which consent stays valid, possibly the same six months. Neither text does that so far.

If the six-month rule is adopted as drafted, a banner that asks visitors who refused again only after 12 months would already meet it. Until then, the rules and guidance described above are the ones that apply.

Sources

1. Directive 2002/58/EC (ePrivacy Directive), consolidated text of 19 December 2009. EUR-Lex. Checked on 26 September 2026.
2. Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0. European Data Protection Board. Checked on 18 October 2026.
3. Telecommunicatiewet, article 11.7a. wetten.overheid.nl. Checked on 26 September 2026.
4. Regulation (EU) 2016/679 (General Data Protection Regulation). EUR-Lex. Checked on 26 September 2026.
5. Directive 2009/136/EC amending Directive 2002/58/EC, Recital 66. EUR-Lex. Checked on 21 October 2026.
6. The Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1. legislation.gov.uk. Checked on 18 October 2026.
7. Judgment of the Court (Grand Chamber) of 1 October 2019, Planet49, C-673/17. Court of Justice of the European Union (EUR-Lex). Checked on 21 October 2026.
8. Guidance on the use of storage and access technologies: How do we comply with the PECR rules?. Information Commissioner’s Office. Checked on 21 October 2026.
9. Guidelines on transparency under Regulation 2016/679 (WP260 rev.01). Article 29 Data Protection Working Party. Checked on 21 October 2026.
10. Endorsement 1/2018 of the WP29 documents. European Data Protection Board. Checked on 21 October 2026.
11. Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1. European Data Protection Board. Checked on 18 September 2026.
12. Recommandation « cookies et autres traceurs », version consolidée. CNIL. Checked on 18 October 2026.
13. Lignes directrices relatives à l’application de l’article 82 de la loi du 6 janvier 1978 aux opérations de lecture et écriture (délibération 2020-091). CNIL. Checked on 21 October 2026.
14. Guidance on the use of storage and access technologies: How do we manage consent in practice?. Information Commissioner’s Office. Checked on 18 October 2026.
15. Vedtak om overtredelsesgebyr – tilsyn med sporingsverktøy – Alarmtelefonen 116111.no. Datatilsynet (Norway). Checked on 18 October 2026.
16. Vedtak om irettesettelse – tilsyn med sporingsverktøy – Apotekfordeg AS. Datatilsynet (Norway). Checked on 18 October 2026.
17. Vedtak om irettesettelse – tilsyn med sporingsverktøy – Norsk Helseinformatikk AS. Datatilsynet (Norway). Checked on 18 October 2026.
18. Vedtak om irettesettelse – tilsyn med sporingsverktøy – Kirkens Bymisjon. Datatilsynet (Norway). Checked on 18 October 2026.
19. Sanktionsavgifter mot Apoteket och Apohem för överföring av personuppgifter till Meta. Integritetsskyddsmyndigheten (IMY). Checked on 18 October 2026.
20. Cookies en uw organisatie: zorg voor een goed beleid. Autoriteit Persoonsgegevens. Checked on 26 September 2026.
21. Cookies : solutions pour les outils de mesure d’audience. CNIL. Checked on 18 October 2026.
22. Guía sobre el uso de cookies para herramientas de medición de audiencia. Agencia Española de Protección de Datos. Checked on 18 October 2026.
23. Linee guida cookie e altri strumenti di tracciamento. Garante per la protezione dei dati personali. Checked on 18 October 2026.
24. § 25 TDDDG. Bundesministerium der Justiz (gesetze-im-internet.de). Checked on 18 October 2026.
25. Cookies. Gegevensbeschermingsautoriteit. Checked on 18 October 2026.
26. Guidance note on cookies and other tracking technologies. Data Protection Commission. Checked on 18 October 2026.
27. Brug af cookies og lignende teknologier. Datatilsynet and Digitaliseringsstyrelsen. Checked on 18 October 2026.
28. SI 2026/82, regulation 2: commencement of the Data (Use and Access) Act 2025, section 112 and Schedule 12. legislation.gov.uk. Checked on 18 October 2026.
29. Guidance on the use of storage and access technologies: What are the exceptions?. Information Commissioner’s Office. Checked on 18 October 2026.
30. § 1 TDDDG. Bundesministerium der Justiz (gesetze-im-internet.de). Checked on 18 October 2026.
31. About Ahrefs Web Analytics. Ahrefs. Checked on 26 September 2026.
32. Opinion 04/2012 on Cookie Consent Exemption (WP194). Article 29 Data Protection Working Party. Checked on 26 September 2026.
33. Cookies. Autoriteit Persoonsgegevens. Checked on 26 September 2026.
34. Cookies plaatsen. Autoriteit Consument & Markt. Checked on 26 September 2026.
35. Report of the work undertaken by the Cookie Banner Taskforce. European Data Protection Board. Checked on 18 September 2026.
36. Tracking cookies. Autoriteit Persoonsgegevens. Checked on 18 October 2026.
37. Guía sobre el uso de las cookies (July 2023). Agencia Española de Protección de Datos. Checked on 18 October 2026.
38. Proposal for a Regulation on the Digital Omnibus, COM(2025) 837 final. European Commission (EUR-Lex). Checked on 18 October 2026.
39. Digital Omnibus: Presidency compromise text, ST 12535/26 (3 September 2026). Council of the European Union. Checked on 18 October 2026.
40. Algemene wet bestuursrecht, articles 5:45 and 5:53. wetten.overheid.nl. Checked on 20 September 2026.
41. Burgerlijk Wetboek Boek 3, article 3:310. wetten.overheid.nl. Checked on 20 September 2026.
42. Besluit tot het opleggen van een bestuurlijke boete aan A.S. Watson (Kruidvat.nl), 2 May 2024. Autoriteit Persoonsgegevens. Checked on 20 September 2026.
43. Clear cookie banners. Autoriteit Persoonsgegevens. Checked on 18 September 2026.
44. Hoe legt de AP de juridische normen rond cookiewalls uit?. Autoriteit Persoonsgegevens. Checked on 18 September 2026.
45. Consent mode overview. Google for Developers. Checked on 20 September 2026.
46. Updates to consent mode for traffic in European Economic Area (EEA). Google Ads Help. Checked on 20 September 2026.
47. EU user consent policy. Google. Checked on 20 September 2026.
48. Withdrawal of Commission proposals (including the ePrivacy Regulation), Official Journal of 6 October 2025. EUR-Lex. Checked on 18 October 2026.
49. Digital Omnibus: Presidency compromise text, ST 9773/1/26 REV 1 (4 June 2026). Council of the European Union. Checked on 18 October 2026.
50. Digital Omnibus: Presidency note after Coreper, WK 8070/2026 (11 June 2026). Council of the European Union. Checked on 18 October 2026.
51. Procedure file 2025/0360(COD): Digital Omnibus. European Parliament Legislative Observatory. Checked on 18 October 2026.
52. EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus. European Data Protection Board and European Data Protection Supervisor. Checked on 18 October 2026.