Headlines about the "end of cookie banners" have been around since the Commission published its Digital Omnibus package. If you run a website, the practical question is simpler: do you need to change anything now?
This post explains what was proposed, where the file stands as of October 2026, which rule your banner has to follow today, and what that means for small embeds such as a feedback widget. It describes the law as we understand it in October 2026. The file is still moving, and none of this is legal advice.
The short answer
Nothing has changed yet. In November 2025 the European Commission proposed moving cookie consent into the GDPR, letting browsers send consent choices automatically and making sites wait before asking again after a refusal. The Council compromise texts reported in September and October 2026 drop both new GDPR articles and keep consent in Article 5(3) of the ePrivacy Directive. Neither the Council nor the Parliament has an agreed position yet, so the current rules still apply: you need consent to store or read information on a visitor's device unless it is strictly necessary for something they asked for.
What the Commission proposed in November 2025
The Digital Omnibus is a package of changes to EU digital laws, tabled by the European Commission on 19 November 2025 to cut paperwork. For cookies, it proposed three changes:
- A new Article 88a GDPR would move the rules on storing or reading personal data on a visitor's device from the ePrivacy Directive into the GDPR. Consent would still be the default, with exemptions for sending the page, for a service the visitor asked for, for a site measuring its own audience, and for security.
- A new Article 88b GDPR would make sites to respect automated, machine-readable consent choices, such as a setting in the browser, and larger browser makers would have to offer a way to send them.
- After a visitor refused, a site could not ask for the same purpose again for six months.
Information that isn't personal data would have stayed under the ePrivacy Directive. The European Data Protection Board and the European Data Protection Supervisor backed the aim of cutting banner fatigue in their joint opinion of February 2026, while raising concerns about some of the new exemptions.
Where the proposal stands in October 2026
An EU regulation needs the agreement of both the Council (the member states) and the European Parliament. Each first settles its own position, then the two negotiate a final text. As of October 2026:
- The Council has moved away from the GDPR route. Compromise texts from the Irish Presidency, dated 3 September and 2 October 2026 according to public reporting, delete Articles 88a and 88b. Consent stays in Article 5(3) of the ePrivacy Directive, with some revised exemptions, no automated browser signal, and a four-month wait before asking again after a refusal.
- The Council has not agreed its position. Ambassadors were due to vote on 7 October 2026. The vote was postponed to 11 October over disagreements on other parts of the package, and we found no confirmation that a mandate was adopted.
- The Parliament has no adopted position. Its committees published a draft report and amendments over the summer.
So negotiations between the two institutions have not started. Whatever comes out will need formal adoption and a date from which it applies. Until then, the cookie rules you work with are the ones that applied before November 2025.
What this means for a feedback widget
Feedback widgets, chat boxes and survey pop-ups get added to sites quickly, often without anyone checking what they store. Under Article 5(3), a widget falls into one of three groups:
- It stores and reads nothing on the device. Then Article 5(3) doesn't come into it, and the widget has nothing to put in your banner. GDPR still applies to any personal data it collects.
- It stores something strictly necessary for what the visitor asked for, such as a note that stops the same survey appearing again straight after the visitor answered it. This can fall under the exemption, but it should be listed in your cookie policy.
- It stores identifiers, targets surveys by behaviour or records sessions. That needs consent, so the widget should only load after the visitor agrees. Visitors who refuse never see it.
The cookie consent checker walks through these questions for a specific widget, so you can see which group yours falls into before you change your banner.
Example
Example: a recipe site reads the headlines
Say you run a recipe site. Your banner covers an analytics tool, an ad network and a survey widget you added last year. Your editor reads that the EU is "scrapping cookie banners" and asks whether you can remove yours before the redesign.
You check where the Digital Omnibus stands and find that nothing has been adopted. The analytics tool and the ad network still need consent under Article 5(3), so the banner stays.
Then you look at the survey widget. It sets a cookie with a random visitor ID so it can count how often each person has seen the survey. That is not strictly necessary for answering a survey, so the widget sits behind the banner, and every visitor who clicks "Reject" never sees it. Part of the reason so few readers answer is that the widget only loads for readers who accepted.
You keep the banner as it is and replace the widget with one that stores no identifier. The banner keeps its two entries, and the survey now loads for every reader.
How the Asklet widget behaves
The Asklet widget is an iframe you paste into your page. This is what it does in your readers' browsers:
- It sets no cookies and uses no tracking identifiers or fingerprinting.
- After a reader submits a survey, it saves one entry in the browser's local storage,
asklet:answered. It lists the pages where a survey was answered in the last 3 hours, with the survey version. Page addresses are stored as short codes, not as text. It holds at most 50 notes and no personal data. - When the widget loads, it reads that entry so it doesn't ask the same reader again on that page. Notes older than 3 hours are deleted, and the entry is removed once it is empty.
- If the browser blocks storage in embedded frames, the widget still works. The reader may just see the survey again.
Our Cookie Policy lists this entry as strictly necessary storage: it is only written after a reader chose to answer, and only so the widget doesn't ask them the same thing again. Whether that matches your own reading of Article 5(3) is for you and your adviser to decide. Either way, list it in your cookie policy.
Answers are stored with the page path and the time, with no IP address, browser details or reader ID. To stop floods of fake answers, Asklet counts recent surveys per network under a keyed hash that changes every hour and is never stored with an answer. Asklet doesn't make your site compliant on its own: your banner, your other scripts and your privacy notice are still yours to get right.
Your next steps
-
Leave your banner as it is for now
No part of the Digital Omnibus applies yet. Don't remove consent for anything on the strength of a proposal.
-
List every script and what it stores
For each one, write down what it stores or reads on the device, the purpose, and whether it is strictly necessary for something the visitor asked for.
-
Check each widget on its own
Run feedback, chat and survey widgets through the cookie consent checker, and ask the vendor in writing about anything you are unsure of.
-
Put strictly necessary storage in your cookie policy
Storage that doesn't need consent still belongs in the policy, with its name, purpose and how long it lasts.
-
Check the file again when negotiations end
Once the Council and the Parliament agree a text, read the final cookie articles and the date they apply from, then update your list.
Try these steps on your own site. Asklet adds the questions to every page with one snippet. Free plan, no card needed. Compare the plans.
Start freeCommon questions
Has the Digital Omnibus changed the EU cookie rules yet?
No. As of October 2026 it is a proposal. The Council and the Parliament have not agreed their positions, so Article 5(3) of the ePrivacy Directive and the national laws based on it still apply.
Will browser settings replace cookie banners?
The Commission's proposal included automated browser signals (Article 88b), but the Council compromise texts reported in 2026 dropped them. The Parliament could still argue for them, so it is too early to say.
Does local storage need consent like cookies?
Yes, on the same terms. Article 5(3) covers any information stored on or read from the visitor's device, so local storage needs consent unless it is strictly necessary for a service the visitor asked for.
Does the Asklet widget need a cookie banner?
It sets no cookies and no identifiers. It keeps one local storage entry, asklet:answered, after a reader answers, which our Cookie Policy describes as strictly necessary. Check your own setup with your adviser, and list the entry in your cookie policy.
Is this legal advice?
No. It is general information about EU rules as of October 2026, and the file is still changing. For decisions about your site, ask a lawyer who knows the law in your country.
Related
Sources
- EUR-Lex: Directive 2002/58/EC (ePrivacy Directive)
- EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive (2024)
- EDPB and EDPS: Joint Opinion 2/2026 on the Digital Omnibus proposal (2026)
- EUTechReg Research: GDPR reform in the Digital Omnibus, dossier (2026)
- Agence Europe: Vote on 'Digital Omnibus' postponed until 11 October (2026)