Summary

  • Under the Council's Digital Omnibus negotiating text, a user must be able to reject a cookie-consent request with one click; after a refusal, the same provider must wait at least four months before asking again for the same purpose.
  • The text gives separate no-consent routes to tightly bounded site counts, media audience measurement and contextual-ad performance measurement. Each comes with its own limits on reuse and tracking.

Some websites treat a declined cookie request like an invitation to try again after lunch. The Council's negotiating mandate proposes a calendar for that habit. A refusal must be easy to make in one click or an equivalent step. For the same purpose, the provider then owes the visitor at least four months without another consent request. An accepted request cannot be repeated while that consent remains valid either.

The proposal is more interesting than a war on pop-ups. The Council keeps device storage and access under the ePrivacy Directive and preserves consent as the ordinary route. It then lists uses that can proceed without it when strictly necessary. Sending a communication and providing a feature the visitor explicitly requested are two. Technical security is another. The Council's public account says this should mean fewer banners. The mandate shows how it intends to get there.

First comes a site's own headcount. A service provider, or a party working on its behalf, may create anonymous aggregate information about use of that service. The underlying collected data cannot be reused for another purpose or mixed with outside data. A counter for today's visitors is a different instrument from a dossier assembled across websites, and the text draws the line there.

Media measurement gets its own clause. It can count and describe audiences under the European Media Freedom Act's Article 24, with personal data pseudonymised after collection, no tracking beyond the service or content being measured and restrictions on sharing personal data. The rule treats a publisher's audience question separately from a general site's own aggregate tally.

There is even a lane for measuring an ad's display and performance when the ad depends only on the page in front of the visitor or a single search query. No profiling, past or future activity, or cross-site trail may enter that measurement; the data cannot be repurposed. Calling every analytics script “measurement” will not make those conditions disappear.

This is the Council's position for talks with Parliament. National data-protection supervisors would enforce the proposed ePrivacy device rule. A legal text that tells a button to remember “no” also asks regulators to police the labels sites put on their counters.