The EU's Digital Omnibus wants to exempt aggregated analytics from cookie consent — what it would and wouldn't cover
If you run web analytics in the EU and you've seen headlines about the Digital Omnibus "ending cookie banners," here's the short answer first: a proposed new Article 88a would let a narrow list of activities run without consent — including aggregated audience measurement by a website controller solely for its own use. A cookieless tool might qualify if it meets every condition; the draft does not automatically exempt every first-party analytics deployment.
But it is a proposal, not law. It creates no new exemption today; existing national rules can still provide narrower exemptions. The text is being negotiated, and EU data-protection regulators have asked for the audience-measurement scope to be clarified. This post maps what is proposed and what a website must still assess under current law.
What the Digital Omnibus actually is
On 19 November 2025 the European Commission adopted the Digital Omnibus — a package of "simplification" amendments touching the GDPR, the ePrivacy Directive, the Data Act and more (Commission proposal page). One quick disambiguation, because the press keeps mixing them up: there are two Omnibus files. The Digital Omnibus on AI moved fast and cleared votes in June 2026. The one that matters here is the main Digital Omnibus covering the GDPR and ePrivacy — a separate, earlier-stage file, still in committee and Council negotiation.
Its headline move for analytics: take the cookie- and tracker-consent rules that currently live in Article 5(3) of the ePrivacy Directive and fold them into the GDPR as new Articles 88a and 88b. Instead of "you need consent to store or read anything on a user's device unless it's strictly necessary," Article 88a would set out a closed list of purposes that don't need consent.
The audience-measurement exemption, in plain terms
Article 88a's list includes security, fixing faults, and — the relevant one — audience measurement. As rendered by law firms reading the draft, the carve-out covers:
"Creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use."
(Taylor Wessing's analysis is a good primary read; that wording is counsel's rendering of the draft, not a certified quote of the final legal text.)
Three conditions do the work, and they're worth reading slowly:
- Aggregated — you're producing counts and totals, not per-person records.
- Measure the audience of such a service — the site's own traffic, not a profile that follows the visitor elsewhere.
- By the controller, solely for its own use — not shared out, not pooled, not reused for someone else's purposes.
Legal commentators are near-unanimous that the exemption excludes analytics "that operate across multiple services, clients or platforms" (clickport's breakdown; Loyens & Loeff). That's the line GA4 falls on the wrong side of: it sends event data to Google's servers, Google reuses it across its own products and ad systems, and Google Signals enables cross-site, cross-device measurement. It isn't measurement by the site's controller "solely for its own use." This is professional interpretation, not settled law — but it's the consistent reading.
How the criteria map onto real tools
| Article 88a criterion | A tool designed for this exemption | GA4 (linked to Google Ads) |
|---|---|---|
| Aggregated, not per-person | Would need to meet the draft's output and processing limits | User- and event-level data retained |
| Measures only this site's audience | Would need to stay within one site's audience | Google Signals can add cross-device measurement |
| Controller uses it solely for its own use | Would need to exclude reuse for another purpose | Linked Ads adds another purpose |
| Reads as "covered" by commentators | Likely | Unlikely |
Read that table as "where the exemption's logic points," not as a compliance verdict. The exemption's exact scope is precisely what's still being argued over.
The part the headlines skip: it isn't law, and it may not survive as written
This matters enough to spell out, because "the EU is scrapping cookie banners" is doing a lot of rounds and it's wrong today.
- Status as of July 2026: the GDPR/ePrivacy Omnibus is a proposal in negotiation — pre-trilogue. The European Parliament is still at committee stage and the Council is still working through its position. No plenary vote, no general approach finalised, no adoption.
- Regulators pushed back. In their Joint Opinion 2/2026 (11 February 2026), the EDPB and EDPS criticised parts of the package and asked that the audience-measurement exemption's scope be further specified (joint opinion PDF). The wording you read today can still narrow.
- Banners aren't going away for tools that need consent. The draft also proposed Article 88b — a machine-readable, browser-level consent signal that would have let people answer once in their browser instead of clicking through banners. In its 18 June 2026 position, the Council removed Article 88b entirely, after lobbying that included a Google paper claiming banner removal would gut online advertising — figures the Commission itself called "highly exaggerated" (Digital Watch; noyb). Parliament hasn't weighed in on 88b yet, so it could return — but as things stand, the automated alternative to banners has been cut, while the consent obligation for tools that need it stays put.
So the honest status line is: if adopted as drafted, first-party aggregate-only measurement would be explicitly consent-exempt. That "if" is carrying real weight.
What a cookie-less tool changes today
Here's the product distinction. Simplytics sets no visitor cookies or browser storage and does not feed an ad network. Those choices reduce what a website has to evaluate, but they do not by themselves settle its consent or notice duties under current law.
The script sets no visitor cookies. Visitors are counted with a keyed daily hash derived from a truncated IP, user-agent, domain and site-local date. That hash links visits on one site during one day and can be personal data while stored. Raw visit records are deleted nightly; daily aggregates remain, and a page path or event name in them can itself identify someone. The website operator must assess the applicable consent exemption and tell visitors what it collects. That assessment does not depend on the Digital Omnibus proposal passing.
What the Digital Omnibus proposes is a more explicit audience-measurement exemption. Its final scope is unsettled. The current European Parliament procedure was still awaiting a committee decision on 18 September 2026. A vendor should not advertise the draft as a permission already granted.
None of this makes GA4 illegal — that's not the claim, and legal posts that lean on fear age badly. It's that the direction of travel keeps rewarding the same thing: collect less, keep it aggregate, share it with nobody. If you want the honest side-by-side on how these tools differ on data handling and price, the Simplytics vs Google Analytics page lays it out — and if the consent machinery itself is what you're untangling, our breakdown of GA4's June 2026 data-controls change covers the settings you'd otherwise have to keep re-checking.
The one-line summary: the Digital Omnibus proposes a wider first-party audience-measurement exemption, but it is still a proposal. Simplytics sets no visitor cookies and minimises raw data; each website must still assess whether its deployment qualifies under the law that applies today. It costs $1/month billed yearly and is compared with GA4 here.