Key points

• In late 2025 the European Commission published its Digital Omnibus proposals, which would amend the GDPR and the rules on accessing information on devices that currently sit in the ePrivacy Directive.
• The proposals would bring most cookie and device access rules into the GDPR framework, add exemptions for low-risk purposes such as audience measurement and security, and make browser or system-level consent signals binding on websites.
• These are proposals only. They face scrutiny in the European Parliament and Council, and the outcome may change materially. The existing rules continue to apply meanwhile.
• For retailers, the practical effect could be less banner fatigue, but also a shift towards honoring signals set by browsers and operating systems, which may reduce the consent rates that advertising and personalization depend on.
• Retailers should not delay current compliance. Regulators continue to enforce consent design, and enforcement can occur under national laws regardless of the reform.

The current framework

Article 5(3) of the ePrivacy Directive, implemented in national law, requires consent before a website or app stores or reads information on a user's device, unless the access is strictly necessary to deliver a service the user requested. That rule covers cookies, software development kits, pixels and similar tools. Where the information is personal data, the GDPR also applies, which means that two sets of rules and sometimes two different regulators govern a single tag. The overlap has produced inconsistent enforcement and the familiar proliferation of consent banners.

What the Commission has proposed

The Digital Omnibus package is a broader simplification initiative. On cookies and tracking technologies, the proposals would move the device-access rule for personal data into the GDPR, so that it is supervised by data protection authorities under a single framework. They would also add a list of purposes for which consent would not be required, covering, for example, security, the creation of aggregated statistics for the operator's own use and certain basic service functions.

A second element addresses user choice. The proposals would require websites to respect machine-readable signals sent by browsers or operating systems to indicate consent or refusal, and would require browser providers to make such signals available. Where a user refuses consent, the site would not be able to ask again for a period of months. Press and media service providers would receive some flexibility. The proposed text would also adjust other parts of the GDPR, such as the definition of personal data and rules for AI training, which attract more debate than the cookie provisions.

Why retailers should pay attention

Retailers rely on tracking technologies for site analytics, personalization, remarketing, affiliate attribution and retail media measurement. The exemption for first-party aggregated measurement may help with some of those uses. However, advertising, remarketing and cross-site profiling are unlikely to benefit from the exemptions. The signal provisions could have the biggest commercial effect, because if a meaningful share of users configure their browser to refuse tracking, consent-dependent advertising will shrink, and retailers may need to lean further on contextual advertising and on first-party relationships where consent is given in a logged-in environment.

The same questions apply to apps. Mobile operating systems already provide tracking permission prompts, and a binding signal approach could align the web and app environments.

The UK position

The United Kingdom is moving on a separate path. The Data (Use and Access) Act 2025 amended the Privacy and Electronic Communications Regulations to add exemptions for certain low-risk cookies, including some analytics and functional uses, and to increase penalties to the level of the UK GDPR. Retailers operating in both markets should expect differences in details and timing, and should avoid assuming that one regime's exemptions apply in the other.

What to do now

• Inventory tracking technologies across web and app properties, and classify each by purpose, data collected and vendor.
• Keep consent design clean. Equal prominence for accept and reject, no pre-ticked choices, and a withdrawal option as easy as the original consent remain the baseline.
• Test signal handling. Check how your consent platform treats browser-based signals and decide on an approach in advance.
• Model the commercial effect. Ask marketing and analytics teams how revenue would change if consent rates fell, and which measurement options do not need consent.
• Engage in the process. Industry associations and national authorities are consulting. Retailers with strong views on the signal and exemption provisions can contribute.

The legislative timetable is uncertain, and the proposals may be split, amended or delayed. We will update this alert as the Parliament and Council positions develop. In the meantime, treat the proposals as a planning scenario rather than a change in the law.