What the Council actually agreed, verified

Three sources line up: the Council's October 21 press release, IAPP's read of the mandate (published October 22, citing negotiating document ST-14756-2026-INIT), and PPC Land's continuously updated ledger. The headline items:

  • The personal-data definition survives as written. The Commission's rewrite of Article 4(1) — a relative definition under which data is not personal for any entity that cannot reasonably identify the person behind it, codifying the CJEU's EDPS v SRB ruling — was opposed since February and is out of the Council text. In its place: an amendment spelling out pseudonymization standards. The EDPB and EDPS won their February fight with the Commission; the case law stays case law, and the definition stays broad.
  • Cookies go back under the ePrivacy Directive. The Irish presidency compromise of September 3 returned device-access consent to Article 5(3), and the mandate lists where consent would not be required: storage necessary to provide the service, storage for audience measurement, and storage for device security. The Commission's plan to move all of this into the GDPR with exemptions is gone.
  • The re-ask moratorium is four months, not six. The October 2 Council document (13886/26) cut the wait before asking a user again after a refusal from six months to four; the mandate keeps it.
  • Breach reporting: 96 hours, high-risk-only, national portals. The Commission proposed raising the 72-hour notification to 96 hours and only where the breach is likely to pose a high risk, filed through one EU-level portal shared with NIS2. The Council kept the 96-hour deadline but rejected the single portal — entry points stay national, with a harmonized framework and provisions for cross-border incidents layered on.
  • AI training got safeguards, not the free pass. The mandate adds safeguards for sensitive data use in biometric verification and AI model training, and clarifies rather than presumes the lawful ground for training-data processing. The unconditional right to object that the Commission proposed was already dropped in the September 3 text.

One procedural wrinkle worth recording because it shows how contested the file is: the ambassadors' committee (Coreper) failed to adopt the mandate on October 7 — Germany and France pressed for stronger trade-secret protection in the Data Act portion — and the agreement only landed October 21. A mandate that survives a Coreper deferral is a position, not a compromise everyone loves.

The browser-level consent signal is the story for small operators

The rest of this package is Brussels plumbing. The Article 88b fight is not.

The Commission's November 2025 proposal included a requirement that websites honor machine-readable consent signals sent by browsers and operating systems — a standard flag that means "I have set my preference, honor it, no banner." For a community site, a fire hall, a school district: that one mechanism was the realistic end of the cookie-banner era, because it outsources the consent UX to the browser where it belongs.

The record on it, in six lines:

  1. Proposed November 19, 2025, as Article 88b, with media service providers exempt.
  2. Backed by the EDPB and EDPS in their February 10, 2026 joint opinion — in fact the watchdogs supported exactly this piece while rejecting the personal-data rewrite around it.
  3. Opposed by the ad industry: France's Alliance Digitale called for deletion; a Google-commissioned study (Implement Consulting Group) estimated the browser mechanism could cost European businesses €40–50 billion a year. noyb called the figure "completely far-fetched," and no independent estimate exists.
  4. Deleted June 18, 2026 by a Council compromise — the same month the AI half of the omnibus was adopted into law and with it the Article 50 transparency obligations and attention was elsewhere.
  5. Asked back by 19 organizations in September after the September 3 text confirmed the cookie rules would live in ePrivacy without it.
  6. Not in the mandate. As of the October 21 position, the signal is gone from the Council's side of the table.

The honest reading: a small self-hosted site loses more from 88b's death than a platform gains from it. Platforms have consent-management vendors and legal teams; a community site has either a banner it should not need, or analytics it does not run because the banner question is not worth the answer. If the European Parliament re-inserts the signal — and it has 1,840 amendment opportunities, with the EDPB's backing on record — the banner-free path returns for everyone. If Parliament confirms the deletion, banners stay permanent infrastructure, and the four-month moratorium is the only relief in the text.

What the mandate changes for someone running a community site

Today: nothing. This is a negotiating mandate, not an adopted law. The GDPR still requires breach notification within 72 hours. ePrivacy Article 5(3) still requires consent for non-essential storage access. Do not rewrite your banners off of a Council position.

If the mandate survives trilogue roughly as written:

  • Self-hosted, cookieless analytics — no storage access, no ePrivacy gate, unchanged. IP-heavy setups with cookies on a legitimate-interest basis: the audience-measurement exemption would remove the separate storage-consent gate, but the GDPR basis for the processing itself is untouched — one consent layer fewer, not a tracking license. The pseudonymization standards amendment, ironically, is the piece that could make that basis cleaner to operate.
  • Embedded third-party widgets (the YouTube embed, the map iframe) — still consent-gated under 5(3). The mandate's exemptions do not reach them.
  • A breach at your site — if adopted: 96 hours, and only when the risk is high. National portal. Learn your national entry point now — the harmonized framework changes the plumbing, not the fact that the reporting goes to your member state.
  • The four-month moratorium — if your site asks again after a refusal, the ceiling drops from six months to four. Small thing; the only reason to note it is that sites doing consent correctly get more room to not re-ask.

The watch item: the LIBE and ITRE committee vote on the Parliament position. The European Council wants the omnibus packages closed by end of 2026, the Irish presidency runs to December 31, and trilogue has not started — so the Parliament position has to land inside weeks, not quarters, for the deadline to mean anything. When the vote happens, the first thing to read is not the cookie exemptions or the breach hours — those will bend in trilogue — it is whether 88b is in or out. That one paragraph is worth more to a community site than the rest of the mandate combined.

Corrections ledger

None — first coverage of the Digital Omnibus data package on this site, and the dates above were cross-checked against the Council's own press release and the PPC Land ledger, which as of this writing is the most current public-running record. One framing note instead: this site covered the AI half's Article 50 transparency obligations in August, when the data half was already a year into its negotiation. The delay was not accidental in either case — the cookie signal died quietly in June while the AI deadline dominated the news cycle, and the mandate landed in October under the same conditions. The cookie-signal question will be decided the way the trilogue's other questions get decided: by which of the three institutions needs the file closed more.