Digital Omnibus: audience measurement without consent?

On 21 October 2026 the EU member states agreed their negotiating position on the Digital Omnibus, a package that among other things is meant to simplify the rules on cookies. For web analytics it contains a quiet bombshell: first-party audience measurement should no longer require consent.

This is not law yet. But if it goes through, consent-free web analytics would no longer be a grey area but clearly regulated. And privacy-friendly, self-hosted tools such as Matomo would be in the best position.

What the Council agreed

According to the Council, the cookie rules stay in the ePrivacy Directive, in a rewritten Article 5(3). In November 2025 the Commission had proposed moving them into the GDPR.

The basic rule remains: storing information on a device or reading it from there requires consent. What is new is an exhaustive list of six purposes for which this is allowed without consent, as far as it is strictly necessary for them:

1. transmitting a communication over a network
2. providing a service the user has explicitly requested, such as the chosen language or the shopping basket
3. First-party audience measurement: anonymous, aggregated figures on the use of an online service
4. audience measurement for media under the European Media Freedom Act
5. the technical security of the service or the device
6. measuring contextual advertising that works without personal data and without profiles

On top of that, consent must be refusable with a single click. After a refusal, a website may ask again after four months at the earliest; the Commission wanted six. The Council did, however, drop the automatic consent signal from the browser that the Commission had proposed.

Audience measurement: what is covered and what is not

The exemption comes with clear conditions. The measurement is carried out by the website operator itself or by a service provider on its behalf. The data collected is used only for the measurement, it is not shared with third parties and not combined with third-party data.

The recitals are even more explicit: no individual user behaviour should be analysed, and the data is not combined with data from the same provider’s other services or with analytics data from other websites. The aggregated results, on the other hand, may be shared.

Why this would end the grey area

In Germany, Section 25 of the TDDDG applies today. Storing information on a device or reading it from there requires consent unless it is strictly necessary. Audience measurement is not one of these exceptions.

That is why anyone using Matomo without consent does without cookies and without reading device properties, and bases the remaining processing on legitimate interest. What that looks like technically is described in the guide Matomo without cookies. This is a defensible approach, but it remains a matter of interpretation: the European Data Protection Board reads access to the device broadly in its Guidelines 2/2023, and not every supervisory authority sees it the same way. In France, by contrast, the CNIL already exempts audience measurement under certain conditions today.

The Digital Omnibus would bring an explicit rule for the whole EU. Consent-free audience measurement would then no longer depend on interpretations, but on conditions that can be checked and documented. Depending on the interpretation, Matomo might even set cookies again, for example to recognise returning visitors more reliably, as long as the data only flows into the aggregated reports.

Why self-hosted Matomo fits well

The conditions read almost like a description of a self-hosted Matomo:

• Your own server: The data stays with you or with a service provider acting on your behalf. No vendor uses it for its own purposes.
• Nothing goes to third parties: Matomo does not send visitor data to advertising or analytics platforms on its own.
• Everything is configurable: Cookies, shortened IP addresses, retention periods, visitor profiles and user IDs can be set up the way the conditions require.
• Verifiable: The configuration can be documented and checked when needed.

Tools whose vendor also analyses the data itself, combines it with other websites or uses it for advertising, on the other hand, do not fit these conditions.

What this means today

Current law still applies. The European Parliament has not yet adopted its position; only then will negotiations between the Council, Parliament and Commission, the trilogue, begin. The text may still change along the way. Once the regulation is adopted, member states have up to 24 months to transpose the cookie rules into national law, in Germany most likely in the TDDDG.

So it will take at least two years before the new rules apply. It is still worth preparing now:

• Don’t rush: Your consent banner stays as it is until the new rules apply.
• Separate measurement from marketing: Decide in your tag manager which tags are pure audience measurement and which send data to ad platforms. That makes switching over quick later on.
• Know your data flows: Write down which data leaves your analytics tool, for example via a Conversions API or exports.
• Set up Matomo with little data: cookieless, without feature detection and with a shortened IP address. That fits today and most likely tomorrow as well.

And you?

Would you actually slim down your consent banner once audience measurement is allowed without consent, or keep everything as it is to be safe? And how do you plan for a law that is still at least two years away? I’d love to hear your view, by message or on LinkedIn.

If you want to set up your Matomo now so that it fits the future conditions, I can help with cookieless and privacy settings. This post puts the Council text into a technical context; the legal assessment of your setup stays with your legal advisers.

Sources

As of 29 October 2026

• Council of the EU: negotiating mandate on the Digital Omnibus, document 14756/26 of 22 October 2026 (PDF)
• Council of the EU: press release of 21 October 2026
• PPC Land: EU Council agrees 4-month cookie re-ask wait for Digital Omnibus talks
• European Data Protection Board: Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive
• Section 25 TDDDG (German)
• CNIL: Use analytics on your websites and applications