Skip to main content
Praxikon

Legislation in motion

Proposal: cookie rules move from ePrivacy to the GDPR, with new exceptions and a six-month rule (new Article 88a GDPR and Article 5(3) ePrivacy)

Date
Status
under negotiation
Body
Europese Commissie
Reference
COM(2025) 837 final, artikel 3, punt 15 (nieuw artikel 88a AVG) en artikel 5 (wijziging artikel 5, lid 3 en schrapping artikel 4 richtlijn 2002/58/EG); ST 15698/25; 2025/0360(COD)

What it is about

Storing or accessing personal data in a natural person's terminal equipment would be governed by the GDPR and require consent, unless necessary for transmitting a communication, a service explicitly requested by the data subject, aggregated audience measurement by the controller solely for its own use, or security. Refusal must be possible with a single-click button or equivalent means; after a refusal no new consent request for the same purpose may be made for at least six months. Article 5(3) ePrivacy would no longer apply where the user is a natural person and personal data are involved; Article 4 ePrivacy (security) is deleted. Article 88a would apply six months after entry into force. In Joint Opinion 2/2026 of 10 February 2026 the EDPB and EDPS support the aim, warn that splitting the rules over different instruments creates legal uncertainty and suggest an extra exception for contextual advertising. The Council Presidency compromise of 22 June 2026 deletes Article 88a; no text has been adopted.

What this means in practice

If adopted, you could set first-party audience measurement and security cookies without consent and would need to redesign your banner: single-click refusal and a pause of at least six months after refusal. Supervision would sit with the GDPR authority. For personal data of natural persons the Dutch legal basis would move from the Telecommunications Act (Article 11.7a) to the GDPR; for other data and legal persons Article 11.7a would remain. The Council is considering keeping the rules in the ePrivacy Directive instead, so the outcome is uncertain. Today the current cookie rules apply in full.

The GDPR articles concerned

Source: Raad van de EU, register (COM(2025) 837 final als ST 15698/25)checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 13

Guidelines8 of 13

Enforcement and fines8 of 9

Legislation in motion6 of 17