Commission proposes changes to EU cookie consent obligations
The European Commission plans to simplify digital rules by reassessing the 2009 e-Privacy Directive that requires websites to obtain user consent before placing most cookies. Cookies collect information ranging from login status to browsing and shopping behavior, and the directive currently forces websites to show consent banners unless cookies are strictly necessary to provide a service. Officials are considering changes to allow users to set preferences once (for example, in browser settings) or to expand exceptions for technically necessary or basic statistical cookies, reducing repetitive consent prompts.
Industry participants have proposed shifting cookie regulation into the General Data Protection Regulation (GDPR), which uses a risk-based approach and allows alternative legal bases for processing, such as legitimate interest, rather than the strict consent model in the e-Privacy Directive. The Commission plans an omnibus proposal that could remove some current burdens and streamline rules; a focus group with industry and civil society discussed these options in September ahead of a December policy text. EU member states, including Denmark, have already suggested narrowing consent obligations for cookies used only for essential functions or simple statistics.
Privacy advocates and some lawmakers strongly oppose broadening exceptions or dismantling the existing directive without a robust risk analysis. They warn that expanding exceptions risks permitting analytics or personalization that enable targeted advertising and commercial exploitation of personal data. Critics argue that removing explicit e-Privacy safeguards could leave Europeans with weaker protections, relying mostly on the EU Charter and general GDPR provisions instead of specific privacy rules for electronic communications.
Reform efforts are likely to intensify as the Commission prepares the Digital Fairness Act, an advertising-focused proposal aimed at protecting consumers from manipulative design and unfair personalization. The debate will pitch industry calls for reduced compliance costs and regulatory harmonization against privacy groups and some MEPs who demand strong, specific safeguards for electronic communications data to prevent intrusive tracking and commercial misuse.
