EU Digital Omnibus leaves publishers worse off on cookie consent
European publishers are reacting with marked skepticism to the EU’s “Digital Omnibus” package adopted on 19 November, which was presented as a simplification of the existing digital rulebook. While the initiative aims to streamline data protection and consent-related obligations, industry representatives describe the changes as essentially cosmetic and even counterproductive in practice. Instead of clarifying the framework for consent-based tracking, the new rules introduce additional layers of complexity without addressing the structural imbalance between publishers and large platforms.
A central concern is the introduction of browser- and device-level consent settings that would allow users to set tracking preferences once in Chrome, Safari, Firefox, iOS or Android, with all websites required to honor those choices. Publishers fear that, if users opt out of tracking at this central level, they will effectively be excluded from consent-based advertising across the web on a quasi-permanent basis. Drawing on experience with Apple’s App Tracking Transparency, industry voices anticipate that a very high percentage of users could reject tracking by default, reinforcing the competitive advantage of walled gardens with logged-in environments that are less dependent on cookie consent.
The Omnibus text suggests a potential exemption from centralized, browser-led settings for media service providers under the European Media Freedom Act, but this carve-out appears fragile in practice. Ad tech vendors would need to determine which partners qualify as media service providers and which processing fits within the exemption, under the shadow of GDPR liability if they misclassify. This allocation of risk makes it unlikely that intermediaries will willingly rely on such exemptions, leaving publishers in a continued legal gray zone. At the same time, shifting consent requirements from the ePrivacy Directive into the GDPR maintains the underlying constraints while adding new formalities, such as mandatory “reject-all” buttons and limits on re-prompting.
The push for one-click consent or rejection is intended to improve user experience and curb opaque consent interfaces, but publishers expect it to result in lower consent rates and less usable data overall. Even low-risk operations—such as measurement, frequency capping and fraud prevention—may become harder to justify when consent is withdrawn at scale, despite a theoretically helpful but ambiguously drafted exception for audience measurement cookies. In practice, the core regulatory logic governing online advertising remains essentially unchanged, while control over consent is further centralized in browsers and operating systems. For publishers, this combination narrows strategic options on the open internet and cements data access asymmetries between independent media and dominant platform operators.
