The EU's Cookie Rewrite: What the Digital Omnibus Means for Publisher Revenue

Cookie banners have been the most visible part of European privacy law for more than a decade, and one of the least loved. On November 19, the European Commission published its Digital Omnibus package, a set of proposals to simplify EU digital rules. Buried inside is a significant rewrite of how consent for cookies and similar technologies would work. For any publisher with meaningful European traffic, and travel publishers in particular, this is worth understanding now, even though it is a proposal and not yet law.

What is actually proposed

Today, the rule that requires consent before storing or reading information on a user's device lives in the ePrivacy Directive, implemented differently in each member state. The Omnibus would move that logic into the GDPR itself through two new articles.

Article 88a: new consent rules and exceptions

• A defined list of exceptions. Device access would be allowed without consent for a closed list of purposes, including transmitting a communication, providing a service the user explicitly requested, maintaining security, and audience measurement.
• One-click refusal. Users must be able to refuse consent with a single click or an equally easy mechanism.
• A six-month pause. If a user refuses, the site cannot ask again for the same purpose for six months.

Article 88b: machine-readable signals

Controllers would have to respect automated, machine-readable consent choices, such as a preference set in the browser. In other words, the per-site banner would increasingly be replaced by a user's standing choice.

The fine print that matters for publishers

The audience measurement exception is narrow

It would be easy to read "audience measurement" and assume analytics are off the consent hook. According to an analysis by Osborne Clarke, the exception is limited to aggregated usage information that the operator of the service creates solely for its own use. Measurement tools that operate across services, customers and platforms, which describes many common analytics and ad measurement products, would likely fall outside it. Advertising cookies and identifiers are not covered at all.

Media services get a carve-out on browser signals, with caveats

The proposal says media service providers are not obliged to respect automated browser signals when providing a media service. That is a nod to the argument that journalism depends on advertising revenue. But the same analysis notes the carve-out simply disapplies the signal obligation rather than creating a positive legal basis for processing. Consent, or another valid basis, would still be required. And whether a given site qualifies as a "media service provider" is not something most ad-supported publishers should assume.

Why the six-month rule is the big one

Most European publishers already offer a "reject all" option on the first layer of their banner, because regulators in several countries have pushed hard for it. So one-click refusal on its own changes less than it sounds.

The six-month pause is different. Today, a site can present the consent prompt again on a later visit or after the stored choice expires, and a meaningful number of users change their answer over time. A mandatory six-month gap after a refusal would lock in lower consent rates for longer. For publishers whose revenue depends heavily on consented traffic, that is a direct hit to the share of impressions that can carry personalized demand.

Browser-level signals could compound that. If a user sets a global refusal once, every site they visit inherits it. Whether that raises or lowers consent overall will depend on how browsers design the setting and what the default is, which is not yet clear.

Why travel publishers should pay attention first

Travel content is disproportionately European in both audience and advertiser base. A travel site may have readers in a dozen EU countries, each with its own data protection authority and its own history of cookie enforcement. Consolidating the rules into the GDPR could reduce that fragmentation, which is a genuine benefit. But travel sites also rely on high-value demand from airlines, hotels and booking platforms that typically bid more for audiences they can identify or retarget. Any structural drop in consent flows straight into those bids.

What to do now

The proposal now goes to the European Parliament and the Council, and it will change along the way. Timelines for EU legislation are measured in years, and there will be transition periods. There is no reason to rebuild your consent setup today. There are good reasons to prepare.

1. Measure your consent funnel properly

Know your current accept, reject and no-action rates by country, device and page type. Know how often users who initially reject later accept. That second number tells you how exposed you are to a six-month re-ask ban.

2. Quantify revenue by consent state

Compare revenue per session for consented versus non-consented traffic. Many publishers have never run this analysis cleanly. It is the number that determines how much a drop in consent costs you.

3. Make non-consented traffic worth more

The durable response to lower consent is stronger contextual monetization. Pass clean page-level signals in bid requests, work with demand partners that buy contextually, and make sure non-personalized ad requests are actually filling rather than timing out. For travel sites, destination and trip-type context is valuable to advertisers without any user identifier.

4. Strengthen first-party relationships

Logged-in users, newsletter subscribers and app users give you consent conversations on your own terms. Those relationships matter more in every version of this proposal.

5. Keep your CMP and TCF setup current

Whatever the final text says, the mechanics will run through consent management platforms and industry frameworks. Stay on current versions and follow how the framework owners respond.

The bottom line

The Digital Omnibus is an attempt to fix banner fatigue, and it may well reduce the number of pop-ups Europeans see. For publishers, the likely net effect is a more standardized consent regime with fewer chances to re-ask and more weight on browser-level choices. That rewards sites that monetize context well and understand their consent economics in detail. Start measuring now, so that when the final text lands you are making decisions from data rather than headlines.