EU Digital Omnibus: What the Council's Position Means for Your Magento Store Before Black Friday

The Short Answer

Nothing has changed yet, so keep your cookie banner. Keep asking for cookie consent. The Council of the EU has agreed on the starting position on the Digital Omnibus. The Digital Omnibus is not law, and the European Parliament and Commission still have to negotiate. The direction is clear enough to prepare for: a short list of consent-free cookie uses, a one-click cookie refusal, and a four-month cookie wait before asking for cookie consent again after someone says no.

Key takeaways

• Consent must still be the rule for cookies that're not absolutely necessary.

• The idea, from the Commission, to move cookie rules into the GDPR was abandoned. They will stay under the ePrivacy rules.

• Browser-level consent signals were removed from the Council’s version. The Parliament might reintroduce them.

• A clear cookie list and a fair one-click banner are the way to prepare. These help you now.

If you sell to shoppers in the EU, Black Friday brings traffic, more ad pixels, and more banner clicks than any other week. Reading a policy paper is the thing on your list, and that is totally understandable. So this guide keeps it short and simple. It explains what the Council proposed, what is still undecided, and what to check in your Magento 2 store using MageDelight’s Cookie Consent (GDPR) extension, for example. It is information, not legal advice, so ask your lawyer about your own situation.

What Is the Digital Omnibus?

It is a set of changes the European Commission put forward to make several digital rules easier to understand. This includes parts of the GDPR and the ePrivacy Directive. The ePrivacy Directive controls cookies and similar tools. The Commission wanted to bring the cookie rules under the GDPR and have browsers automatically send consent signals.

The Council has now created its version. According to an analysis of the Council's negotiating text, it follows the direction but removes many of the most extreme changes. For cookies, the Council returned to the position. The rules remain in Article 5(3) of the ePrivacy Directive, which the Council has rewritten.

What the Council Changed for Cookies

The closed list of uses that would not need consent includes:

• Sending a communication.

• A service the user clearly asked for, including how it works. The Council’s notes mention shopping baskets as an example.

• Anonymous first-party audience measurement.

• Security updates that are absolutely essential.

• Measuring advertising, with no profiling and no data shared across websites.

A media audience measurement exception also exists. The media audience measurement exception is aimed at media services, not shops. For a Magento store, the useful ones are the shopping basket and the anonymous measurement. Marketing and retargeting pixels still need consent.

What Is Not Decided Yet

This is where people start thinking far ahead. Legal experts say the requirement is the first step, not actual law yet, and Parliament hasn't made it official. One law company points out that Parliament might bring back browser signals. Since the ePrivacy rules are a Directive, each country will still have time to turn them into law, and differences between countries will remain. So changing a banner today would be a guess.

What to Do Before Black Friday

None of this requires a redesign. It requires a tidy-up that you will want anyway.

1. Continue to ask for consent for analytics, marketing and anything that is not strictly needed. Do not turn anything off because of the proposal. Keep asking for consent.

2. List every cookie and tag on your store. Sort them into groups: strictly necessary, shopping functions, analytics, marketing. When the final rules arrive, you will know exactly which group moves in your store.

3. Make refusing as easy as accepting. Put a Deny button on the first layer of the banner and test it.

4. Don't keep reminding. Decide how long you wait before asking after a refusal. Four months is what the Council suggests. Your current local rules still apply.

5. Check campaign tags. Every pixel you add for Black Friday must go into the group and not appear until the visitor agrees.

6. Keep records of consent and of the policy text people agreed to.

Where the Cookie Consent (GDPR) Extension Fits

According to the product page, the extension shows a cookie notice and popup, supports Google Consent Mode v2, and covers Magento Open Source, Adobe Commerce, and Adobe Commerce Cloud from 2.4.0 to 2.4.9. The extension is marked Hyvä-ready and Marketplace Approved. First-year prices for the extension are $129, $259, and $359 for the three editions; after the first year, the extension costs $89 per year for updates and support.

The user manual explains the admin settings. You can turn on the cookie policy. You can choose how long the choice lasts. You can. Hide the Deny button. You can edit the button text and the bar text. You can pick where the bar appears and what colours it uses. You can group cookies. Assign them to groups. The manual says marketing cookies, like the ones from Google Analytics, can be listed so they are blocked until the user gives consent. You can also manage versions of the privacy policy. You can use a customer consent grid. You can show a consent checkbox on registration, newsletter signups and checkout. You can let customers download their data. You can let customers request account deletion. Admins can approve these requests using an approval grid.

To see the customer side, try the storefront demo.

To see the settings, open the admin demo.

Three things to check in your own store

• Deny button: the manual says you can show or hide it. Turn it on.

• "Restrict customers to access the website if deny cookie": this setting stops people from entering if they refuse cookies. Most regulators do not like cookie walls. Keep this turned off unless your lawyer tells you to do.

• Consent records: the manual describes a grid for policy consents. Ask MageDelight if cookie choices are also logged and how detailed the banner is in your version, since the manual is older than the product page.

Test It Before the Rush

If you run Google tags, check that consent signals reach them correctly. Our GA4 with GTM guide covers how tracking and consent fit together.

Common Mistakes

Taking the banner down because "cookies are changing." Hiding the Deny button on a screen. Leaving pixels from last year's campaigns running. Asking again on every visit. Turning on the cookie wall setting. Adding Black Friday tags without telling whoever manages consent.

Which Setup Fits Your Store?

When most of your shoppers are in the EU, treat consent as a core feature and test consent every time you launch a campaign. When you sell worldwide, consider showing the banner by region, and see whether IP GeoLocation Advance can help after you review its features. Rules outside the EU differ; ask counsel.

Not sure which pixels and scripts your store really loads? A Digital Marketing Audit can list them. MageDelight’s support team can also help you set up the extension.

FAQ

What is the Digital Omnibus?

A set of proposed EU changes aims to simplify digital rules. These EU changes cover parts of the GDPR and the ePrivacy Directive, which controls the use of cookies.

Do I need to change my cookie banner now?

No. The Council text is a negotiating position, not a law. Keep your consent practices and use the time to tidy your cookie list.

Will cookie banners disappear?

Not under the Council text. Consent remains the rule; browser signals were removed, and saying no would be possible with one click.

Which cookies might not need consent?

The Council text mentions a set of cookies. These include cookies that're necessary for a service the user requested, like a shopping basket. It also includes first-party measurement cookies. However, marketing and retargeting cookies still require consent.

How long must I wait before asking again after a refusal?

The council suggests four months, which's less than the Commission's six. This is not law yet, so follow the rules that're in effect for you right now.

Does the extension support Google Consent Mode v2?

The product page says it does. It works with Magento 2.4.0 to 2.4.9. Test it with your tags on staging.