The Council of the EU has set out when a website could count its own audience without asking for cookie consent: when the result is anonymous aggregated information and the collected data is not reused, not shared and not combined with third-party data. The member states’ ambassadors (Coreper) agreed the text on Oct. 21, and the Council published it on Oct. 22 as document ST 14756/26. It is a negotiating mandate for the Digital Omnibus, not law, and nothing changes for an EU cookie banner today.
Does audience measurement need cookie consent under the Council’s text?
Not if it fits point (c) of the rewritten ePrivacy Article 5(3). The mandate keeps consent as the rule: storing or reading information on a device is “only allowed when that person has given his or her consent”, with a closed list of exceptions. Audience measurement is one of them, on conditions. The text is a mandate only: the Parliament’s file is still at “Awaiting committee decision” on the Legislative Observatory, the Parliament’s position and then trilogues come next, and after adoption the national laws are due on a placeholder of 24 months.
How does the Council’s wording differ from the Commission’s?
The Council struck the Commission’s new GDPR Article 88a, kept the cookie rules in the ePrivacy Directive and rewrote its Article 5(3). The table sets the Commission’s point 88a(3)(c) against the Council’s 5(3)(c). The Council column is article text except the sharing row, which comes from a recital: it guides interpretation but is not operative.
| Question | Commission 88a(3)(c) | Council 5(3)(c) |
|---|---|---|
| Who may measure | The controller of the service | The provider, or “a third party on behalf of that provider” |
| “Anonymous” | Not in the wording: “aggregated information” | “anonymous aggregated information” |
| Own use vs conditions | “solely for its own use” | Three conditions: no other purpose, no sharing with third parties, no combining with third-party data |
| Sharing the aggregates | No express sharing rule; the count is “solely for its own use” | Recital 44d: could be shared |
| Start of application | 6 months after entry into force (88a(5), struck) | Placeholder: 24 months after adoption (Art. 17(3)) |
Recital 44d says “The aggregated information could be shared with third parties, including companies and non-commercial organizations.” The Commission’s clause had no such sentence; it limited the count to “solely for its own use”. The Commission’s start date, “6 months following the date of entry into force of this Regulation”, is gone, and the six-months-after-publication line in the final provisions is struck in the mandate as published.
What would an analytics setup have to show?
Whatever the final text exempts, counts of your own traffic sources and campaigns are only as clean as the tags behind them, so a UTM builder for consistent campaign links stays useful whichever way the law lands. The questions below read point (c) clause by clause, as a reading aid.
- Who runs it? The clause allows “the provider of the service”, or a third party acting on the provider’s behalf. The whole processing must also be “solely related to and strictly necessary for” the count.
- Is the output anonymous and aggregated? Recital 44d adds that the data “should not relate to a specific data subject and should therefore be anonymous”.
- Is the data used for anything else? The exemption requires that the data are not processed “for another purpose”.
- Is the collected data shared with third parties? The clause requires that it is not “shared with third parties”; a third party may still run the count on the provider’s behalf. Sharing the finished totals is a recital point, not an article one.
- Is it combined with outside data? The article says “data from third parties”. The recital is wider: “data from other services from the provider of the online service”. How regulators read that gap is open.
What else did the Council write about measurement, refusals and enforcement?
Point (d) covers media audience measurement under Article 24 of Regulation (EU) 2024/1083, with data pseudonymised after collection, not processed for another purpose, and no tracking outside the measured service. Point (f) covers measuring the display and performance of advertising “based solely on the immediate content” shown during a visit or on a single search query. In the clause, “does not involve the processing of personal data” describes that advertising; data collected for the measurement “shall be pseudonymised after collection and shall not be processed for another purpose”.
On refusals, users must be able to decline “with a single-click button or equivalent means”, and after a refusal the provider may not ask again for the same purpose for “at least four months”. The Commission’s proposal said six. Member states would have to designate the GDPR data protection authorities to enforce Article 5(3). A Commission report on privacy-enhancing technologies is due within a placeholder of 12 months after adoption. PPC Land covered the earlier Oct. 2 draft.
What stays the same until national law changes?
Everything. No date exists for application, and even under the Council’s text, anything outside the closed list would still need consent. Until then, consent is collected as it is today; for how a single consent setting now governs GA4’s ad data, see our report on GA4 consent mode and ad-data control. noyb dates the Council text as “Text approved by the Council on Wednesday, published on Thursday”, and focuses on the mandate’s AI clause, a separate fight. For analytics, the thing to watch is whether point (c) and its three conditions come through intact in the trilogue with the Parliament.
