BRUSSELS — Efforts by the European Union to streamline its complex web of digital legislation have hit another roadblock. Member states have once again failed to forge a unified Council position on the highly anticipated "Digital Omnibus" package—a sweeping legislative initiative designed to harmonize and simplify the General Data Protection Regulation (GDPR) and the Data Act.
The legislative stall, driven primarily by last-minute resistance from key heavyweights Paris and Berlin, means that critical compliance questions—particularly concerning email tracking pixels, device access, and trade secret protections—remain unresolved, leaving businesses and privacy advocates alike in a state of regulatory uncertainty.
1. Main Facts: What is the Digital Omnibus and Why Has It Stalled?
The Digital Omnibus package was conceived to alleviate compliance friction for enterprises operating within the European single market by bridging overlapping, and sometimes contradictory, mandates across major pieces of EU tech legislation. Central to this initiative is the simplification of obligations under the GDPR and the Data Act. However, translating this ambition into a coherent legal text has proven exceptionally difficult.
According to a leaked 163-page draft of the Council text (Document 13886/26, dated October 2, and classified as LIMITE), the legislative framework remains a battleground of competing national interests.
The Core Stumbling Blocks
- The French and German Pushback: The Irish Presidency’s compromise proposal was originally scheduled for review by EU ambassadors at Coreper II on October 7. Under intense pressure from Paris and Berlin, the vote was first postponed to October 11, only to be completely shelved from discussion or voting on the rescheduled date.
- German Trade Secret Concerns: Germany’s primary objection centers on the Data Act’s provisions regarding trade secrets. Berlin is pushing for stringent safeguards, demanding that any sharing of data protected by trade secrets must require an explicit, bilateral agreement between the data holder and the user.
- The Email Pixel Status Quo: Despite high hopes from marketers that the Digital Omnibus might soften restrictions on digital analytics, the leaked draft maintains the strict consent requirements governing email tracking pixels.
2. Chronology of the Stalemate
The path to the current deadlock has been marked by sudden delays and intense diplomatic maneuvering behind closed doors in Brussels.
- November 2025: The European Commission tables its initial proposal, which originally aimed to relocate the regulatory rules governing access to a user’s terminal equipment (device access) out of the ePrivacy Directive and fold them directly into the GDPR.
- September 25, 2026: Industry publications, including emailexpert, highlight proposed cookie consent modifications that threaten to reshape the enforcement landscape for email tracking pixels.
- October 2, 2026: Council document 13886/26 is finalized as a LIMITE text, outlining proposed exemptions to device-access rules and modifying cookie re-prompt timelines, while leaving email tracking pixels explicitly bound to consent regimes.
- October 7, 2026: The Irish Presidency’s proposed compromise fails to reach the Coreper II table after encountering strong objections from France and Germany, forcing a postponement.
- October 11, 2026: The rescheduled vote is abruptly canceled. The text is neither debated nor voted upon, plunging the future of the Digital Omnibus back into legislative limbo.
- October 29, 2026: Looming deadline for national compliance with Italy’s Garante regarding email tracking pixels, proceeding independently of the stalled EU-level legislative overhaul.
3. Supporting Data & Technical Breakdown of the Leaked Draft
While the leaked Council text is not yet public, detailed reporting—most notably from PPC Land—has shed light on the mechanics of the 163-page document.
Device Access and ePrivacy Continuity
In a significant departure from the European Commission’s November 2025 proposal, the Council has dropped the plan to move device-access rules out of the ePrivacy Directive and into the GDPR.
- Article 5(3) Retained: The rules governing the storage or reading of information on a user’s device remain firmly anchored in Article 5(3) of the ePrivacy Directive.
- Consent Definition: Any such storage or access continues to require explicit consent, strictly defined according to the high standards of the GDPR.
- Exemptions Introduced: The draft attempts to inject a degree of pragmatism by outlining a closed list of specific technical purposes that would be exempt from the consent requirement. However, these carve-outs are tightly circumscribed and do not extend to standard commercial tracking practices.
Enforcement Shift
Under the proposed text, the enforcement architecture would undergo a notable centralization. GDPR supervisory authorities (data protection authorities) would be designated to enforce device-access rules across every EU member state. This shifts authority away from national telecoms or consumer protection regulators in jurisdictions where those bodies previously held primary responsibility.
The Timeline Contradiction
Legal experts analyzing the leaked text have flagged a glaring internal contradiction regarding implementation timelines:
- Member states would theoretically be granted 24 months to formally transpose the ePrivacy changes into national law.
- Simultaneously, the text dictates that specific portions of the regulation will apply a mere six months after publication.
The draft currently offers no reconciliation for how these conflicting deadlines can run concurrently, adding further anxiety for legal compliance teams.
4. Official Responses and National Regulatory Pressure
While Brussels negotiates at a snail’s pace, individual EU member states are refusing to wait for a centralized European consensus, aggressively pushing forward with their own national interpretations and enforcement deadlines.
The Email Tracking Pixel Crackdown
Email tracking pixels—tiny, invisible graphic files embedded in marketing emails to track open rates, read times, and user locations—fall squarely under the scope of Article 5(3) of the ePrivacy Directive. Because the leaked Council text preserves these consent requirements, national data protection authorities feel emboldened to press ahead with aggressive enforcement:
- France: In April, France’s data protection authority, the CNIL, published definitive guidance clarifying that email tracking pixels require prior user consent, as highlighted by the Federation of European Direct and Interactive Marketing (FEDMA).
- Italy: Italy’s data protection authority, the Garante, has drawn a hard line in the sand, establishing October 29 as the definitive compliance deadline for businesses operating within its jurisdiction.
The Limits of Audience Measurement Exemptions
The draft text does include limited exemptions—such as for first-party audience measurement. However, this exception is strictly limited to anonymous, aggregated figures generated directly by a service provider (or an agent acting on their behalf) where data is never shared, pooled, or combined with other datasets.
For the email marketing industry, this exemption provides little comfort. Per-recipient open tracking, which is fundamentally utilized for granular audience segmentation, personalization, and automated re-engagement campaigns, does not produce anonymous, aggregated statistics. Consequently, individual tracking remains firmly in the regulatory crosshairs.
Crucially, reports on the leaked Council text indicate no proposed amendments to Article 13 of the ePrivacy Directive, which governs unsolicited electronic marketing communications (spam rules).
5. Implications for Businesses and the Future of EU Tech Law
The ongoing deadlock over the Digital Omnibus carries severe implications for businesses, legal compliance officers, and software developers operating within the European Union.
1. Persistent Regulatory Fragmentation
The primary goal of the Digital Omnibus was to simplify the European digital rulebook. By failing to reach an agreement, the EU perpetuates a fragmented legal landscape. Businesses must continue navigating a labyrinth of overlapping, sometimes contradictory national enforcements, where local regulators interpret directives independently—as demonstrated by Italy’s fast-approaching October deadline.
2. Operational Paralysis for Email Marketers
Email marketers face an increasingly hostile regulatory climate. Without legislative relief from Brussels, the widespread practice of tracking email engagement via pixels is effectively restricted unless explicit, granular consent is captured upfront. This threatens to break standard automated workflows, lead-scoring models, and email performance metrics across the board.
3. The Long Road Ahead
It is important to emphasize that the leaked Council document is far from final. Even if the Council of the European Union eventually manages to hammer out a unified internal position—likely requiring further concessions to Paris and Berlin—the legislative process is far from complete.
The European Parliament has yet to adopt its own official stance on the Digital Omnibus package. Once both the Council and the Parliament finalize their respective positions, they must enter into arduous "trilogue" negotiations with the European Commission to forge a final, legally binding compromise text. Until that lengthy process concludes, European digital compliance will remain trapped in a state of high-stakes ambiguity.
