EU Draft Reduces Cookie Consent Re-prompt Window to 4 Months

A draft mandate for the Council of the European Union in document 13886/26, dated October 2, 2026, spanning 163 pages, proposes amending Article 5(3) of the ePrivacy Directive so that users have the right to refuse consent requests "in an easy and clear manner via a one-click button or an equivalent mechanism." The amendment stipulates that in the event of refusal, "the provider may not submit a new consent request for the same purpose for a period of at least" four months, compared to six months in the European Commission's proposal, representing a reduction of about one-third.

The text also changes breach notification rules, limiting notifications to cases "likely to result in high risks" instead of broad reporting, and extending the deadline from 72 hours to no more than 96 hours from the moment of learning about the breach, provided that notification is subsequently conducted via a single entry point managed by the European Union Agency for Cybersecurity. Furthermore, the text designates the national data protection supervisory authority responsible for enforcing tracker rules, granting member states 24 months to transpose the directive into national legislation.

The draft amends eight laws, including the European General Data Protection Regulation, the ePrivacy Directive, the Data Act, and the Cybersecurity Directive, and asks the Permanent Representatives Committee to approve the negotiation mandate text to bargain with the European Parliament under file 2025/0360. The committee's meeting on October 7 ended without a vote on the Data Act file, and ambassadors are expected to decide on the matter on Sunday, October 11, with the agreed mandate text to be published unless the committee objects.

This means that advertisers and publishers targeting a European audience may face re-requesting consent every four months instead of every six, raising the frequency of consent dialogues and making refusal management more recurrent. The text also offers clearer recognition of contextual advertising based on page content, while extending the breach notification deadline gives companies more time to classify the incident. However, the draft remains a negotiating mandate and has not yet become enforceable law.

What do these terms mean?

Negotiation Mandate (Mandate): An authorization granted by the Council of the European Union to its Presidency to negotiate with the European Parliament on behalf of member states, setting the ceiling of acceptable terms.

Cookies: Small files stored by a website in a user's browser to track behavior and remember choices between visits.

ePrivacy Directive: A European framework regulating privacy in electronic communications, under which rules for tracking file consent fall.

Breach Notification: The obligation for an entity to notify the regulatory authority when a data breach occurs that could cause harm to individuals, within a specified timeframe.