The Digital Omnibus is sold as a simplification. But it also builds in a kill switch on European ad-funded media and small businesses.
The final touches of the Digital Omnibus (COM(2025) 837) are currently being negotiated in the Council, which would insert new provisions into the GDPR to end the “banner fatigue” and streamlining consent by allowing websites to rely on user consent expressed at the level of the operating system (OS) or browser.
Firstly, Article 88a (according to the GDPR numbering) would set out a narrow whitelist of processing that requires no consent and specify how consent must be requested when required. Meanwhile, another article – the controversial Article 88b – sets out how consent, refusal, and objection are to be expressed through “automated, machine-readable means” – such as browser settings, the OS user profile, or the EU Digital Identity Wallet (eIDAS 2.0).
In effect, the proposed Article 88b designates a substrate layer of US tech giants’ operating systems as a “user-choice” infrastructure. These firms then take over mediating identity and consent on behalf of the entire open web. Once user consent is given (or rejected) at the browser or OS level, it is reused everywhere else for publishers and services on the open web, who are removed from negotiating user consent.
This browser or device-level consent rejection is a collective, upstream denial that undermines the privileged relationship between the users and downstream European businesses.
Gatekeepers Above All Other Gatekeepers
However well-intended the Digital Omnibus may be, the proposed Article 88b is a radical reversal of the EU data regulation regime that set out to favour EU media and businesses. Europe’s attempt to reshape the markets culminated in regulations such as the Digital Services Act (DSA) and the Digital Markets Act (DMA), which imposed requirements on gatekeepers and very large online platforms (VLOPs), using carefully calibrated thresholds for user numbers and turnover.
While the Digital Omnibus discussions are portrayed as being about “advertising and cookies”, the real issue is whether European SMEs can reach new customers, to measure what works and learn from their mistakes. Advertising remains also the primary financing mechanism for local media, which is intrinsically linked to linguistic and cultural diversity. Smaller publishers, such as regional and local-language media, are already operating on narrow margins and depend more on advertising-funded models, as their markets or languages are too small for subscription-based models.
In that regard, the proposed Article 88b will inevitably transfer revenues from a business model that sustains culturally diverse and pluralistic digital media to OS and browser developers. In April 2021, iOS 14.5 introduced App Tracking Transparency (ATT), which required apps to get advertising consent via a system prompt controlled by Apple, an opt-in that most iPad and iPhone users declined. Downstream apps and services lost nearly $10 billion in ad revenue during the second half of 2021, while Apple’s own services business reached $18.3 billion in just one quarter. Italy’s antitrust authority also ruled against ATT as an abuse of dominant position.
This is exactly the structural shift that – if adopted – Article 88b would impose on all online activities in Europe.
What the European Players Want
The Commission and the Council seem to recognise that the proposed Article 88b harms advertising-funded media and propose a carve-out for media service providers under Article 88a(3).
But according to the EU media industry, these exceptions (pegged to the European Media Freedom Act definitions) are unrealistic. A coalition of broadcasters, publishers, and ad-funded media from EBU, EGTA, and EPC has issued a joint statement urging the co-legislators to delete Article 88a(4) and Article 88b of the GDPR, which limit the ability to seek users’ direct consent.
Another open letter by 46 European publishers and tech firms warns that these amendments in the Digital Omnibus “risk achieving the opposite outcome.” Such sentiments are echoed by a group of European start-ups who warn that “proposed browser-level consent mechanism would make things worse, not better,” and that a dual regime – one under the GDPR and another under the E-Privacy Directive – “only adds complexity at precisely the moment Europe has committed to reducing it.”
Understandably, some Member States have called for the deletion of Article 88b on similar antitrust grounds. The European media industry also rightly questions whether a uniform browser signal constitutes sufficiently specific consent as stipulated by Article 4(11) of the GDPR, presaging many years of cross-litigation between data protection authorities, industry actors, user groups, and EU institutions, with uncertain outcomes.
In other words, European media and SMEs – the intended beneficiaries of simplification – are asking the Digital Omnibus train to stop.
Moreover, the Digital Fairness Act (DFA), which is expected to be published later in 2026, may include further restrictions on online advertising, such as a second prompt at the service level to opt out of personalised advertising. If Article 88b and the DFA were to operate in tandem, open-web players would first see their user base filtered for the sake of “simplicity” under the Digital Omnibus, and the remaining users would be filtered again, since the DFA views personalisation as inherently harmful. All this while the browser- or OS-based ecosystems (whose targeting relies on first-party data within its own walls) never meet either filter.
This is Not an Exit
The proposed articles currently under the Council’s final deliberations aim to address a user experience problem: too many banners and too much mindless clicking. But it does so with a Faustian trade-off that hands unprecedented market powers to a limited number of browsers and operating systems. If the DMA was designed to constrain gatekeepers from exploiting critical bottlenecks, the proposed Article 88b reassigns them as legally sanctioned bottlenecks in consent and identity management.
And if the European ad-based businesses are stifled, the surviving model is subscription, which primarily works in major European markets or languages with scale. But even subscription-based models rest on persistent identity, authentication, and billing, and these sit at the device and OS layers as well, where operating systems or app stores take a cut.
While some competitors may try to develop their own devices or browsers if the proposed amendments pass, European players are unlikely to succeed in such endeavours. More importantly, a European publisher that moves to a paywall does not automatically create an ecosystem. Instead, it develops a billing dependency on an OS.
In other words, the exit from the Digital Omnibus trap is built and tolled by the owner of the same trap.