EU Council seeks fewer cookie banners and new incident reporting

The Council of the European Union adopted its position on simplifying the digital rulebook on 21 October. The draft would amend parts of the GDPR, e-privacy and cyber incident reporting. For Hungarian companies and public bodies, the changes could mean fewer overlapping reports and clearer compliance duties, but parliamentary negotiations still lie ahead.

The Council release says more cookie uses would not require consent, including cases necessary to provide a service, measure audiences or secure a user’s device. The deadline for reporting personal-data breaches would be extended. Each member state would establish a national entry point for cyber and data incidents, supported by an EU-level information point.

The Council has not adopted final law; it now holds a negotiating mandate. Talks can begin only after the European Parliament adopts its own position. The next material step is Parliament’s mandate and then a common text. Our related reports cover the AI compliance standard and EU–Ukraine cyber cooperation.