European publishers say the Digital Omnibus ‘cookie fix’ leaves them worse off
By Jessica Davies • December 5, 2025 •
Ivy Liu
European publishers are feeling pretty grim about the outcome of the Digital Omnibus, released on Nov. 19.
For a moment, the European Union’s attempt at a legislative spring clean for Europe’s digital rulebook dangled a few carrots of hope by signaling it might finally simplify Europe’s tangled maze of data privacy rules.
But for publishers, the outcome amounts to little more than ineffective window dressing. Several have described the Omnibus as nothing deeper than a “cosmetic” attempt to fix the complex rules around how to gain consumer consent for digital tracking needed to sustain digital businesses.
Many are still trying to understand what the Omnibus actually means for them. (Spoiler: it apparently means nothing more than your job may actually get harder). But it’s clear that those who have managed to ingest the detail (all 153 pages of it) see little that can help publishers move the needle. In fact, it’s made things even worse. It certainly doesn’t help them with revenue and challenges, or the practical realities of running ad-funded businesses, they say.
“I don’t see that we — publishers — are getting anything out of the Omnibus, and even less in the way of ‘simplification’ which is the stated purpose for revising the rulebook,” said Iacob Gammeltoft, senior policy manager at News Media Europe, an association that represents over 2,700 news brands across Europe. Instead, a bunch of new rules have been added and publishers are now startlingly “worse off” than before, he stressed.
One of the most worrying factors: Under the Digital Omnibus proposal, users can set their tracking and cookie permissions once, directly in their browser or device settings — so in Chrome, Safari, Firefox, or on iOS/Android. That’s a mega red flag for publishers that rely on consent-driven data to sell ads, measure performance and fund free content.
Here are two parts of the Digital Omnibus’ plans that have frustrated and confused publishers:
The Omnibus pitch: Browser-level consent settings
It lets users set tracking preferences once in their browser or device, and oblige every website to honor those choices.
Reality for publishers:
They’ve just moved the yes/no button. If most users toggle “no tracking” at browser level, that’s a near-permanent opt-out across the web.
Bert Verschelde, director of privacy at DPG Media, believes this additional browser control could be disastrous for publishers. “We know that consent rates are heavily impacted by the exact UI design of consent requests, but if Apple’s ATT is anything to go by, this could mean that as many as 75 percent of EU browsers will reject all targeted ads across the web by default,” he said. “This will ultimately benefit the walled gardens, who have a high logged-in reach and do not rely on cookie consent for their targeting.”
While the Digital Omnibus suggests that media services and publishers might get an exemption from centralized, browser-led cookie settings, publishers doubt this will work in practice. “It would require ad tech companies to decide who is a media service provider under the European Media Freedom Act [and] what qualifies for this exemption to make sure they are not in a legal red zone and liable for GDPR breaches when doing business,” said Gammeltoft. In a nutshell, that means if an ad tech vendor gets that classification wrong, they risk exposing themselves and the publisher to GDPR violations. Ad tech vendors aren’t likely to want to make that call, he noted, leaving publishers in a legal gray area. “This will create problems for publishers,” he added.
Verschelde has lambasted the Omnibus on LinkedIn, writing that “The EU’s cookie fix is 20 years old and still misses the point.” In the comments to that post, other publishers noted that different browsers would have wildly varied incentives when it comes to the consent levels within their ecosystems and therefore the way they implement this. Plus, this strips publishers of their ability to obtain consent directly from their own users — harming their business.
The Omnibus pitch: One-click consent/reject
Under GDPR/ePrivacy rules, a one-click action is required for non-essential cookies. But the implementation of this has often led to multiple-layered menus or inconsistent design across websites. The Omnibus aims to reduce this chaotic and inconsistent user experience, via a one-click consent or reject-all cookies button.
Reality for publishers:
Publishers had been energized by the thought of an end to the consent walls that have gone up throughout Europe, and reduced traffic. But they don’t see that the Omnibus has helped address this after all.
Instead, the worry is that the one-click almost guarantees lower consent rates, meaning less usable data. And that it will be harder to run even low-risk tracking needed for things like measurement, frequency capping and fraud detection.
Consent requirement is simply being shifted from ePrivacy directive into GDPR, but the consent requirements remain there, noted Gammeltoft. “What does that really change? Apart from the fact that we now have additional consent management requirements relating to having a reject-all button and a cap on the frequency with which we can ask for users to consent,” he said. He added that there is an exception given to audience measurement cookies, which he said could be useful in theory, but that the language around it is unclear, so it’s hard to determine how it can be used in practice.
In theory, moving consent choices into the browser should simplify life for users and publishers. In practice, the core logic of EU privacy enforcement around online ads stays almost exactly where it was — and that’s what has publishers worried.
“Sadly, changes appear to be fairly cosmetic; they don’t really put publishers in a better position; big tech will still have way easier access to data via their closed ecosystems, whereas publishers will have to ‘fight’ to get data on the open internet,” said Thomas Lue Lytzen, director of ad sales and tech at Danish tabloid Ekstra Bladet. “The formalized consent requirements and browser-controlled consent only limit publishers’ choices even more and hand over power to browsers,” he added.
