Digital Omnibus: What you need to know & steps before rollout

Digital Omnibus is a list of proposals aimed at amending data regulations. The European Commission published the Digital Omnibus Regulation Proposal in November 2025. It introduces amendments across the EU's data protection, data sharing, and cybersecurity regulations to eliminate overlapping requirements and provide clearer guidance on how these rules interrelate.

For digital marketing specialists and business owners, the Digital Omnibus could provide numerous benefits and simplify data collection/management/processing. On the other hand, if it comes into force, they could face challenges connected with data collection and its security.

• Eliminate the need for cookie banners. If a mechanism for automated consent choices via web browser/app settings were implemented, there would be no need for adding cookie banners for every website. The reason for such a move: cookie banners are annoying for website users (according to research published on ResearchGate, most find banners annoying, but prefer having choices - 88% expect at least one opt-out option). If the banner is poorly designed, behavioral metrics (such as time on page, bounce rate) can drop. Creating automated user choices can remove such a problem for website owners.

• Accelerate the development of artificial intelligence systems. Providing the legal basis for data processing by AI could accelerate and simplify systems development for marketing purposes (audience segmentation and/or running personalized marketing campaigns).
• Unified security incident reporting. For businesses dealing with security or data breaches, it should be easier to report cybersecurity incidents. If a Single Entry Point (SEP) is adopted, the companies would submit one report to a central EU portal. No need to submit separate, overlapping notifications under different regulations, which reduces administrative work.
• Easier to conduct business operations. The digital wallets, as part of the EU Digital Omnibus, would accelerate cross-border business operations, simplify paperwork, and save money for European companies by reducing administrative burdens.
• The simpler EU digital rules. Instead of managing compliance across four regulations, businesses could primarily focus on two regulations: the GDPR (for personal data) and the amended Data Act (for non-personal and organizational data). This reduces the complexity of legal mapping and internal compliance checks.

• Lower impact on user consent and potentially reduced volume of data collected. With cookie banners, website owners could test different options to increase the consent rate; they had direct influence on the cookies that visitors can accept. If the users pre-define (via web browser or app settings) the cookies they reject, these selections will be applied to all websites they visit, and the companies can end up collecting less data.
• Protection of sensitive personal data. Developing general-purpose AI models can become simplified, but at the same time, data collection, storage, and usage requirements could be more challenging to comply with. The requirements for European companies or those aiming at the EU market include respecting data minimization during the source selection, training, and testing of the AI system; implementing protections against the non-disclosure of retained data in the system; and providing transparency to data subjects.
• Technical compliance with automated user choices. Although the Digital Omnibus proposal doesn't provide the standardized requirements on how automated user choice should technically be implemented on the website's side, there are assumptions that it could work similarly to the Global Privacy Control (GPC). Currently, not all Consent Management Platforms (CMPs) support GPC, so business owners may face difficulties implementing them to receive a signal on user consents.

If the digital package is passed in the form that is currently publicly available, the server-side tracking can help stay in compliance with the regulations while collecting data.

First-party data collection is the key shift that can be noticed over the past years; it has become a trend in digital marketing. The EU's proposed changes, along with trends, push marketers toward switching to server-side tracking. The Digital Omnibus focuses on general data protection regulation mechanisms that client-side tracking struggles to meet without data loss/security vulnerability:

• Data minimization
• Secure data flows

Both principles are required to follow while collecting data, particularly for training AI systems.

Data minimization. The regulations could demand that marketers only collect the minimum data necessary. Client-side tracking isn't a flexible approach to data gathering. Third-party data-collecting scripts can gather all available data (IP address, browser type, device identifiers, etc.) right away. Such an approach violates the principle of data minimization.

Secure data flows. Client-side tracking is vulnerable to browser exploits and man-in-the-middle attacks, as the data is sent directly from the user's browser to third-party services. With server-side tracking, the data is collected and processed in your server environment before it is forwarded to any third-party platform. This reduces the attack surface available to external threats.

We don't know what exact approach will be selected to ensure automated user choice. Still, the thing is clear - business owners can have less impact on the users' consent preferences and the volume of data they collect. In this case, server-side tracking can help keep the balance between data collection and regulation compliance.

A server-side tracking solution provides complete control to comply with signals on consent (by blocking sharing), and at the same time, it can help you achieve higher data accuracy due to bypassing ad blockers and browser restrictions.

Since the implementation mechanism of automated user choice hasn't been published yet, it is just guesswork based on the currently available technologies.

The research states that Global Privacy Control (GPC) can be mapped to the various legal bases for processing under the GDPR and can become a prototype for automated user choice adoption in the EU. Currently, GPC has an explicit legal requirement under laws in the USA (CCPA/CPRA) only.

For now, you can check whether your CMP supports GPC, and you may test how it works for your case. The CMS platforms can have a separate option to activate GPC signal receiving. Another option is a separate toggle to activate compliance with the USA data privacy regulations, for example, as in iubenda:

For the test, you will also need to activate the GPC within your web browser or install a browser extension that sends the GPC signal.

A few browsers currently support GPC: Brave, DuckDuckGo Browser, and Mozilla Firefox. For other browsers, you can use extensions such as Privacy Badger, OptMeowt, and Dedicated GPC Enabler.

Configuring server-side tracking is a good strategy to follow before the EU Digital Omnibus rollout. Although it may have additional adjustments, the commitment to safeguarding the fundamental rights of website users will be preserved.

Collecting and processing data in a secure server environment is the most effective way to implement the mandatory data minimization and protection rules required for AI datasets. Server-side tracking helps filter, pseudonymise, and protect sensitive data from leaking. In addition, with its help, you can track more data while staying compliant (server-side tracking allows you to minimize the impact of ad blockers and browser restrictions).

With server-side tracking, a cloud server acts as a proxy between your website and any third-party tools. Your site sends data to the cloud server first, and the server then forwards that data to third-party vendors and tracking platforms.

Stape provides hosting for server GTM containers as well as numerous solutions to smoothly implement server-side tracking. Check our guides to get deeper into the topic of server-side tracking and decide if it works for you:

• What is server-side tracking?
• Server-side tagging vs client-side tagging
• Server-side tracking benefits: what it is and why it matters
• Benefits of Stape hosting for the server Google Tag Manager

The Digital Omnibus is still at the proposal stage, but political and economic factors suggest that reforms in EU data collection and processing rules are on the horizon. 

The European Commission views the Omnibus as a necessary step to reduce the “compliance thicket” created by existing regulations. It is seen as limiting European businesses and preventing competitiveness with the US and Asia in fields like AI. 

The exact amendments and their timing are unknown, but some of the currently published proposals will likely come into force. Businesses and marketers should be ready to meet the changes, understanding both the opportunities they may offer and the challenges they can bring.