Uliana Lesiv
AuthorKey takeaways:
Digital Omnibus is a list of proposals aimed at amending data regulations. The European Commission published the Digital Omnibus Regulation Proposal in November 2025. It introduces amendments across the EU's data protection, data sharing, and cybersecurity regulations to eliminate overlapping requirements and provide clearer guidance on how these rules interrelate.
Please note:
| Proposal | Description |
| Modernizing cookie and tracking rules | The aim is to reduce “consent fatigue”. The proposal introduces a “single-click” reject option - a mechanism for automated and machine-readable consent choices (e.g., via web browser or app settings). The exception: Media service providers (e.g., national newspapers' websites, TV channels' video platforms) could maintain direct interaction with users on consent choices. |
| Lawful basis for AI | Amendments to clarify the definitions of "personal data" and "scientific research" to simplify the legal basis for processing data to build and run AI systems. |
| "Report Once, Share Many" principle | The creation of a single-entry point for security incident reporting managed by ENISA. The ENISA would route the data to relevant national authorities. |
| Consolidation of the EU data regulations | The proposal repeals three acts: the Free Flow of Non-Personal Data Regulation (FFDR), the Data Governance Act (DGA), and the Open Data Directive. Certain rules from these acts can be merged into the amended Data Act. Cookie regulations, which are now governed by the e-Privacy Directive, could move into the GDPR. |
| Simplified compliance obligations for Small Mid-Cap companies (SMCs) | Companies with up to 499 employees (or €100 million in turnover) would get simplified technical documentation requirements, limits on fines, and priority entry into regulatory sandboxes. |
For digital marketing specialists and business owners, the Digital Omnibus could provide numerous benefits and simplify data collection/management/processing. On the other hand, if it comes into force, they could face challenges connected with data collection and its security.
| Before starting, it is important to note that the EU Digital Omnibus regulation doesn’t mandate a switch to server-side tracking; this section is aimed at highlighting the challenges the marketers may face and how server-side tracking can help overcome them. |
If the digital package is passed in the form that is currently publicly available, the server-side tracking can help stay in compliance with the regulations while collecting data.
First-party data collection is the key shift that can be noticed over the past years; it has become a trend in digital marketing. The EU's proposed changes, along with trends, push marketers toward switching to server-side tracking. The Digital Omnibus focuses on general data protection regulation mechanisms that client-side tracking struggles to meet without data loss/security vulnerability:
Both principles are required to follow while collecting data, particularly for training AI systems.
Data minimization. The regulations could demand that marketers only collect the minimum data necessary. Client-side tracking isn't a flexible approach to data gathering. Third-party data-collecting scripts can gather all available data (IP address, browser type, device identifiers, etc.) right away. Such an approach violates the principle of data minimization.
Secure data flows. Client-side tracking is vulnerable to browser exploits and man-in-the-middle attacks, as the data is sent directly from the user's browser to third-party services. With server-side tracking, the data is collected and processed in your server environment before it is forwarded to any third-party platform. This reduces the attack surface available to external threats.
We don't know what exact approach will be selected to ensure automated user choice. Still, the thing is clear - business owners can have less impact on the users' consent preferences and the volume of data they collect. In this case, server-side tracking can help keep the balance between data collection and regulation compliance.
A server-side tracking solution provides complete control to comply with signals on consent (by blocking sharing), and at the same time, it can help you achieve higher data accuracy due to bypassing ad blockers and browser restrictions.
Since the implementation mechanism of automated user choice hasn't been published yet, it is just guesswork based on the currently available technologies.
The research states that Global Privacy Control (GPC) can be mapped to the various legal bases for processing under the GDPR and can become a prototype for automated user choice adoption in the EU. Currently, GPC has an explicit legal requirement under laws in the USA (CCPA/CPRA) only.
For now, you can check whether your CMP supports GPC, and you may test how it works for your case. The CMS platforms can have a separate option to activate GPC signal receiving. Another option is a separate toggle to activate compliance with the USA data privacy regulations, for example, as in iubenda:
For the test, you will also need to activate the GPC within your web browser or install a browser extension that sends the GPC signal.
A few browsers currently support GPC: Brave, DuckDuckGo Browser, and Mozilla Firefox. For other browsers, you can use extensions such as Privacy Badger, OptMeowt, and Dedicated GPC Enabler.
Configuring server-side tracking is a good strategy to follow before the EU Digital Omnibus rollout. Although it may have additional adjustments, the commitment to safeguarding the fundamental rights of website users will be preserved.
Collecting and processing data in a secure server environment is the most effective way to implement the mandatory data minimization and protection rules required for AI datasets. Server-side tracking helps filter, pseudonymise, and protect sensitive data from leaking. In addition, with its help, you can track more data while staying compliant (server-side tracking allows you to minimize the impact of ad blockers and browser restrictions).
With server-side tracking, a cloud server acts as a proxy between your website and any third-party tools. Your site sends data to the cloud server first, and the server then forwards that data to third-party vendors and tracking platforms.
Stape provides hosting for server GTM containers as well as numerous solutions to smoothly implement server-side tracking. Check our guides to get deeper into the topic of server-side tracking and decide if it works for you:
The Digital Omnibus is still at the proposal stage, but political and economic factors suggest that reforms in EU data collection and processing rules are on the horizon.
The European Commission views the Omnibus as a necessary step to reduce the “compliance thicket” created by existing regulations. It is seen as limiting European businesses and preventing competitiveness with the US and Asia in fields like AI.
The exact amendments and their timing are unknown, but some of the currently published proposals will likely come into force. Businesses and marketers should be ready to meet the changes, understanding both the opportunities they may offer and the challenges they can bring.
Comments