ACT Position Paper on the Digital Omnibus
Download the document
Brussels, 12 March 2026. The ACT strongly supports the Commission’s simplification agenda. Legal uncertainty and excessive compliance burdens undermine investment in European content and services.
Audiovisual media services (AVMS) rely on cookies and personal data for a number of use cases ranging from core service delivery to advertising and monetisation. For reference, advertising represents 23.5 bn euros of commercial AVMS revenues in the EU[1] and targeted advertising represents an increasingly important share of this figure. There is real value in a Digital Omnibus that delivers pragmatic clarifications, provided the focus remains on targeted simplification rather than wholesale reform.
We welcome the shift to a unified GDPR framework and the recognition of media’s special role in Article 88b(3). However, the proposals on cookies and consent in articles 88a and 88b GDPR create an imbalanced framework that may ultimately harm Europe’s media ecosystem.
The proposal creates a dual challenge: First, Article 88a(3) establishes a closed list of exemptions that is too narrow and fails to adequately reflect the legitimate, low-risk processing activities essential to audiovisual media services’ operations and business models. Second, Article 88a(4) introduces severe restrictions on how consent may be requested, notably requiring one-click rejection mechanisms and prohibiting follow-up requests for six months. Together, these restrictions would make it harder for media companies to legally process data essential to service monetisation and operation.
While Article 88b(3) exempts media service providers from automated consent signals, this addresses only one dimension of a broader structural problem. The combination of overly narrow exemptions and restrictive consent requirements will make it difficult, if not impossible, for media companies to legally process data essential to their services – particularly for targeted advertising and audience measurement.
As it stands, the digital omnibus does not bring simplification when it comes to cookies, but rather risks creating an environment that would cement the position of dominant platforms while undermining the sustainability of Europe’s diverse media landscape.
ENSURING CONSENT REMAINS A VIABLE LEGAL BASIS
The six-month consent request ban undermines media monetisation
Article 88a(4) prohibits controllers from requesting consent for the same processing purpose within six months after a data subject has refused consent, unless there is a relevant change in processing activities. While intended to reduce consent fatigue, this restriction would severely limit media services’ ability to engage with viewers over time.
Viewers’ circumstances, preferences, and willingness evolve. A viewer who initially refuses consent may reconsider to access specific content (e.g., a football game, new movies, or specific journalistic coverage), after a change in their personal situation, or after better understanding the value exchange. A rigid six-month prohibition prevents media companies from responding to these natural shifts in user preferences and effectively locks in refusals in a way that is neither proportionate nor beneficial to viewers themselves.
Furthermore, this creates friction whereby viewers cannot access content but media companies cannot prompt them to reconsider. Instead, the framework should allow consent requests at proportionate intervals taking into account viewers’ needs and the evolution of services over time.
Centralised consent mechanisms favor dominant platforms
Article 88b requires controllers to respect automated, machine-readable consent signals transmitted through browsers once technical standards are established. This framework establishes a default architecture favoring large platforms and browser providers – entities controlling consent infrastructure who are themselves major digital advertising players. This directly conflicts with the Digital Markets Act’s objectives to limit gatekeeper power.
The framework enables browser providers to interpose themselves between media companies and audiences, instrumentalising privacy protections to reinforce market dominance. It is also difficult to reconcile GDPR consent criteria -which require specific, informed consent – with universal browser signals that are by definition general and decontextualised.
Recognising and supporting media’s special role
We welcome the recognition of the important role of journalism, the media and its economic sustainability for democracy, as well as the importance to “not undermine the possibility for media service providers to request consent by data subjects”.
Audiovisual media services are the lead investors in European journalistic and entertainment content. They are also among the most trusted media sources resulting in higher-than-average opt-in levels. It is therefore essential that media companies retain the ability to engage directly with their audiences to request consent.
Given the central role that consent would continue to play in the updated framework – particularly for the personalisation of content and advertising – the changes proposed in articles 88a and 88b raise significant concerns for the sustainability of media business models.
While Article 88b(3) currently exempts media service providers, the exemption’s durability through the legislative process is uncertain. More fundamentally, the Commission’s recognition of media’s special role should extend beyond this single carve-out. It could also cover for instance Article 88a(4) and certain processing activities essential to AVMS operations.
To preserve viable consent mechanisms for media services, we recommend to :
- Generally reject centralised consent architectures
- Preserve and broaden the special status for media throughout the legislative process, particularly if the centralized consent approach is maintained
- Remove or significantly relax the six-month prohibition and/or introduce more flexibility to take into account changes in services, at least for media service providers
- Explicitly confirm that media services may make access to content conditional on consent
AUDIENCE MEASUREMENT
As recognized in the European Media Freedom Act, audience measurement is crucial for the media sector. AVMS depend on meaningful and comprehensive measurement for many reasons, including advertising allocation, pricing, purchases or sales, as well as understanding audiences, editorial planning and supporting the development of innovative and appealing services.
The exemption foreseen in Article 88a(3)c is therefore welcome. However, it is defined too narrowly. In most European markets, audience measurement is organised through well-established industry frameworks such as Joint Industry Committees (JICs) or Media Owner Committees[2] and, importantly, carried out by third-parties. This point is important because it ensures the independence of the measurement.
CLEAR EXEMPTIONS FOR LOW RISK AND PRIVACY ENHANCING ESSENTIAL DATA PROCESSING
The list of purposes for which processing is permitted without consent is too narrowly defined and fails to adequately reflect the legitimate, low-risk processing activities essential to audiovisual media services’ operations and business models.
Currently, different countries and different regulators take different views as to when and for what purposes consent is necessary or when an exemption applies. The work of the EDPB has not been particularly helpful in this matter. We would therefore welcome a scenario where we have clearer rules (i.e. clearly defined exemptions) for all countries and players. In this regard, we would encourage policy-makers to take inspiration in the useful work of the ICO[3] on the matter.
A useful step would be the creation of a “white list” of essential, low-risk use cases typically exempt from the consent requirement. Such an approach would avoid unnecessary consent requests for benign technical and necessary processes, allowing the deployment of privacy-preserving technologies, while provide clarity and legal certainty for audiovisual service providers. This could take the form of a dedicated recital, elaborating on the exemptions foreseen in Article 88a. EDPB guidelines elaborated in partnership and collaboration with the industry could create further legal certainty. This would be in line with the spirit of other provisions in the digital omnibus such the as the EDPB task to prepare a list of high risk processing activities for which data protection impact assessments are required. Many of the bellow following currently fall within the “strictly necessary for a service explicitly requested by the user” exemption in Article 5(3), or to a certain degree legitimate interest, but explicit clarification would facilitate the assessment of appropriate legal basis in a GDPR-only context.
[1] EAO, Yearbook 2025.
[2] These bring together media, advertisers, agencies and independent measurement providers, and rely on audited and widely trusted methodologies across linear and digital environments.
[3] https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/