Last week, the Digital Omnibus Regulation proposal was discussed in the media. The adoption of this document will have a significant impact on web analytics. If web data is important to you, you should pay attention to it.
Digital Omnibus is being prepared as an EU regulation. This means that it will apply to all member states equally, without them having to incorporate it into their own legislation (it is the same as GDPR).
What follows from the regulation
The regulation covers many areas, such as AI. In my opinion, the following points will likely have the greatest impact on web analytics:
Analytics without consent, but…
Yes, you will probably be able to collect data for analytics even without consent. But beware, only if several conditions are met:
- the data will be measured solely for the needs of the service provider
- the data will be used solely for analytical purposes
- the data will be aggregated—i.e., it will not be possible to display information about the behavior of a specific person
If you have a simple analytics tool on your own hosting or a paid analytics tool (which aggregates data), you probably won’t need to ask for consent at all.
It is not clear to me what exactly aggregation will mean—whether it is sufficient when displaying data, or whether the source data also needs to be aggregated in some way. And whether it will be possible to measure longer conversion paths without consent. All this will depend on the implementing acts.
On the other hand, it is clear that data collection for personalization or marketing remains subject to consent.
And what about Google Analytics 4? Here, it will be difficult to prove that only you are using the measured data. In other words, Google is positioning itself as an altruistic ascetic who kindly provides a measurement tool but does not use the data itself, even though it would very much like to. Hmm?
I estimate that this will significantly increase the demand for alternatives to GA4.
The consent status can be read from the browser settings.
I imagine that your browser will ask you what purposes you want to give automatic consent to. You will only use classic cookie bars when you use a different type of consent on the website than the browser itself supports.
In addition to the browser, the consent status should also be readable from the EU digital wallet or other locations. The EU is preparing a specification according to which these consent tools will be transferred.
Personally, I expect this to lead to a reduction in the opt-in rate and thus to a reduction in measurement accuracy.
You will have to respect the choice set in the browser. That is, if a person sets “decline” in their browser, you must not ask them the same question by displaying a cookie bar.
If you run a news or media website and advertising revenue is crucial to your independence, you will be covered by the exception. However, you must meet a number of requirements. The EU is thus seeking to support independent journalism.
Cookie bar behavior
The regulation mentions several things regarding cookie bars, which I already consider to be good practice:
- If a person does not give their consent, you should not ask them for the same purpose for at least another 6 months.
- It must be possible to refuse consent in a simple and understandable manner by means of a single-click button or equivalent means.
When will it come into effect?
The regulation is still in the draft stage and may be subject to change. We can expect that
- it will be submitted to the European Commission for official approval in the near future,
- followed by the standard legislative process,
- and then there will be a deadline for implementation.
Personally, I estimate that it will be implemented sometime in mid-2026.