Client Alert | November 18, 2025
While its final shape is subject to change, the Digital Omnibus is expected to introduce far-reaching amendments that would impact core data protection principles and obligations.
1. Executive Summary
Draft versions of the European Commission’s forthcoming Digital Omnibus Package (Digital Omnibus) have recently become publicly available ahead of the official presentation scheduled for 19 November 2025. The initiative marks one of the most wide-ranging overarching revisions of the EU’s digital regulatory framework since the General Data Protection Regulation (GDPR) entered into application in 2018. The Commission positions the Digital Omnibus as a competitiveness-driven simplification effort aimed at reducing administrative burdens and compliance costs, improving legal certainty for businesses, and making the EU’s digital rulebook easier to navigate.
While its final shape is subject to change, the Digital Omnibus is expected to introduce far-reaching amendments that would impact core data protection principles and obligations.
2. Background and Target Areas
The Digital Omnibus follows increasing feedback from the European business community that the EU’s digital regulatory landscape has become fragmented and difficult to navigate. Similar recommendations were set out in the 2024 Draghi Report, which called for measures to strengthen EU competitiveness, foster innovation, and simplify regulatory requirements.
In response, the Commission has prepared two legislative proposals that together would amend multiple EU digital regulations in parallel, including the GDPR and the recently issued AI Act. According to the available draft texts and preparatory materials, the Digital Omnibus revolves around three main regulatory areas: data, cybersecurity, and artificial intelligence.
3. Key Proposals
The draft proposals cover a broad range of regulatory issues, ranging from personal-data processing and consent management to the governance of AI systems and related compliance obligations. Set out below are selected aspects that are of particular relevance for businesses operating in the EU digital market.
a. Consent Fatigue and Cookie Rules – Toward Recognition of Automated Signals
According to the recitals, the Commission intends to address so-called “consent fatigue” by revising the rules on cookies and similar tracking technologies. The Digital Omnibus proposal pursues a two-part approach: first, by broadening the situations in which cookies and comparable technologies may be used without consent, extending the current exceptions under the ePrivacy framework to include additional purposes such as security, audience measurement, and the provision of user-requested services[1]; and second, by introducing a mechanism for the automated and machine-readable expression of user preferences, designed to reduce the need for repetitive consent banners.[2] Controllers would be required to respect such automated signals once corresponding technical standards are adopted.
b. AI Training and Operation – Legitimate Interest as Legal Basis
The Digital Omnibus proposal introduces a new provision under the GDPR[3] establishing that the development and operation of AI systems or models constitutes a legitimate interest of the controller for the purpose of processing. In essence, the Commission is carving out AI-training and usage as a recognized legal basis for companies, provided that the processing of personal data is necessary for that purpose and such interest is not overridden by the rights and freedoms of individuals. If confirmed, this change would mark the end of an ongoing debate within the EU over whether legitimate interest can lawfully underpin AI model training, and would even go beyond that to include the operation of AI systems as well.
c. Automated Decision-Making (ADM) – Clarifying the Exemptions
The GDPR currently provides individuals with a qualified right not to be subject to solely automated decisions that have legal or similarly significant effects (Article 22 GDPR), subject to three limited exemptions: where the decision is necessary for entering into or performing a contract, authorised by law, or based on explicit consent. The Digital Omnibus proposal would amend the contractual exemption by clarifying that an automated decision may be taken even where the same outcome could also be reached by human means. This adjustment would provide greater legal certainty for the deployment of automated decision making within the EU.
d. Sensitive Data – Narrowing the Scope of Article 9 GDPR
The Digital Omnibus proposal intends to narrow the scope of the GDPR’s protection for special categories of personal data under Article 9. Enhanced protection would apply only to data that directly reveal a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health status, or sexual orientation. By contrast, inferred characteristic, such as information deduced through profiling or cross-referencing, would no longer automatically qualify as “sensitive” data.
This represents a marked departure from current practice, where the notion of sensitive data is interpreted broadly in line with CJEU case law.
e. AI Act – Facilitating Implementation and Oversight
To ensure a smooth rollout of the AI Act, the proposal introduces several targeted adjustments aimed at easing initial implementation. It provides a one-year transitional period for providers to comply with the Act’s content-labelling and watermarking obligations, giving additional time for technical adaptation. At the institutional level, the proposal strengthens the supervisory mandate of the AI Office by centralizing oversight over AI embedded in very large online platforms and search engines. Finally, it seeks to improve coherence with other EU digital legislation, notably by clarifying the interplay with the Cyber Resilience Act and facilitating compliance with data protection laws.
4. Key Implications
The overall direction of the Digital Omnibus is expected to be favorable for companies operating in the EU’s digital economy. In practice, businesses may reasonably expect fewer procedural overlaps, clearer interfaces between existing legal frameworks, and a more predictable compliance environment overall.
At the same time, certain elements could introduce new uncertainty. While the Digital Omnibus consolidates certain instruments and clarifies their interaction, it largely builds on existing rules rather than replacing them. In some areas, such as the GDPR, the approach of adding new provisions to amend existing ones may even increase structural complexity. Moreover, the envisaged mechanism for automated consent signals under the revised cookie rules could materially alter how digital services collect and use user-level data, and in turn affect their ability to provide and maintain the quality of their services.
5. Outlook
The Commission is expected to present the Digital Omnibus on 19 November 2025, after which the proposals will move through the ordinary legislative procedure in the European Parliament and the Council. Substantive amendments are likely during the legislative process before any final text is adopted.
For now, companies should monitor the official release, assess which proposals are most relevant to their operations, and consider early policy engagement to position themselves for upcoming regulatory developments and maintain alignment with evolving EU priorities. A forward-looking compliance strategy will be essential once the legislative process clarifies the final scope and timing of the reforms.
[1] Art. 88a GDPR-Draft
[2] Art. 88b GDPR-Draft
[3] Art. 88c GDPR-Draft
Gibson Dunn’s lawyers are available to assist with any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Artificial Intelligence or Privacy, Cybersecurity & Data Innovation practice groups:
Ahmed Baladi – Paris (+33 1 56 43 13 00, abaladi@gibsondunn.com)
Kai Gesing – Munich (+49 89 189 33 285, kgesing@gibsondunn.com)
Joel Harrison – London (+44 20 7071 4289, jharrison@gibsondunn.com)
Vera Lukic – Paris (+33 1 56 43 13 00, vlukic@gibsondunn.com)
Robert Spano – London/Paris (+33 1 56 43 13 00, rspano@gibsondunn.com)
Yannick Oberacker – Munich (+49 89 189 33 282, yoberacker@gibsondunn.com)
Victor A. Thonke – Frankfurt (+49 69 247 411 526, vthonke@gibsondunn.com)
Artificial Intelligence:
Keith Enright – Palo Alto (+1 650.849.5386, kenright@gibsondunn.com)
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650.849.5203, cgaedt-sheckter@gibsondunn.com)
Vivek Mohan – Palo Alto (+1 650.849.5345, vmohan@gibsondunn.com)
Robert Spano – London/Paris (+33 1 56 43 13 00, rspano@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213.229.7186, evandevelde@gibsondunn.com)
Privacy, Cybersecurity & Data Innovation:
Ahmed Baladi – Paris (+33 1 56 43 13 00, abaladi@gibsondunn.com)
Ashlie Beringer – Palo Alto (+1 650.849.5327, aberinger@gibsondunn.com)
Joel Harrison – London (+44 20 7071 4289, jharrison@gibsondunn.com)
Jane C. Horvath – Washington, D.C. (+1 202.955.8505, jhorvath@gibsondunn.com)
© 2025 Gibson, Dunn & Crutcher LLP. All rights reserved. For contact and other information, please visit us at www.gibsondunn.com.
Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.
