Cookie Consent: What the EU’s Four-Month Proposal Means

Written by Safegram Editorial Team

Irish websites cannot treat Europe’s latest cookie proposal as a new permission to track visitors. On 21 October 2026, the Council of the EU agreed its negotiating position on changes to the digital rulebook. The text proposes simpler refusal, limits on repeat consent requests and tightly conditioned exceptions. It is a negotiating mandate, not a law already changing Ireland’s cookie rules. [1][2]

Key takeaways

The Council proposes a single-click refusal or equivalent and at least four months before asking again for the same purpose after a refusal. [2]
Proposed audience-measurement exceptions have conditions; they do not exempt every analytics or advertising tool. [2]
Ireland’s Data Protection Commission continues to say analytics cookies require consent. Businesses should test current compliance, not implement a proposal early. [3][4]

What the four-month proposal actually says

The Council mandate, published with the updated announcement on 22 October, would let users refuse a consent request easily and intelligibly through a single-click button or equivalent means. If they refuse, the provider should not ask again for the same purpose for at least four months. Where consent is given, it should not be requested again for that purpose during the period it can lawfully be relied on. [2]

The details matter. This is not a universal four-month expiry date for every cookie. Nor does it mean a website may ignore a later change of preference. It addresses repeated requests for the same purpose. The mandate also contemplates a later national implementation period; nobody should describe the October announcement as an overnight switch in Irish law. [2]

A cookie is a small piece of information stored on a device. Some support functions a person actually requested; others help measure activity or target advertising. Calling them all “essential” because they are useful to a business does not make that classification correct. [4]

A hand holds a phone beside a coffee cup; the screen is unreadable.

A hand holds a phone beside a coffee cup; the screen is unreadable. AI-generated editorial illustration; not a photograph of a named event or research participant.

Measurement is not a blanket exemption

The draft contains different measurement provisions. One audience-measurement provision requires data to be pseudonymised after collection, limits reuse and tracking outside the measured service or media content, and restricts sharing of personal data. Pseudonymisation is not the same thing as irreversible anonymisation. Describing the entire proposal as an exemption for “anonymous analytics” would miss important conditions. [2]

Another provision concerns measurement of contextual advertising: advertising selected from immediate content or a single search query, rather than a profile of past or future activity. Its conditions restrict profiling and other uses. A company cannot simply rename behavioural advertising “contextual” and assume it falls within the proposal. [2]

The practical distinction is between asking how a particular page performs and assembling a continuing picture of an identifiable person’s activity. Whether a specific tool meets a future exception would depend on what it actually does, not the wording on its sales page. These provisions remain proposals, not a ready-made compliance approval for a software product.

What Irish businesses must do now

The DPC’s current guidance answers “yes” to whether analytics cookies need consent, including in its discussion of first-party analytics. It identifies narrow exemptions for strictly necessary functions requested by the user and for transmission of a communication. It says targeted-advertising and conversion-tracking cookies are not exempt. [3][4]

The DPC also warns that pre-ticked boxes or toggles do not produce valid consent. A generic link to someone else’s cookie explanation is not a substitute for explaining the operator’s own use. People must be able to withdraw or vary consent, and withdrawal must be as easy as giving it. [4][5]

This is why changing a button is not enough. A consent banner is the interface; the scripts running behind it determine whether the visitor’s choice is respected. A business should know which tools load before a decision, which load after refusal and what stops after withdrawal.

Three colleagues discuss a laptop in a bright workspace.

Three colleagues discuss a laptop in a bright workspace. AI-generated editorial illustration; not a photograph of a named event or research participant.

A practical audit without waiting for new legislation

Take an illustrative Dublin bakery using a booking widget, a traffic counter and an advertising pixel. The owner should ask the developer to document each tool’s purpose, data recipients, retention and consent behaviour. The booking function and the marketing pixel should not be assumed to need identical treatment. This is a hypothetical example, not an audit of a named business.

Then test the site as a new visitor who refuses optional tracking. Repeat on mobile and after withdrawing an earlier agreement. Check that the policy describes the actual tools and that refusal does not quietly become consent elsewhere in the interface. Keep a record of the test and obtain qualified advice for uncertain cases. [4][5]

For creators and smaller businesses, fewer intrusive requests could be useful. But measuring success only by how many people press “accept” rewards the wrong outcome. The better test is whether people understand the choice and the site honours it.

A shopkeeper talks with a customer at a counter.

A shopkeeper talks with a customer at a counter. AI-generated editorial illustration; not a photograph of a named event or research participant.

Simpler choices still need accountability

Safegram’s emphasis on privacy and user control is relevant to that principle: a privacy promise should be judged by the experience of someone who says no, not just by a headline. This is a design standard to apply to Safegram too, not a claim that its technology has been independently audited or that it never uses a particular tool.

The Council says negotiations with the European Parliament are the next step. Readers elsewhere should not treat the EU proposal or Irish regulator’s guidance as an automatic change to UK, US, Brazilian or other domestic law. Even within Europe, a specific implementation should be checked against the applicable rules and eventual final text. [1]

The useful next action is available now: test one real refusal and one withdrawal on your website. For information about Safegram, visit safegram.com (https://safegram.com/). This is general editorial analysis, not individual legal advice or a compliance certificate.

Frequently asked questions

Did the EU abolish cookie banners in October 2026?

No. The Council agreed a negotiating position, not a final law abolishing banners. Existing obligations continue to apply. [1]

What does the proposed four-month period mean?

After refusing a request, a person should not be asked again for the same purpose for at least four months under the Council’s text. It is not yet a new Irish rule. [2]

Can Irish sites now set analytics cookies without consent?

Not because of this proposal. Current DPC guidance says analytics cookies require consent. The proposed exceptions have not replaced that guidance. [3]

Is pseudonymised information anonymous?

Not necessarily. Replacing identifiers does not by itself remove the possibility of linking information to a person. The draft’s measurement conditions should not be reduced to a claim that all analytics are anonymous. [2]

What is contextual advertising?

Advertising based on the content being viewed or a specific query rather than a profile of a person’s activities. The proposed measurement exception contains further restrictions. [2]

What should a business change immediately?

Fix current compliance problems: identify actual trackers, remove invalid preselected consent, explain purposes and provide an easy withdrawal route. Do not activate proposed exemptions before they become applicable. [3][4][5]