Digital Omnibus: What Would it Mean for Competition and Privacy in Advertising?

This post for The Platform Law Blog by authors Thomas Höppner & Yannick Werle (Geradin Partners) explores the European Commission’s proposed “Digital Omnibus” regulation, a wide-ranging effort to simplify and consolidate EU digital legislation while enhancing competitiveness. Although framed as a streamlining exercise, the proposal revisits core elements of the GDPR and ePrivacy Directive, particularly around personal data use in advertising. Ongoing institutional debate—between the Commission, the Council, and data protection authorities—signals that the final shape of the reform remains uncertain.

A central and controversial element is the proposed redefinition of “personal data,” which would narrow GDPR applicability where identification of individuals is not reasonably possible. While the Commission views this as a pragmatic, risk-based adjustment that could reduce compliance burdens and encourage innovation, the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) oppose it, warning it could weaken fundamental rights and create legal complexity. The authors argue that a more differentiated approach is justified, particularly for smaller players handling pseudonymised data.

The proposal also introduces new consent rules for data processing, including limited exemptions and the integration of ePrivacy provisions into the GDPR. However, the authors highlight inconsistencies and competitive distortions, especially in the treatment of audience measurement. A narrowly defined exemption for “in-house” measurement could advantage large digital platforms with vast first-party data ecosystems, while disadvantaging independent, cross-site measurement systems relied upon by smaller publishers. This asymmetry risks further concentrating market power in favor of major tech companies.

As noted by the authors, the Digital Omnibus proposes stricter consent management rules and browser-level consent mechanisms, intended to reduce “cookie fatigue.” The article argues these measures may backfire—undermining user choice, disrupting ad-funded business models, and reinforcing the dominance of major platforms, particularly those controlling browsers, building the case for a more balanced, risk-based approach that may avoid inadvertently harming competition, media plurality, and European digital competitiveness while offering limited gains in privacy protection…

CONTINUE READING…