EU Omnibus Directive Explained for Businesses and Consumers

Written by: Natasha Piirainen
Updated on: February 25, 2026
Reviewed by: Masha Komnenic CIPP/E, CIPM, CIPT, FIP | Director of Global Privacy @ Termly

The Enforcement and Modernisation Directive, or EU Omnibus Directive, came into effect on Jan. 7, 2020 it entered into action on May 28, 2022.

The European Commission then published the Digital Omnibus Proposal on Nov. 19, 2025, which includes meaningful changes to EU cookie rules.

As part of the New Deal for Consumers initiative, the EU Omnibus Directive strengthens and expands the scope of EU consumer laws and helped modernize consumer protection rules for new market developments.

Below, I summarize the EU Omnibus Directive and the new proposal, its requirements, and how it impacts consumers and businesses.

What Is the EU Omnibus Directive?

The EU Omnibus Directive introduced changes to four pieces of EU/EEA consumer protection legislation:

The goal of the EU Omnibus Directive was to expand the scope of the existing consumer rights framework that applies to physical services and goods to cover digital content, goods, and services.

It introduced new definitions such as “ranking” and “online marketplace” and amends existing definitions such as “digital service” and “sales contract” to bring digital content, goods, and services into the scope of consumer protection legislation.

What Is the EU’s New Deal for Consumers Initiative?

The EU Omnibus Directive was part of the EU’s New Deal for Consumers initiative, which sought to strengthen the enforcement of EU consumer laws and modernize EU consumer protection rules in light of market developments.

The initiative was adopted on April 11, 2018, and includes a communication and two proposals: COM(2018) 184 and COM(2018) 185.

Since the implementation of this initiative, two EU instruments have been adopted: the EU Omnibus Directive and the Directive on Representative Actions.

What Is The Digital Omnibus Proposal?

On November 19, 2025, the European Commission published the Digital Omnibus proposal.

Some key changes from this proposal include:

The proposal adds a second channel of consent management on top of traditional consent banners: automated signals.

It’s expected that honoring browser setting opt-out preferences will become the norm for the foreseeable future.


What’s Changes	What Doesn’t Change
Some purely statistical cookies don’t require consent (truly aggregated, own-use only).	Still need consent for most common tracking purposes.
One-click rejection becomes mandatory.	Still required to scan, classify, and manage cookies.
Browser signals must be respected, where available.	Still needs a preference center and granular consent options.
6-month restriction on re-prompting for consent after refusal.	IAB TCF requirements for ad-supported published still relevant.
Consolidated regulation under the GDPR instead of a split between the GDPR/ePrivacy framework.	Obligations to document compliance still exist.
	Enforcement of GDPR principles remains the same (purpose limitation, data minimization, etc).
	Right to object to legitimate interest processing still exists.
	Technical requirement to block cookies before consent still exists.

How Will CMPs Evolve If Traditional Banners Change or Disappear?

If this proposal goes through, some businesses worry about cookie consent banners as we know them changing or even shrinking.

However, it’s more likely that CMPs will shift from a UI-first setup to an orchestration-first setup.

Consent Orchestration Layer

Consent orchestration layering is likely to become the norm, where the CMP becomes the engine that reconciles and enforces:

Browser/OS signals,
In-site choices,
Geo/regime differences,
Vendor requirements,
Exemptions

Compliance System of Record

CMPs are also likely to become the backbone of businesses audit-trails, primarily because regulators and customers still expect evidence for:

Consent/objection,
Timing,
Scope,
Implementation proof (aka, no dark patterns, one-click reject),
How these choices were applied.

What Are the Requirements of the EU Omnibus Directive?

The EU Omnibus Directive makes key changes to existing consumer framework legislation.

Here are some of the most important requirements of the EU Omnibus Directive.

New Consumer Rights

Expansion of traditional consumer rights to transactions that deal with digital goods

Thanks to the EU Omnibus Directive, consumers involved in transactions that deal with digital goods can now benefit from traditional consumer rights such as:

The right to receive necessary pre-contractual information
The right to withdraw within 14 days

Restrictions on Businesses

Restrictions on price manipulation

The EU Omnibus Directive requires businesses to make pricing more transparent for customers.

If a trader says that a discount is available, the base price to which the discount is being applied must have been available for at least a month before the discount was publicized.

Examples of such situations include:

Automatic price alterations based on individual consumer data
Automatic price alterations reflecting seasonal periods

Increased online marketplace transparency

All online marketplaces must provide consumers with up-front awareness of their rights and whom they can complain to if they believe they’ve been denied their rights.

How Are Consumers Impacted?

Under the EU Omnibus Directive, consumers can now exercise traditional consumer rights when buying digital goods, services, and content.

This means they have more individual remedies when harmed by unfair business practices such as fake reviews and overly aggressive marketing.

How Are Businesses Impacted?

Thanks to the EU Omnibus Directive’s stringent standards, businesses now have more restrictions to follow.

This means that businesses need to review and renew their pricing processes, terms and services, transparency practices, and methods of protecting consumers’ personal data.

How Can Businesses Comply With the EU Omnibus Directive?

Complying with the EU Omnibus Directive can be difficult, particularly if you’re a new company.

Process for Verifying Consumer Reviews

The EU Omnibus Directive requires you to review and update your process for verifying consumer reviews, so every review is genuine.

Pricing Processes

Look at your current pricing processes and ensure that all of your prices have been available for at least 30 days in their respective member states.

Existing Terms and Services for Digital Services or Goods

Review and renew your current terms and services for every digital service or good you sell to EU consumers.

How Will It Be Enforced?

The EU Omnibus Directive leaves enforcement to each EU member state.

Fines and Penalties

If you don’t follow the EU Omnibus Directive, you can face heavy fines at similar levels to those levied under the EU’s General Data Protection Regulation (GDPR).

Proposed Changes: Omnibus IV

Currently, a proposal known as Omnibus IV is pending approval by the European Parliament & Council.

The EU Omnibus Directive makes significant changes to four existing EU directives on consumer protection.