The Digital Omnibus: why the next era of tracking will be decided by browsers, not banners

Digital measurement has been going through various shifts driven primarily by privacy being brought into the focus of consumers and regulators:

• GDPR reorganised the industry
• iOS 14.5 created the first major crack in behavioural targeting
• Cookie deprecation revealed just how dependent the ecosystem was on a fragile piece of technology

Now the EU’s Digital Omnibus proposal is emerging as the next milestone. Not because it removes cookies, and not because it introduces entirely new obligations, but because it shifts control.

For the first time, consent is set to move away from individual websites and into the browser itself. This change sounds simple, but it represents a fundamental restructuring of how the internet governs tracking and personal data.

A shift in power: from websites to browsers

The heart of the Digital Omnibus is centralised consent. Instead of interacting with dozens of banners, users will set their tracking preferences once inside their browser or operating system. Websites must respect those choices for at least six months.

This replaces the noisy, inconsistent world of consent pop-ups with a silent, browser-controlled system. It also hands enormous influence to a small group of technology companies who maintain the browser ecosystem.

Chrome, Safari, Firefox, Edge and privacy-focused browsers will become the gatekeepers of tracking. Their defaults, design choices and privacy philosophies will quietly rewrite what marketers and data teams can measure.

AI at the heart of these changes

AI growth is a major trigger for this shift. LLMs depend on large, consistent and predictable datasets, yet the current privacy landscape is anything but stable. Fragmented consent frameworks, inconsistent cookie banners, shrinking third-party data and wildly different national interpretations of GDPR have created a messy, unreliable data environment that slows AI development. 

This proposal reduces friction for AI companies, but it also raises challenging questions about who actually benefits from these changes. The proposal promises simplicity for users, but the real efficiency gains sit with the organisations training the next generation of LLMs. 

That is why brands need to approach this with eyes open and invest in data foundations that protect both performance and user trust.

What the proposal introduces

1. Consent handled at the browser level

Users choose tracking preferences globally. Sites respond to those signals automatically. This reduces friction for users but increases unpredictability for marketers, as each browser may handle consent differently.

2. Some low-risk cookies may run without consent

Security, operational and basic analytics cookies could operate without a banner prompt. This could restore some analytics visibility, but will not solve the loss of detailed behavioural data.

3. Broader use of legitimate interest

The proposal expands scenarios where legitimate interest can justify certain types of tracking. This is a flexibility point, but only if businesses maintain strong assessments, documentation and clear opt-out options.

4. A narrower definition of sensitive data

Only data that directly reveals a sensitive attribute qualifies as special category data. This could open up more interest-based targeting, but it also raises serious ethical questions.

5. A long rollout timeline

The regulation must pass through the EU legislative process, which historically takes years. Browser adoption comes later. Businesses should prepare early, but no one should expect immediate upheaval.

What this means for marketing, analytics and product teams

The shift is not theoretical. It will have material, measurable effects across the entire digital landscape.

1. Analytics and visibility

Basic analytics may become more complete if low-risk cookies are exempt from consent, but deeper behavioural data will still depend on user settings. Expect discrepancies across browsers and more modelled data in GA4.

2. Attribution and measurement

Attribution will get harder. Multi-touch visibility weakens when browser-level blocks override site-level tracking. Teams will need to rely more heavily on:

• server-side tagging
• conversion APIs
• incrementality testing
• marketing mix modelling
  

3. Audiences and retargeting

Retargeting and lookalike audiences will shrink if users activate strict controls. Custom audiences built from site behaviour will reduce in size and accuracy. Brands will need to increase focus on contextual targeting and authentication-based strategies.

4. Personalisation

With fewer reliable behavioural signals, personalisation will shift toward:

• contextual triggers
• preference-based zero-party data
• logged-in user experiences
• high-quality on-site UX design
  

5. Platform data divergence

Google, Meta, TikTok and others will continue to model conversions when signals are missing. Platform numbers and analytics numbers will increasingly disagree. Teams will use platform reporting for optimisation and site analytics for health metrics.

6. First-party data, once again, is cemented as the foundation

Email, CRM data, loyalty programmes and logged-in experiences will become the most durable signals. Brands that build strong first-party ecosystems will withstand the changes far better than those reliant on anonymous browsing behaviour.

How businesses can prepare now

Preparation is not about responding to the regulation directly. It is about modernising measurement and data strategies so that future changes are absorbed, not feared.

Start with:

• strengthening first-party and zero-party data collection
• moving tracking infrastructure to the server-side
• implementing conversion APIs
• creating a privacy-first value exchange
• aligning legal and marketing teams early
  preparing leadership for reporting disruptions

The companies that act now will be the ones that experience the least turbulence later.

The opportunity within the change

The Digital Omnibus Regulation Proposal may look like another regulatory hurdle, but there is genuine upside. For users, the experience becomes simpler. For brands, the shift encourages healthier data ecosystems built on trust, clarity and genuine relevance.

The future will not reward businesses that try to work around limitations. It will reward those who build strong, ethically grounded data foundations. The winners will not be the brands with the most data, but the brands with the most trusted data.

Connect with us to strengthen your data strategy and prepare for browser-led consent.