Digital & AI Omnibus: A Turning Point for Data-Driven Marketing

The Omnibus is part of the Commission’s competitiveness and simplification agenda. Its aim is clear: reduce compliance burdens, make the AI Act workable and allow SMEs to innovate while maintaining strong data protection. In essence, it seeks to rebalance protection and innovation.

The Omnibus strikes at the core of digital marketing. It codifies European caselaw on the personal data definition, clarifies AI use under legitimate interest, regulates bias detection, reshapes consent for cookies, touches upon browser signals (a topic that raises unresolved technical and legal issues), curbs abusive requests, adjusts breach rules and revisits documentation duties. In short, it sets the framework for how data is collected, analysed and activated.

Institutionally, the file is moving quickly. In the Council, the Cypriot Presidency is prioritising the less politically sensitive provisions first, such as cookies and certain ePrivacy elements, with the objective of delivering a first compromise text by the end of February 2026. AI-related discussions are expected to intensify in the spring. In the European Parliament, rapporteurs are appointed, reports are circulating and amendments tabled. This is no longer preliminary discussion it is active legislation...

Several debates deserve close attention

1. The integration of cookie rules into the GDPR and the proposal to introduce automated, machine-readable consent signals, potentially at browser level. Simplification and reduction of cookie fatigue are legitimate objectives. However, a centralised browser-based model could concentrate power in the hands of a limited number of global technology providers and reduce flexibility for European SMEs. The architecture of consent is a major issue; it shapes competition, market access and could jeopardise digital sovereignty.
2. The proposal codifies a more relative approach to the definition of personal data, in line with recent CJEU case law*.. If implemented clearly with simple criteria, this could increase legal certainty and encourage the deployment of PET’s (privacy-enhancing technologies such as pseudonymization). For AI training and advanced analytics, clarity around identifiability is essential. Legal uncertainty in this area has long slowed innovation.
3. Third, the clarification that legitimate interest may be relied upon for the development and operation of AI systems is structurally important. Consent cannot be the default mechanism for all forms of data processing in complex AI environments. Because legitimate interest relies on a documented assessment, it naturally reinforces accountability and stimulates companies to justify and mitigate risks rather than avoid innovation altogether. A risk-based and accountable use of legitimate interest offers a more realistic balance between protection and innovation, provided safeguards are clearly defined.
4. Fourth, the Commission is addressing abusive data subject access requests. While the right of access and compensation must remain intact, there is growing recognition that the framework can be misused in bad faith. Clarifying proportionality helps protect responsible companies while preserving genuine rights.
5. Finally, the alignment of breach notification thresholds and the discussion around AI literacy obligations illustrate a broader attempt to streamline overlapping regulatory layers. The key principle must remain proportionality. Especially for SMEs, obligations should be practical and risk-based rather than formalistic.

Beyond the technical amendments, a deeper question is emerging: what digital architecture does Europe want? The Omnibus touches platform concentration, market structure, innovation capacity and strategic autonomy. Personalised digital advertising plays a critical role in enabling SMEs to compete. If regulation becomes overly rigid or technologically prescriptive, innovation risks shifting elsewhere. If simplification genuinely improves clarity and feasibility, Europe can strengthen both protection and competitiveness.

BAM has not been passive in this landscape. Through its AI Charter, its Meaningful Marketing framework and its MarTech reflections on data sovereignty and ecosystem accessibility, BAM has already addressed the structural questions now central to the Omnibus debate. The focus on human oversight, technological neutrality, modular architectures and avoidance of structural dependency is directly aligned with today’s regulatory discussions.

For BAM responsibility and competitiveness are not opposites. Meaningful Marketing defends value creation, trust and accountability while preserving operational room for innovation. Data sovereignty is not about nationalism; it is the practical ability to understand and govern one’s MarTech architecture. Interoperability, transparency and auditability are governance tools, not ideological positions.

The Omnibus discussion confirms that the market is moving toward the same structural balance BAM has consistently advocated: strong data protection combined with operational feasibility and sustainable competitiveness. BAM is therefore not reacting to regulatory change. It is in phase with it.

Through FEDMA and the ICC, BAM contributes to the European and global debate while staying operationally focused for its members. The aim is not deregulation, but responsible innovation not platform opposition, but architectural clarity and competitive resilience. BAM will continue to follow the file closely, contribute constructively at European level and ensure that Belgian marketers remain both compliant and competitive.

The real question is simple: can Europe protect citizens without stifling innovation and market access? BAM’s answer is clear: yes, if regulation stays risk-based, technologically neutral and balanced. This is not a shift. It confirms we are on the right path.