19 October 2026. This is the Council draft of 2 October, document 13886/26. Coreper did not vote on 11 October. I'll update this page when a text is law.
If that October wording survives, a site could measure its own audience without cookie consent, provided the figures are an anonymous aggregate for that one site. Active Analytics is built to that shape. The banner stays until this is law, and the word "anonymous" is where the exemption can still fail.
I'm not a lawyer. This is a reading of a draft, for the agency that has to explain a cookie banner to a client this week.
What the draft would allow
The text rewrites Article 5(3) of the ePrivacy Directive. Storing something on a visitor's device, or reading it back, needs consent, except for a closed list. One entry is first-party audience measurement: anonymous aggregated information about the use of a single online service, carried out by the site or by someone working for it.
Here's the conditions, from PPC Land's breakdown of the 2 October text. The data collected to build those figures:
- is not processed for another purpose
- is not shared with a third party
- is not combined with data from other sites
Recital 44d names the case this blocks: "analytics information from other websites". A vendor that pools its clients to benchmark them sits outside the exemption.
The same article also exempts contextual ad measurement, among other things. The four-month wait before a site may ask again, after a refusal, is a separate sentence. It sets how often a banner may come back.
Still a draft
Germany and France held the file up over the Data Act, trade secrets in particular. The cookie wording was sitting in the text that never got a vote. Agence Europe reported that the Irish Presidency compromise was not discussed at Coreper on 11 October. The 7 October meeting had already stopped.
Parliament has no position yet. Trilogue can rewrite the line. The dates in the draft disagree with each other anyway. Member states would have 24 months to transpose the ePrivacy changes. Another clause says those changes apply 6 months after publication in the Official Journal. Wait until one of those dates is real.
Where Active Analytics sits
The exemption is permission to store or read something on the device, for measurement. Active Analytics does not set a cookie, and it does not read one. The rows go into that site's own WordPress database. I don't receive them. There is no pool of client sites behind the plugin.
On a site I look after today, the banner is there for the tags that do use the device. Google Analytics. An ads pixel. Cookieless counts, kept on the site's own server, were already why some of us ran stats with no banner, and the Data Protection Commission enforces the rules that are written down now.
If a regulator treats the request itself as device access, the IP address and the user agent, the plugin is the shape that recital describes. One site, and the site owner holds the totals.
Anonymous is the catch
The plugin hashes on the server. The Last Hits screen can list IP addresses. Anonymous aggregated information is the total on the dashboard. A list of IPs is a log. Keep the raw hits and you are storing something a person can be picked out of. The exemption is written for the aggregate.
The same draft also changes the GDPR definition of personal data, so a record would not be personal for someone who has no way to identify the person. That clause is the same unfinished text. The site holding the hash can tell two visits apart. I would not lean on it for a log of addresses.
What to tell the client
Keep consent on any analytics cookie and any marketing cookie. A text that never reached a vote is a poor reason to take the banner down.
If the October wording becomes law, the measurement that fits is the dull one. One site, figures added up, kept there, kept apart from the site next door. Cross-site tracking and behavioural ads would still need a yes.
I'll change this page when the Council agrees a text. Until then, the DPC is the office that matters.
Ciprian Popescu runs WP Dublin and builds WordPress plugins at getButterfly. He has been helping Irish businesses get found online since 2002. More about me.
WordPress & WooCommerce Plugins