Kiri

The Data of Democracy: the Omnibus must protect journalism from one-size-fits-all privacy rules Publishers are very concerned that the omnibus is not simplifying, but instead creating new rules that will harm their business and ability to process data. The proposal must be amended so that it may achieve its intended goals of simplification and supporting media services. While the GDPR is important to protect citizens, its complex overlaps with the ePrivacy Directive are outdated and fail to reflect the realities of the digital economy or to even encourage the use of privacy-friendly technologies. Therefore, these rules should be simplified in the interest of citizens, regulators and the business community. To succeed, EU privacy rules must shift away from a one-size-fits-all approach and encourage a risk-based framework aligned with the GDPR and the corresponding legal bases for processing data. In addition, the strict rules that apply to global tech platforms because of their invasive data practices should not apply to ordinary SMEs or publishers. Current rules divert crucial revenue away from European publishers towards foreign platforms, undermining the strategic objectives of the European Democracy Shield and Media Freedom Act. Publishers appreciate that the Omnibus recognises this risk and the role of editorial media in society through a targeted exemption, but it must go further and create a GDPR data framework that genuinely enables sustainable journalism, treating it as a democratic pillar. Why data is essential for European media News publishing is rapidly moving from print to digital where the main currency is data. Access to reliable data is essential to fulfil editorial and social objectives, both in terms of driving engagement and ensuring commercial sustainability. Publishers must be able to: (a) Use data to know who their audience is. This is crucial to understanding how younger audiences consume news, improving user experience and engagement with quality editorial content that can compete with social media and AI; (b) Use data to offer advertisers effective, interest-based solutions. This is crucial to ensure sufficient income from digital advertising, which is an essential source of revenue alongside premium content subscriptions. Problems with the Omnibus proposals The Omnibus is intended to simplify the current rules. However, it introduces proposals that will make it more difficult for publishers and media services to use data:

1 News Media Europe vzw, 35 Square de Meeus 1000 Brussels, Belgium - BE0647900810

EU Transparency Register ID: 577812220311-81

1. It maintains the strict ePrivacy consent requirement in Art. 88a (with only a partial derogation for audience measurement) for user devices that contain personal data, while a parallel regime is foreseen in the ePrivacy Directive for devices without personal data.

2. It introduces new consent rules for all websites in Art. 88a (eg. single click rejections and

consent request cooling-off periods) that are unworkable, as they require a persistent identification of user devices, and which can starve media of advertising revenues.

3. It introduces centralised consent settings for all websites in Art. 88b (with a media exemption) that would deprive publishers of revenues and create new gatekeepers, against the objectives of the Digital Markets Act.

The current approach means that consent remains the only legal basis for publishers to use cookies and similar technologies. This completely fails to address consent fatigue, restricts flexibility for media services, and excludes more privacy-friendly advertising models based on legitimate interest. The Omnibus should focus on easing the excessively strict consent requirement that currently applies to many low-risk data processing activities, even where they clearly have no or only a negligible impact on privacy. By reducing the need to obtain consent only where it is really needed, the Omnibus can eliminate the need for centralised consent settings. So when media services process data in ways that are privacy-friendly, using aggregates, limited data, or on a first-party basis, they should be able to depart from the rigid consent approach. This can be achieved through targeted exemptions for responsible media services or by relying on other legal bases of the GDPR such as legitimate interest. We oppose the implementation of centralised settings and single-click rejections because of the harm they can inflict to the media sector. While the media exemption is a welcome acknowledgement of this risk, it remains unworkable. In practice, centralised settings will create user expectations about compliance which contradict the operational reality of media services. This disconnect creates an inevitable risk for consent rates, starving independent publishers of vital advertising revenue and undermining the high level of trust users place in their preferred news brands. Further to the competition and gatekeeper problems that centralised settings could create, this type of solution would also require advertising technology providers to determine who is a “media service provider” under the Media Freedom Act, and to voluntarily accept significant GDPR risks and liability for breaches of consent. We believe adtech companies are neither willing or capable of doing both.

2 News Media Europe vzw, 35 Square de Meeus 1000 Brussels, Belgium - BE0647900810

EU Transparency Register ID: 577812220311-81

Suggestions to improve the Omnibus proposal It is essential to preserve the intent of the omnibus to support the media at this difficult juncture. The Omnibus can actively support the sector in several ways:

1. Introduce alternatives to consent for media services that engage in low-risk data processing activities or use privacy-friendly technologies, by allowing reliance on the other legal bases of the GDPR and expanding the audience measurement derogation.

2. Clarify that media services may base the availability of their content on user consent for processing activities that are necessary to finance that content.

3. Stop the introduction of centralised settings and new consent rules because of the harm they could inflict on media services regardless of the exemption, or alternatively make the settings only binding on gatekeepers under the Digital Markets Act.

3 News Media Europe vzw, 35 Square de Meeus 1000 Brussels, Belgium - BE0647900810

EU Transparency Register ID: 577812220311-81

The Data of Democracy: the Omnibus must protect journalism from one-size-fits-all privacy rules Publishers are very concerned that the omnibus is not simplifying, but instead creating new rules that will harm their business and ability to process data. The proposal must be amended so that it may achieve its intended goals of simplification and supporting media services. While the GDPR is important to protect citizens, its complex overlaps with the ePrivacy Directive are outdated and fail to reflect the realities of the digital economy or to even encourage the use of privacy-friendly technologies. Therefore, these rules should be simplified in the interest of citizens, regulators and the business community. To succeed, EU privacy rules must shift away from a one-size-fits-all approach and encourage a risk-based framework aligned with the GDPR and the corresponding legal bases for processing data. In addition, the strict rules that apply to global tech platforms because of their invasive data practices should not apply to ordinary SMEs or publishers. Current rules divert crucial revenue away from European publishers towards foreign platforms, undermining the strategic objectives of the European Democracy Shield and Media Freedom Act. Publishers appreciate that the Omnibus recognises this risk and the role of editorial media in society through a targeted exemption, but it must go further and create a GDPR data framework that genuinely enables sustainable journalism, treating it as a democratic pillar. Why data is essential for European media News publishing is rapidly moving from print to digital where the main currency is data. Access to reliable data is essential to fulfil editorial and social objectives, both in terms of driving engagement and ensuring commercial sustainability. Publishers must be able to: (a) Use data to know who their audience is. This is crucial to understanding how younger audiences consume news, improving user experience and engagement with quality editorial content that can compete with social media and AI; (b) Use data to offer advertisers effective, interest-based solutions. This is crucial to ensure sufficient income from digital advertising, which is an essential source of revenue alongside premium content subscriptions. Problems with the Omnibus proposals The Omnibus is intended to simplify the current rules. However, it introduces proposals that will make it more difficult for publishers and media services to use data:

1 News Media Europe vzw, 35 Square de Meeus 1000 Brussels, Belgium - BE0647900810

EU Transparency Register ID: 577812220311-81

1. It maintains the strict ePrivacy consent requirement in Art. 88a (with only a partial derogation for audience measurement) for user devices that contain personal data, while a parallel regime is foreseen in the ePrivacy Directive for devices without personal data.

2. It introduces new consent rules for all websites in Art. 88a (eg. single click rejections and

consent request cooling-off periods) that are unworkable, as they require a persistent identification of user devices, and which can starve media of advertising revenues.

3. It introduces centralised consent settings for all websites in Art. 88b (with a media exemption) that would deprive publishers of revenues and create new gatekeepers, against the objectives of the Digital Markets Act.

The current approach means that consent remains the only legal basis for publishers to use cookies and similar technologies. This completely fails to address consent fatigue, restricts flexibility for media services, and excludes more privacy-friendly advertising models based on legitimate interest. The Omnibus should focus on easing the excessively strict consent requirement that currently applies to many low-risk data processing activities, even where they clearly have no or only a negligible impact on privacy. By reducing the need to obtain consent only where it is really needed, the Omnibus can eliminate the need for centralised consent settings. So when media services process data in ways that are privacy-friendly, using aggregates, limited data, or on a first-party basis, they should be able to depart from the rigid consent approach. This can be achieved through targeted exemptions for responsible media services or by relying on other legal bases of the GDPR such as legitimate interest. We oppose the implementation of centralised settings and single-click rejections because of the harm they can inflict to the media sector. While the media exemption is a welcome acknowledgement of this risk, it remains unworkable. In practice, centralised settings will create user expectations about compliance which contradict the operational reality of media services. This disconnect creates an inevitable risk for consent rates, starving independent publishers of vital advertising revenue and undermining the high level of trust users place in their preferred news brands. Further to the competition and gatekeeper problems that centralised settings could create, this type of solution would also require advertising technology providers to determine who is a “media service provider” under the Media Freedom Act, and to voluntarily accept significant GDPR risks and liability for breaches of consent. We believe adtech companies are neither willing or capable of doing both.

2 News Media Europe vzw, 35 Square de Meeus 1000 Brussels, Belgium - BE0647900810

EU Transparency Register ID: 577812220311-81

Suggestions to improve the Omnibus proposal It is essential to preserve the intent of the omnibus to support the media at this difficult juncture. The Omnibus can actively support the sector in several ways:

1. Introduce alternatives to consent for media services that engage in low-risk data processing activities or use privacy-friendly technologies, by allowing reliance on the other legal bases of the GDPR and expanding the audience measurement derogation.

2. Clarify that media services may base the availability of their content on user consent for processing activities that are necessary to finance that content.

3. Stop the introduction of centralised settings and new consent rules because of the harm they could inflict on media services regardless of the exemption, or alternatively make the settings only binding on gatekeepers under the Digital Markets Act.

3 News Media Europe vzw, 35 Square de Meeus 1000 Brussels, Belgium - BE0647900810

EU Transparency Register ID: 577812220311-81