A Council draft would cut the cookie re-prompt wait to four months
A draft EU Council mandate would let sites ask for cookie consent again after four months instead of six. It is a draft, not law, and Parliament has no position yet.
On 9 October 2026 PPC Land reported on a Council of the EU document under the headline EU Council draft cuts cookie re-prompt wait from 6 months to 4. According to PPC Land, Council document 13886/26, dated 2 October 2026 and prepared by the Council's General Secretariat for the Permanent Representatives Committee (Coreper), would require a provider to wait at least four months before asking again for consent for the same purpose. The Commission's proposal said six months, and so did an earlier Council text of 3 September.
What the draft says about asking again
PPC Land quotes the cover note: "a new request for consent for the same purpose shall not be made for a period of at least four months." The rule covers any provider that accesses the device, including third-party cookies. The report lists the cases where a request may come sooner: the purpose changes, a new service is offered, the service changes substantially, or the stored refusal is no longer valid for reasons beyond the provider's control, such as the user deleting cookies.
What stays the same
The cookie rules stay in the ePrivacy Directive, in Article 5(3), rather than moving to the GDPR. Storing or reading information on a device still needs consent that meets the GDPR's standard.
The Commission's proposed browser consent signal, in Articles 88a and 88b, was deleted from this text.
Consent is not needed where access is strictly necessary for one of six purposes, among them providing a service the user explicitly requested, first-party audience measurement that produces anonymous aggregated information, and maintaining technical security. Measuring the display and performance of contextual advertising is new in this text.
PPC Land also reports that the text would apply six months after publication in the Official Journal, which it says sits uneasily with a 24-month transposition period for member states. Any of this can change before a text is adopted.
What we can say about FormFlow
We checked what the code and our privacy policy say, and report only that.
FormFlow's own landing page loads Google Analytics only after a visitor allows analytics. The page's script starts with analytics and advertising storage denied and keeps the visitor's choice in the browser's local storage; a "Privacy choices" control changes it.
The privacy policy says FormFlow uses strictly necessary cookies to keep you signed in and to protect against request forgery, that Cloudflare Turnstile, our spam protection, may set its own cookies when a form is submitted, and that FormFlow does not use advertising or cross-site tracking cookies.
The Hosted page's templates and its content security policy name no analytics or advertising script. The only third-party script the policy allows is Cloudflare's Turnstile, and only when the Form uses it.
An Embedded form is markup in your own page, so every other cookie on that page is set by your site and its tools, not by FormFlow.
That is a description of today, under today's rules. It is not a statement that FormFlow would satisfy a rule that has not been adopted, and we have not assessed it against this draft.
What to do now
Nothing in the draft takes effect yet. If you run a consent banner, it is still worth knowing what your tool does after a visitor refuses: whether it asks again on the next visit or waits. Under the Commission's proposal the wait would have been six months; under this draft, four. Either way it is a setting in whichever consent tool you use. Nothing here is legal advice; take the legal reading from your own counsel.