ePrivacy Directive: Cookie Consent and Electronic Marketing Rules
The ePrivacy Directive is the EU law behind cookie banners. Article 5(3) requires prior consent before storing or accessing information on a user's device, such as cookies, pixels, local storage and fingerprinting, unless strictly necessary for a service the user requested. It also restricts unsolicited electronic marketing and protects the confidentiality of communications, traffic and location data. It sits alongside the GDPR and is enforced through national laws, often by data protection authorities.
The ePrivacy Directive, Directive 2002/58/EC, is the EU law that made cookie banners part of the web. Its Article 5(3) requires websites and apps to get users' consent before storing or reading information on their devices, unless that is strictly necessary for a service the user asked for. It also governs email and SMS marketing and the confidentiality of electronic communications. Because it is a directive, each EU country implements it through its own law, and enforcement is often by data protection authorities that also apply the GDPR.
A replacement ePrivacy Regulation was proposed in 2017 but withdrawn in 2025, and the Commission's November 2025 Digital Omnibus proposal would change how cookie rules work. Until any change is adopted, the directive and national laws apply. This guide explains the cookie rules, exemptions, consent quality, marketing rules, how they interact with the GDPR, and how to build a compliant setup.
What is the ePrivacy Directive?
The Directive on privacy and electronic communications was adopted in 2002 and amended in 2009 by Directive 2009/136/EC, which introduced the current consent requirement for cookies. It complements the GDPR as a specific law: where it sets rules, such as for device access, those rules apply, and the GDPR governs the processing of personal data that follows. National laws implement it, for example the TDDDG in Germany, the PECR in the UK (retained after Brexit), and articles of the French data protection law.
Who must comply?
- Anyone storing or accessing information on a user's terminal equipment in the EU: websites, mobile apps, SaaS products, smart TVs and connected devices, whatever their location.
- Senders of electronic direct marketing by email, SMS or automated calls.
- Providers of publicly available electronic communications services, including, since the European Electronic Communications Code took effect in December 2020, many messaging and calling services, for the confidentiality, traffic and location data rules.
Article 5(3) applies whether or not the information is personal data. A cookie with no personal data still needs consent unless exempt.
Is it mandatory or voluntary?
Mandatory through national laws. There is no certification. Fines are set under national law or, where authorities apply the GDPR to the processing that follows, under GDPR limits.
Article 5(3): consent for cookies and similar technologies
Storing information, or gaining access to information already stored, in a user's terminal equipment is allowed only if the user has given consent after receiving clear and complete information, in line with the GDPR, about the purposes. Two exemptions apply:
- Transmission exemption: storage or access for the sole purpose of carrying out the transmission of a communication over a network, such as load balancing.
- Strictly necessary exemption: storage or access strictly necessary to provide an information society service explicitly requested by the user, such as session cookies, shopping basket cookies, authentication, security cookies, and user preference cookies such as language or consent choices.
Consent is required for analytics (with narrow national exceptions for configured first-party audience measurement in some countries, such as France), advertising, social media plugins that track, A/B testing tools that are not strictly necessary, session replay and most third-party scripts.
What counts as accessing a device?
The EDPB's Guidelines 2/2023, finalised in 2024, confirm that Article 5(3) is technology-neutral. It covers cookies, local storage, tracking pixels and tracking links, URL parameters that cause device information to be sent, device fingerprinting, IoT reporting, unique identifiers generated from device data and, in many cases, scripts that instruct the browser to send information to a third party. Moving tracking server-side does not avoid the rules if the device is still instructed to send information.
What valid consent looks like
Consent uses the GDPR standard: freely given, specific, informed, unambiguous and given by a clear affirmative act. The Court of Justice ruled in Planet49 (C-673/17, 2019) that pre-ticked boxes are not valid consent, that the rule applies whether or not the data is personal, and that users must be told how long cookies last and whether third parties can access them. Authorities and courts have since established that:
- Rejecting must be as easy as accepting, usually with a "reject all" button on the first layer.
- No cookies requiring consent may be set before the user chooses.
- Consent must be specific to purposes, with granular choices.
- Withdrawal must be as easy as giving consent, usually through a persistent link or icon.
- Cookie walls that block access unless users accept are generally not valid, though some authorities accept "pay or consent" models under strict conditions.
- Dark patterns, such as colour tricks and confusing wording, invalidate consent.
- Consent records should be kept as proof.
Mobile apps, SDKs and connected devices
The rules apply equally to apps. Reading the advertising identifier, device identifiers or installed app lists, and writing data to app storage for analytics or advertising, all need consent unless strictly necessary. Many analytics, crash reporting, attribution and advertising SDKs start collecting as soon as they are initialised, so the app must delay initialisation until the user chooses, or configure the SDK to start in a restricted mode. Crash reporting limited to what is needed to keep the app working may qualify as strictly necessary in some authorities' views, but analytics on user behaviour generally does not. Smart TVs, cars and other connected devices that report usage data back to the manufacturer fall under the same principle, which the EDPB's 2023 guidelines make explicit.
Electronic marketing (Article 13)
Unsolicited direct marketing by email, SMS and automated calling to individuals requires prior consent. The soft opt-in exception allows marketing similar products or services to existing customers whose contact details were obtained in the context of a sale, if they had a clear chance to object at collection and in every message. Senders must not disguise their identity and must provide a valid address to opt out. Marketing to business addresses is governed by national rules, which vary. Tracking pixels in marketing emails that report opens are also device access under Article 5(3) and may need consent.
Confidentiality, traffic and location data
For electronic communications services, the directive protects the confidentiality of communications and limits use of traffic data (such as call records) and location data to what is needed for transmission, billing or, with consent, value-added services. Providers must secure their services and notify personal data breaches to the national authority, under Regulation 611/2013 within 24 hours where feasible. Most SaaS products are not communications services, but messaging and calling features can bring parts of a product within scope.
How the ePrivacy Directive and GDPR work together
The ePrivacy Directive decides whether you can access the device. If consent is required under Article 5(3), the subsequent processing of personal data obtained must have a GDPR legal basis, and authorities expect that to be consent too, as legitimate interest cannot override a lack of ePrivacy consent. The GDPR's one-stop-shop mechanism does not apply to ePrivacy enforcement, so authorities in several countries can act against the same company. This is why French, Italian and other authorities have fined large technology companies tens or hundreds of millions of euros over cookie practices.
National implementation and enforcement
Because the directive is implemented nationally, details differ by country. Germany's rules sit in section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG). France's CNIL published guidelines and a recommendation in 2020 requiring that refusing be as easy as accepting, and it allows certain first-party audience measurement without consent if strictly configured. Italy's Garante issued cookie guidelines in 2021, and Spain's AEPD updated its cookie guide in 2023 to align with EDPB positions. Ireland and the Netherlands have run sweeps of popular websites and issued warnings.
Enforcement has been heavy. In January 2022, the CNIL fined Google a total of EUR 150 million and Facebook EUR 60 million because refusing cookies was harder than accepting them, and it has fined many retailers, publishers and technology firms since. Authorities increasingly use automated tools to check whether trackers fire before consent, which makes technical gating more important than banner wording.
Reform: ePrivacy Regulation and the Digital Omnibus
The Commission proposed an ePrivacy Regulation in 2017 to replace the directive with a directly applicable regulation. After years of stalled negotiations, the Commission withdrew it in 2025. In November 2025, the Commission proposed a Digital Omnibus package that would, among other changes, move rules on device access for personal data into the GDPR, add exemptions for low-risk purposes such as some audience measurement and security, and require respect for automated browser-based consent signals. As of October 2026, the proposal was still being negotiated between the Council and Parliament, and its final content could differ substantially. Until adopted and in force, current national ePrivacy rules apply.
How to comply, step by step
- Scan your site or app for cookies, local storage, pixels, SDKs and fingerprinting, including tags loaded by tag managers.
- Classify each as strictly necessary or requiring consent, by purpose.
- Implement a consent management platform with accept all, reject all and granular choices on the first layer.
- Block non-essential tags until consent, using tag manager consent modes or server-side gating.
- Write a cookie notice listing purposes, providers, durations and third-party access.
- Store consent records and re-ask at reasonable intervals.
- Make withdrawal easy with a persistent settings link.
- Review email and SMS marketing for consent or soft opt-in, and opt-out handling.
- Check mobile SDKs: initialise analytics and ad SDKs only after consent.
- Retest after every release, since new scripts slip in.
Documentation you will need
- Cookie and tracker inventory with purposes, providers and durations.
- Consent records and banner versions.
- Cookie notice and privacy notice.
- Marketing consent and opt-out records.
- Scan reports and release testing records.
- Data processing agreements with analytics and ad vendors.
Timeline and cost considerations
Implementing a compliant consent setup for a typical website or store takes days to a few weeks, depending on how many tags are involved. Costs include a consent management platform subscription, engineering to gate tags and SDKs, and periodic scans. Server-side analytics or privacy-friendly analytics tools can reduce the number of tags needing consent but do not remove the rules by themselves.
Common mistakes
- Banners that do not block anything, with tags firing before choice.
- No reject button on the first layer.
- Treating analytics as strictly necessary.
- Forgetting mobile SDKs and email tracking pixels.
- Assuming server-side tagging removes the need for consent.
- Ignoring national differences in enforcement and exceptions.
Best practices, tools and technologies
- Use a certified consent management platform compatible with your tag manager and ad stack.
- Use tag manager consent states to gate tags and fire nothing optional by default.
- Prefer first-party, minimal analytics configured for privacy.
- Run automated cookie scans in CI or after deployments.
- Respect Global Privacy Control for US users alongside EU consent; see US state privacy laws.
- Keep performance in mind: load the consent tool without hurting Core Web Vitals.
We build consent-aware tag loading, privacy-friendly analytics and fast-loading consent banners through our web application development and e-commerce services.
How it relates to other laws
| Law | Relationship |
|---|---|
| GDPR | Governs processing after device access and sets the consent standard. |
| UK GDPR and PECR | The UK equivalent, with some exemptions for analytics added by the Data (Use and Access) Act 2025. |
| Digital Services Act | Bans dark patterns on platforms and restricts targeted ads using sensitive data or to minors. |
| CCPA/CPRA | US opt-out model for sale and sharing, versus EU opt-in for device access. |
Real-world example
A Shopify-based store run by an Indian team sells to customers in Germany and France. A scan finds analytics, two ad pixels, a chat widget and a session replay tool. The team configures a consent platform with accept and reject buttons, sets the tag manager to deny all optional tags by default, loads the chat widget only when the user opens it, removes session replay, and confirms that a fresh browser visit sets only session and basket cookies before choice. Email marketing to past buyers uses soft opt-in with unsubscribe links, and new subscribers use double opt-in.
Next steps
- Scan your site and apps.
- Block optional trackers until consent.
- Add a first-layer reject option.
- Fix marketing consent and opt-outs.
- Track the Digital Omnibus.
Frequently asked questions
Do I need consent for analytics cookies?
Generally yes, unless a national exemption for privacy-configured audience measurement applies.
Do strictly necessary cookies need consent?
No. Cookies strictly necessary for a service the user explicitly requested, such as login and basket cookies, are exempt.
Does the cookie rule apply only to personal data?
No. Article 5(3) applies to any information stored on or read from the device.
Are pre-ticked boxes valid consent?
No. The Court of Justice ruled in Planet49 that pre-ticked boxes are not valid consent.
Must there be a reject all button?
Many authorities require rejecting to be as easy as accepting, usually with a reject option on the first layer.
Does server-side tracking avoid consent?
Not if the user's device is still instructed to send information; the EDPB guidelines take a broad view of device access.
Is the ePrivacy Regulation in force?
No. It was withdrawn in 2025.
What is the soft opt-in?
An exception allowing email marketing of similar products to existing customers who were given a chance to object.
Does the directive apply to companies outside the EU?
Yes, if they access the devices of users in the EU.
Will the Digital Omnibus change cookie rules?
It proposes to, but it was still under negotiation in October 2026; current rules apply until any change takes effect.
Who enforces cookie rules?
National authorities, often data protection authorities, under their national implementing laws.
Official sources
- Directive 2002/58/EC on privacy and electronic communications (consolidated) (EUR-Lex)
- Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive (European Data Protection Board)
- Case C-673/17 Planet49 (Court of Justice of the European Union)
- ePrivacy Regulation policy page (European Commission)
- Cookies and other tracking devices: CNIL guidelines (CNIL)
Review history
Last reviewed Oct 30, 2026. Next scheduled review Jan 30, 2027, or sooner if the Digital Omnibus is adopted or the EDPB issues new cookie or tracking guidance.
- : First published.
This guide explains the official requirements in plain language. It is not legal advice and does not tell you whether your organisation is compliant. Confirm with qualified counsel, your auditor or an accredited certification body.