ePrivacy Directive

Ask most people why cookie banners exist and they will say GDPR. That answer is only half right. The rule that decides whether a website may place or read something on your device is older, narrower and written into a different law: the ePrivacy Directive (Directive 2002/58/EC).Understanding how it works alongside the GDPR is the key to getting ePrivacy Directive cookies right.

This post explains what that rule says, which technologies it covers, when consent is required, how it fits with GDPR, and where the law stands today. Legal requirements are kept separate from regulator expectations and good practice, because the two are often confused.

Two laws, two jobs

GDPR (Regulation 2016/679) governs what organisations may do with personal data. The ePrivacy Directive governs access: whether a company may store information on your device, or read information from it, in the first place.

The two overlap but are not the same. Article 5(3) protects "information", which is wider than personal data, so it can apply even when nobody could identify the visitor. GDPR applies only once personal data is processed. A single cookie can therefore trigger both laws, and satisfying one does not satisfy the other.

Where the law stands today

The ePrivacy Directive was adopted in 2002 and amended in 2009. It is a Directive, not a Regulation, so it does not bind website owners directly. Each Member State wrote its own implementing law, and that national law is what a regulator enforces. Details, and the regulator, differ between countries.

Two developments are often misreported. The Commission proposed an ePrivacy Regulation in 2017 to replace the Directive, but withdrew it in 2025, so it never became law. And in November 2025 the Commission proposed a Digital Omnibus (COM(2025) 837) that would move part of the device-access rules into GDPR through a new Article 88a. That is a proposal only. Parliament and Council have not adopted it, and reports on the Council's position conflict, so check the legislative procedure (2025/0360(COD)) before relying on any change. For now, the Directive and your national implementing law remain the rules.

Article 5(3): the rule behind cookie consent

Article 5(3) allows storing information on a user's device, or gaining access to information already stored there, only on condition that the user has given consent after receiving clear and comprehensive information, including about the purposes. Consent is therefore the starting point, and it has to come before the storage or access happens. A technology that fires first and asks later does not fit that wording.

The EDPB's Guidelines 2/2023 analyse its key notions: "information", "terminal equipment", "electronic communications network", "gaining access" and "storage". They treat the rule as technology-neutral.

It is not only about cookies

The word "cookie" does not appear in Article 5(3). What matters is what a technology does. Depending on how they work, the following can all be caught: tracking pixels, URL-based tracking, local storage, mobile SDK identifiers, device fingerprinting and reading an operating-system identifier. "Terminal equipment" includes phones, laptops, connected TVs, connected cars and other connected devices. Renaming a cookie as a pixel does not take you outside the rule. It does not follow that every such technology needs consent, because the exceptions still apply.

Which technologies need consent?

Article 5(3) contains two exceptions. No consent is needed for technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or where it is strictly necessary for the provider to deliver an information society service the user explicitly requested. The test is judged against the service the visitor asked for, not against the operator's business model. A cookie that is merely useful to you is not exempt.

As an illustration only, a login session cookie or shopping-cart cookie will usually be exempt, while advertising and cross-site tracking technologies will not. Two areas need care. Analytics: there is no EU-wide rule that analytics is always exempt or always needs consent. Some national regulators, such as the CNIL in France, accept narrow audience-measurement exemptions on strict conditions, and those do not travel across borders. Personalisation: a setting the user chose, such as language, differs from behavioural profiling.

What valid consent requires

The Directive requires consent "in accordance with" the data protection standard. Since GDPR replaced the 1995 Directive, references to it are read as references to GDPR, so consent must be freely given, specific, informed and unambiguous, shown by a clear affirmative act (Articles 4(11) and 7).

The Court of Justice applied this in Planet49 (Case C-673/17, 1 October 2019). It held that pre-ticked boxes are not valid consent, that the rule covers information whether or not it is personal data, and that users must be told how long cookies last and whether third parties can access them. The EDPB's consent guidelines (05/2020) also reject scrolling or continued browsing as consent.

Be careful to separate what the text says from what regulators expect. Article 5(3) does not literally require a "Reject all" button. But the EDPB's cookie banner taskforce and authorities such as the CNIL expect refusal to be as easy as acceptance, and treat deceptive banner design as a problem, so a first-layer reject option is the prudent standard. Withdrawal of consent should be as easy as giving it, which comes from GDPR Article 7(3). Cookie walls, which block access unless the visitor accepts, are viewed strictly by the EDPB as not freely given, but national positions and facts vary, so avoid assuming they are always unlawful or always acceptable.

What website owners should do

Start before the banner. A practical sequence:

1. Inventory every cookie, pixel, local-storage item, SDK and third-party script, including those added by marketing tools.
2. Record what each one stores or reads, why, for how long, and which vendors receive it.
3. Decide whether an exception applies, judged against the service the visitor explicitly requested.
4. If none applies, obtain valid consent before the technology fires, with clear information about purposes.
5. If personal data is involved, check GDPR separately: lawful basis, transparency, processor contracts and data subject rights.
6. Check the national implementing law and regulator guidance for each country you target.

Good practice, strongly supported by regulators rather than written in Article 5(3):

1. Place a reject option on the first layer, as prominent as accept.
2. Keep records of consent so you can demonstrate it.
3. Re-scan regularly, because trackers change when vendors update their code.

Enforcement is real

Penalties for breaching Article 5(3) are set by each Member State, which must make them effective, proportionate and dissuasive (Article 15a). In September 2025 the CNIL fined Shein's operating entity €150 million. It found that cookies were placed without consent, that users' choices were not respected and that information was incomplete. The lesson is practical: a banner does not cure trackers that fire before consent or ignore a refusal.

The rest of the Directive

Cookies are one part of a wider law. The Directive also protects the confidentiality of communications (Article 5(1)), limits the use of traffic and location data (Articles 6 and 9), requires prior consent for unsolicited direct marketing by email, automated calls and fax, subject to a limited exception for existing customers (Article 13), and lets Member States restrict these rights for public security and crime prevention only where necessary, appropriate and proportionate (Article 15). Data retention case law grew from Article 15.

What the Digital Omnibus proposes

As proposed, the Omnibus would add GDPR Article 88a, keep consent as the general rule for storing or accessing personal data on a person's device, and list limited cases needing no consent: transmission, a service the user requested, aggregated audience measurement by the provider for its own use, and security. It would require a single-click way to refuse and bar a new request for the same purpose for at least six months after refusal. A proposed Article 88b would require sites to honour machine-readable consent signals once standards exist, with media service providers exempt. Article 5(3) would no longer apply where the user is a natural person and personal data is involved. All of this is a proposal, and it may change or be dropped.

The bottom line

The EU cookie law is Article 5(3) of the ePrivacy Directive, applied through national law. It protects the device, covers any information stored on it or read from it, and makes consent the default subject to two narrow exceptions. GDPR then applies alongside it when personal data is involved. The proposed Digital Omnibus may change how this is organised, but until a final text is adopted and applies, it has not.

The safest cookie strategy is not to start with the banner. Start by understanding what your website is actually doing behind the scenes.

That is where real cookie compliance begins.

GrantCookie can help website owners identify trackers, manage consent and maintain records of visitor choices turning cookie compliance from a one-time banner setup into an ongoing process.