Decide whether analytics cookies need consent, whether a limited analytics exemption can be supported, and what evidence must prove the configuration.
Built for privacy, product analytics, web engineering, consent-platform, legal, and regional operations teams that need cited cookie decisions without inventing country rules.
Structured answer sets in this page tree.
Cited legal and guidance references.
are not automatically exempt from EU ePrivacy consent rules. The starting point is Article 5(3): storing information on, or accessing information from, a user's terminal equipment generally requires clear information and consent unless a narrow exemption applies. For analytics, teams need a documented technical classification, consent or exemption rationale, live banner behavior, and country-specific checks where national implementation or regulator guidance controls the final answer.
The conservative EU-wide default is that and similar tracers require consent before they are deposited or read unless the deployment fits a narrow exemption. CNIL's analytics sheet states that audience-measurement tracers are subject to the consent rule unless they fall exactly within the described exemption perimeter, and it warns that national variation remains relevant.
If the analytics deployment supports advertising, cross-site measurement, partner attribution, user profiling, CRM enrichment, product personalization beyond measurement, or reuse across multiple publishers, do not classify it as exempt from EU-wide sources alone. Route it through consent unless a competent national rule and the actual configuration support a different conclusion.
A limited analytics exemption is not a generic ePrivacy safe harbor. WP29 explains that Article 5(3) exemptions are narrow: the cookie must be for network transmission, or strictly necessary for a service or functionality explicitly requested by the user. For analytics, CNIL describes a more specific national-regulator path where audience-measurement cookies may move from opt-in to opt-out only if listed conditions are met.
Use the conditions in CNIL's 11 June 2020 sheet as a historical French regulator example, not as a current EU-wide safe harbor. CNIL's current material, published on 4 July 2025, focuses the French exemption on audience measurement for the publisher's exclusive account, anonymous statistics, no cross-checking with other processing, no non-anonymous data transmission to third parties, and no tracking across sites or apps. It recommends user information, a tracer lifetime no longer than needed for meaningful comparison, 13 months as an example, no automatic extension on repeat visits, a maximum 25-month retention period for collected information, and periodic review. Before relying on the exemption, document the live configuration against the current French material or the applicable authority's current rule for another Member State.
The analytics decision should be reproducible from evidence, not from vendor labels. Keep the scanned cookie list, tag-manager rules, consent-management-platform configuration, event taxonomy, data-sharing settings, IP handling, retention settings, processor terms, and tests showing what fires before accept, after reject, after withdrawal, and after opt-out.
Consent logs matter when analytics is consent-based, but they are not the whole record. The team also needs proof that non-essential analytics is blocked until consent, reject and withdrawal choices are honored, and exempt or opt-out analytics remains within the exact configuration justified in the decision.
EU-level materials do not give a single operational answer for every analytics setup in every Member State. The ePrivacy Directive is implemented through national laws, national data protection authorities publish different levels of cookie guidance, and CNIL's analytics sheet itself warns that ePrivacy analytics guidance may be subject to national variation.
Do not state that a vendor, tag template, consent mode, or first-party analytics product is exempt across the EU merely because it can be configured with privacy controls. The final conclusion needs the actual configuration, the Member State position, and the evidence record.
No, but consent is the default starting point unless a narrow exemption is supported. CNIL describes limited audience-measurement conditions that may allow an opt-out model, while WP29 and EDPB sources require a purpose-and-implementation analysis.
No. CNIL is the French regulator, and the cited sheet is dated 11 June 2020 and flags national variation. Treat its conditions as a dated French example, then verify the current law and regulator guidance for every Member State relevant to the site or app.
They should prove the banner and purpose version shown, the user's affirmative choice or rejection, the timestamp and region, later withdrawal, and that analytics tags respected the choice in live tests.
Sorena can help convert the analytics-cookie decisions on this page into cookie inventories, CMP checks, consent-log evidence, exemption rationales, and country-specific review prompts.
Ask questions tied to cited sources about analytics cookies, Article 5(3), consent quality, exemption criteria, and evidence records using the cited sources on this page.
Walk through cookie inventories, CMP behavior, consent logs, and limited analytics-exemption evidence with Sorena.
"subject to national variation"
"terminal equipment"
"maintain such lists"
"Demonstrate consent"
"gaining of access"
"all the distinct purposes"