Decide whether analytics cookies need consent, whether a limited analytics exemption can be supported, and what evidence must prove the configuration.
Built for privacy, product analytics, web engineering, consent-platform, legal, and regional operations teams that need source-linked cookie decisions without inventing country rules.
Structured answer sets in this page tree.
Cited legal and guidance references.
Analytics cookies are not automatically exempt from EU ePrivacy consent rules. The starting point is Article 5(3): storing information on, or accessing information from, a user's terminal equipment generally requires clear information and consent unless a narrow exemption applies. For analytics, teams need a documented technical classification, consent or exemption rationale, live banner behavior, and country-specific checks where national implementation or regulator guidance controls the final answer.
The conservative EU-wide default is that analytics cookies and similar tracers require consent before they are deposited or read unless the deployment fits a narrow exemption. CNIL's analytics sheet states that audience-measurement tracers are subject to the consent rule unless they fall exactly within the described exemption perimeter, and it warns that national variation remains relevant.
If the analytics deployment supports advertising, cross-site measurement, partner attribution, user profiling, CRM enrichment, product personalization beyond measurement, or reuse across multiple publishers, do not classify it as exempt from EU-wide sources alone. Route it through consent unless a competent national rule and the actual configuration support a different conclusion.
A limited analytics exemption is not a generic ePrivacy safe harbor. WP29 explains that Article 5(3) exemptions are narrow: the cookie must be for network transmission, or strictly necessary for a service or functionality explicitly requested by the user. For analytics, CNIL describes a more specific national-regulator path where audience-measurement cookies may move from opt-in to opt-out only if listed conditions are met.
Use the CNIL criteria as a grounded example of what a limited analytics configuration can look like. In practice, you still need to check the local law and regulator guidance for each Member State, and you should document the implementation evidence that shows the actual setup matches the claimed exemption.
The analytics decision should be reproducible from evidence, not from vendor labels. Keep the scanned cookie list, tag-manager rules, consent-management-platform configuration, event taxonomy, data-sharing settings, IP handling, retention settings, processor terms, and tests showing what fires before accept, after reject, after withdrawal, and after opt-out.
Consent logs matter when analytics is consent-based, but they are not the whole record. The team also needs proof that non-essential analytics is blocked until consent, reject and withdrawal choices are honored, and exempt or opt-out analytics remains within the exact configuration justified in the decision.
EU-level materials do not give a single operational answer for every analytics setup in every Member State. The ePrivacy Directive is implemented through national laws, national data protection authorities publish different levels of cookie guidance, and CNIL's analytics sheet itself warns that ePrivacy analytics guidance may be subject to national variation.
Do not state that a vendor, tag template, consent mode, or first-party analytics product is exempt across the EU merely because it can be configured with privacy controls. The final conclusion needs the actual configuration, the Member State position, and the evidence record.
No, but consent is the default starting point unless a narrow exemption is supported. CNIL describes limited audience-measurement conditions that may allow an opt-out model, while WP29 and EDPB sources require a purpose-and-implementation analysis.
No. CNIL is a national regulator source and the sheet flags national variation. Use it as grounded support for limited analytics-exemption criteria, then verify the Member State rules that apply to the site or app.
They should prove the banner and purpose version shown, the user's affirmative choice or rejection, the timestamp and region, later withdrawal, and that analytics tags respected the choice in live tests.
Sorena can help convert the analytics-cookie decisions on this page into cookie inventories, CMP checks, consent-log evidence, exemption rationales, and country-specific review prompts.
Ask source-linked questions about analytics cookies, Article 5(3), consent quality, exemption criteria, and evidence records using the cited sources on this page.
Walk through cookie inventories, CMP behavior, consent logs, and limited analytics-exemption evidence with Sorena.
"subject to national variation"
"terminal equipment"
"maintain such lists"
"Demonstrate consent"
"gaining of access"
"all the distinct purposes"