Decide whether need consent, whether a limited analytics exemption can be supported, and what evidence must prove the configuration.
Built for privacy, product analytics, web engineering, consent-platform, legal, and regional operations teams that need cited cookie decisions without inventing country rules.
are not automatically exempt from EU ePrivacy consent rules. The starting point is Article 5(3): storing information on, or accessing information from, a user's terminal equipment generally requires clear information and consent unless a narrow exemption applies. For analytics, teams need a documented technical classification, consent or exemption rationale, live banner behavior, and country-specific checks where national implementation or regulator guidance controls the final answer.
The conservative EU-wide default is that and similar tracers require consent before they are deposited or read unless the deployment fits a narrow exemption. CNIL's analytics sheet states that audience-measurement tracers are subject to the consent rule unless they fall exactly within the described exemption perimeter, and it warns that national variation remains relevant.
If the analytics deployment supports advertising, cross-site measurement, partner attribution, user profiling, CRM enrichment, product personalization beyond measurement, or reuse across multiple publishers, do not classify it as exempt from EU-wide sources alone. Route it through consent unless a competent national rule and the actual configuration support a different conclusion.
Sources (3)
Supports the position that audience-measurement tracers generally require consent unless they fit CNIL's limited exemption conditions, with national variation flagged.
subject to the rule of consent
Supports consent-quality requirements: freely given, specific, informed, unambiguous, demonstrable, and withdrawable.
freely given, specific, informed and unambiguous
Supports checking reject options, pre-ticked boxes, deceptive link design, misleading visual emphasis, and withdrawal paths in cookie banners.
pre-ticked boxes
Article 5(3) exemptions are narrow: WP29 identifies transmission-only storage or access and storage or access strictly necessary for a service explicitly requested by the user. Its finding that some first-party analytics presents lower privacy risk does not itself exempt that analytics. A national audience-measurement exemption needs its own source and configuration assessment.
CNIL's 11 June 2020 sheet describes a historical French opt-out model with the conditions listed below. Check the current French eligibility rules before relying on it. For audience-measurement trackers that already qualify for exemption, CNIL's recommendation consolidated on 16 January 2026 recommends user information, a tracker lifetime suitable for meaningful audience comparison, such as 13 months without automatic renewal on repeat visits, a maximum 25-month retention period for collected information, and periodic review. Those recommendations do not establish eligibility or an EU-wide retention rule.
Sources (3)
Historical French regulator guidance dated 11 June 2020 describing an audience-measurement opt-out model. Verify current eligibility separately.
switch from an opt-in to an opt-out regime
For already-exempt audience-measurement trackers, recommends user information, a suitable tracker lifetime such as 13 months without automatic renewal, maximum 25-month retention of collected information, and periodic review. Eligibility must be established separately.
Supports the narrow Article 5(3) exemption tests and the rule that multipurpose cookies are exempt only if every purpose is exempt.
all the distinct purposes
The analytics decision should be reproducible from evidence, not from vendor labels. Keep the scanned cookie list, tag-manager rules, consent-management-platform configuration, event taxonomy, data-sharing settings, IP handling, retention settings, processor terms, and tests showing what fires before accept, after reject, after withdrawal, and after opt-out.
Consent logs matter when analytics is consent-based, but they are not the whole record. The team also needs proof that non-essential analytics is blocked until consent, reject and withdrawal choices are honored, and exempt or opt-out analytics remains within the exact configuration justified in the decision.
Sources (3)
Supports maintaining cookie lists, documenting purposes, demonstrating essentiality, and checking accessible withdrawal routes.
maintain such lists
Supports keeping evidence that consent was obtained validly and can be withdrawn as easily as it was given.
Demonstrate consent
Supports configuration evidence for analytics exemption claims, including IP truncation, tracker lifetime, and independent processing by a third-party processor.
trackers are independent
EU-level materials do not give a single operational answer for every analytics setup in every Member State. The ePrivacy Directive is implemented through national laws, national data protection authorities publish different levels of cookie guidance, and CNIL's analytics sheet itself warns that ePrivacy analytics guidance may be subject to national variation.
Do not state that a vendor, tag template, consent mode, or first-party analytics product is exempt across the EU merely because it can be configured with privacy controls. The final conclusion needs the actual configuration, the Member State position, and the evidence record.
Consent is the starting point unless a narrow exemption applies to the actual deployment under the relevant Member State rules. WP29 requires a purpose-and-implementation analysis; its finding that limited first-party analytics can present lower privacy risk does not itself establish an exemption.
No. CNIL is the French regulator, and the cited sheet is dated 11 June 2020 and flags national variation. Treat its conditions as a dated French example, then verify the current law and regulator guidance for every Member State relevant to the site or app.
They should prove the banner and purpose version shown, the user's affirmative choice or rejection, the timestamp and region, later withdrawal, and that analytics tags respected the choice in live tests.
Sources (3)
Supports warning readers that analytics-cookie conclusions may vary by national regulator position.
subject to national variation
Supports the need to assess actual technical access or storage rather than relying on product names.
gaining of access
Provides the baseline ePrivacy Directive framework for terminal-equipment consent and narrow exceptions, as implemented through Member State law.
terminal equipment
Sorena can help convert the analytics-cookie decisions on this page into cookie inventories, CMP checks, consent-log evidence, exemption rationales, and country-specific review prompts.
Ask questions tied to cited sources about analytics cookies, Article 5(3), consent quality, exemption criteria, and evidence records using the cited sources on this page.
Walk through cookie inventories, CMP behavior, consent logs, and limited analytics-exemption evidence with Sorena.
"subject to national variation"
"subject to the rule of consent"
"switch from an opt-in to an opt-out regime"
"trackers are independent"
"withdraw consent at any time"
"pre-ticked boxes"
"maintain such lists"
"freely given, specific, informed and unambiguous"
"Demonstrate consent"
"storage or access"
"Article 5(3) ePD applies"
"gaining of access"
"strictly necessary"
"purpose and the specific implementation"
"all the distinct purposes"
"terminal equipment"
Compare ePrivacy rules for device storage and access with DSA ad labels, advertiser disclosures, targeting information, profiling limits, and VLOP/VLOSE ad repositories.
Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence.
EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs.
A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence.
A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence.
Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay.
Build evidence that links each cookie or tracker decision to the banner shown, the user's signal, the live technical behavior, withdrawal, and later changes.
Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence.
Decide whether cookies, pixels, SDKs, local storage, identifiers, and analytics fall within Article 5(3), then document consent, an exemption, or escalation.
Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats.
Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up.
A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records.
Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats.
Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay.
Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats.
Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits.
Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence.
How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice.
Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits.
Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits.
Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing.
Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.
Compare the EU ePrivacy Directive with current UK PECR rules for device storage and access, statutory exceptions, consent, electronic-mail marketing, soft opt-ins, and enforcement.
Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats.
Decide whether an electronic-mail marketing audience meets every Article 13 soft opt-in condition, or must be suppressed or supported by valid prior consent.
Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks.
FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.
FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.
When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.
Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.
FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions.
FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.