EU ePrivacy Directive Cookies and Consent

Treat Article 5(3) as technology-neutral. The EDPB technical-scope guidance explains that cookies are only one example: tracking pixels, tracked URLs, JavaScript that makes the browser send data, local storage, fingerprinting-style signals, IoT reporting, and unique identifiers can also fall within the rule when information is stored on or accessed from terminal equipment.

Consent is needed before non-exempt storage or access. Assess each purpose instead of relying on the vendor or technical label. A first-party cookie can still need consent if it is used for tracking or advertising, and a multipurpose cookie is exempt only if every purpose independently qualifies for an exemption.

Do not add a personal-data threshold to the Article 5(3) test. The EDPB explains that the protected information can be personal or non-personal and need not have been stored by the same party that later accesses it. Personal-data classification becomes a separate question for GDPR duties.

The transmission exemption is narrow: the cookie or similar access must be used for the sole purpose of carrying out the transmission of a communication over an electronic communications network. WP29 gives load-balancing session cookies as an example when the information only identifies a server endpoint needed to carry the communication.

The strictly necessary exemption is also narrow. The functionality must be part of an information society service explicitly requested by the user, and the storage or access must be necessary for that specific functionality. User-input session cookies, shopping-cart cookies, authentication cookies for the logged-in session, user-centric security cookies, multimedia-player session cookies, and short-lived user-interface preference cookies may qualify when implemented within those limits.

Cookie consent is not valid just because a banner is visible. EDPB consent guidance requires consent to be freely given, specific, informed, and unambiguous, and the controller must be able to demonstrate it. The Cookie Banner Taskforce report identifies common banner problems such as relying on pre-ticked options or deceptive designs that make refusal harder than acceptance.

The consent flow should let users accept or refuse non-essential purposes before storage or access occurs, choose granular purposes where purposes differ, and return later to change their choice. Withdrawal must be as easy as giving consent in practice, so a one-click banner acceptance should not require a call, email, account request, or hidden path to undo. The EDPB taskforce report records common supervisory-authority positions, but national implementing law and competent-authority guidance still control the final country-specific banner assessment.

Consent evidence should prove both what the user chose and what the interface allowed at that time. The EDPB consent guidance says controllers should be able to show the session in which consent was expressed, the consent workflow, and the information presented. For cookies, that means saving CMP configuration, banner text and screenshots, purpose and vendor versions, tag-firing tests, and consent or refusal events without collecting excessive additional data.

Analytics requires a separate check. WP29 does not treat first-party analytics as strictly necessary under the two Article 5(3) exemptions, and national approaches to audience-measurement exemptions are not uniform. Current French guidance limits its exemption to publisher-exclusive audience measurement that produces anonymous statistics and does not allow cross-checking, non-anonymous third-party transmission, or cross-site or cross-app tracking. If relying on any national analytics exemption, cite the current local rule, document the live configuration and retention limits, and do not present a provider self-assessment as regulator certification.

The ePrivacy rule decides whether terminal-equipment storage or access is allowed. The GDPR can still apply to subsequent processing when the cookie, pixel, SDK, or identifier leads to personal-data processing. The EDPB Cookie Banner Taskforce report and Opinion 5/2019 both describe this coexistence: ePrivacy governs placement or reading, while the GDPR governs later personal-data processing and consent conditions where consent is used as the GDPR lawful basis.

Do not treat Article 5(3) consent as a full GDPR compliance answer. The cookie record should connect the storage/access decision to the GDPR record of processing, lawful basis, controller or joint-controller analysis, processor terms, transparency notices, data-subject rights handling, retention, international transfer checks, and security controls where personal data is processed.