A source-backed guide to when cookies and similar technologies need consent under Article 5(3), when the transmission or exemptions may apply, and what evidence a cookie program should keep.
Built for privacy, product, analytics, marketing, legal, engineering, and consent-management owners who need banner UX, consent logs, withdrawal controls, and GDPR follow-on processing to line up.
Article 5(3) requires consent before storing information on, or gaining access to information already stored in, a subscriber's or user's unless one of two exemptions applies. The operation must be solely for transmitting a communication over an electronic communications network, or for the provider to deliver an information society service explicitly requested by the user. The rule protects information on the device whether or not that information is personal data. GDPR applies as well when the operation or later use processes personal data.
The transmission exemption is narrow: the cookie or similar access must be used for the sole purpose of carrying out the transmission of a communication over an electronic communications network. WP29 gives load-balancing session cookies as an example when the information only identifies a server endpoint needed to carry the communication.
The exemption is also narrow. The functionality must be part of an information society service explicitly requested by the user, and the storage or access must be necessary for that specific functionality. User-input session cookies, shopping-cart cookies, authentication cookies for the logged-in session, user-centric security cookies, multimedia-player session cookies, and short-lived user-interface preference cookies may qualify when implemented within those limits.
Sources (3)
Defines the two Article 5(3) exemption criteria and gives examples of exempt and non-exempt cookie uses.
sole purpose of carrying out the transmission
Sets the legal language for technical storage/access used only for transmission or strictly necessary service delivery.
strictly necessary in order for the provider
Shows the amended consent wording for storing information or gaining access to information already stored in terminal equipment.
has given his or her consent
Cookie consent is not valid just because a banner is visible. EDPB consent guidance requires consent to be freely given, specific, informed, and unambiguous, and the controller must be able to demonstrate it. The Cookie Banner Taskforce report identifies common banner problems such as relying on pre-ticked options or deceptive designs that make refusal harder than acceptance.
The consent flow should let users accept or refuse non-essential purposes before storage or access occurs, choose granular purposes where purposes differ, and return later to change their choice. Withdrawal must be as easy as giving consent in practice, so a one-click banner acceptance should not require a call, email, account request, or hidden path to undo. The EDPB taskforce report records common supervisory-authority positions, but national implementing law and competent-authority guidance still control the final country-specific banner assessment.
Sources (3)
Defines valid GDPR consent conditions used for cookie consent quality and withdrawal mechanics.
freely given, specific, informed and unambiguous
Summarizes supervisory authority positions on cookie-banner complaints, including banner practices assessed against ePrivacy and GDPR concepts.
Cookie Banner Taskforce
Supports the rule that preselected boxes are not sufficient for cookie consent and that users must receive relevant cookie information.
preselected checkbox
Consent evidence should prove both what the user chose and what the interface allowed at that time. The EDPB consent guidance says controllers should be able to show the session in which consent was expressed, the consent workflow, and the information presented. For cookies, that means saving CMP configuration, banner text and screenshots, purpose and vendor versions, tag-firing tests, and consent or refusal events without collecting excessive additional data.
Analytics requires a separate check. WP29 does not treat first-party analytics as under the two Article 5(3) exemptions, and national approaches to audience-measurement exemptions are not uniform. Current French guidance limits its exemption to publisher-exclusive audience measurement that produces anonymous statistics and does not allow cross-checking, non-anonymous third-party transmission, or cross-site or cross-app tracking. If relying on any national analytics exemption, cite the current local rule, document the live configuration and retention limits, and do not present a provider self-assessment as regulator certification.
Sources (4)
Supports consent recordkeeping, proof of the consent workflow, and easy withdrawal requirements.
demonstrate that valid consent has been obtained
Explains why analytics, advertising, and tracking purposes generally need careful consent analysis rather than automatic exemption treatment.
behavioural advertising, analytics or market research
Provides national regulator guidance on analytics configurations, useful as a caveat that audience-measurement exemptions depend on strict conditions and local implementation.
audience measurement
Supports the current French criteria for exempt audience measurement, retention recommendations, configuration evidence, and the warning that provider self-assessment is not CNIL certification or validation.
Sorena can help convert cookie inventories, CMP settings, consent logs, exemption claims, analytics configuration, and GDPR processing records into a cited workflow for ePrivacy review.
Ask questions tied to cited sources about Article 5(3), cookie exemptions, consent UX, withdrawal, analytics, and GDPR interplay using the cited sources on this page.
Review your cookie banner, tracker register, consent logs, analytics setup, and exemption evidence with Sorena.
"Cookie Consent Exemption"
"the purpose and the specific implementation"
"sole purpose of carrying out the transmission"
"behavioural advertising, analytics or market research"
"storing of information, or the gaining of access"
"strictly necessary in order for the provider"
"Cookie Banner Taskforce"
"subsequent processing activities"
"freely given, specific, informed and unambiguous"
"demonstrate that valid consent has been obtained"
"future proof legal framework for online privacy"
"has given his or her consent"
"technical operations covered by Article 5(3)"
"governed by provisions of both"
"preselected checkbox"
"audience measurement"
Compare ePrivacy rules for device storage and access with DSA ad labels, advertiser disclosures, targeting information, profiling limits, and VLOP/VLOSE ad repositories.
Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence.
EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs.
Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps.
A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence.
A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence.
Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay.
Build evidence that links each cookie or tracker decision to the banner shown, the user's signal, the live technical behavior, withdrawal, and later changes.
Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence.
Decide whether cookies, pixels, SDKs, local storage, identifiers, and analytics fall within Article 5(3), then document consent, an exemption, or escalation.
Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats.
Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up.
A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records.
Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats.
Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats.
Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits.
Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence.
How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice.
Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits.
Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits.
Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing.
Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.
Compare the EU ePrivacy Directive with current UK PECR rules for device storage and access, statutory exceptions, consent, electronic-mail marketing, soft opt-ins, and enforcement.
Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats.
Decide whether an electronic-mail marketing audience meets every Article 13 soft opt-in condition, or must be suppressed or supported by valid prior consent.
Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks.
FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.
FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.
When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.
Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.
FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions.
FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.