How to implement Article 5(3) as an engineering and evidence system.
Focus: exemptions test, analytics/ads trackers, CMP configuration, and proof.
Structured answer sets in this page tree.
Cited legal and guidance references.
Cookie compliance fails when teams treat consent as a UI pop-up instead of a controlled system. Article 5(3) requires a tracker-by-tracker decision: consent or exemption. WP29 guidance gives a practical test for the exemption criteria. This page shows how to operationalize that test, design a CMP that enforces outcomes, and maintain evidence that stands up to enforcement.
Start with a full inventory across web and apps (cookies, local storage, SDK identifiers, pixels, fingerprinting-like techniques).
For each tracker, you need a defensible "consent required vs exemption" decision and proof that implementation matches.
WP29 Opinion 04/2012 analyzes the two exemption criteria and emphasizes narrow interpretation.
Use the test below as an internal acceptance checklist before classifying anything as exempt.
Most analytics cookies/SDKs are not "strictly necessary" for providing the service explicitly requested by the user.
If you want a low-risk posture, treat analytics as consent-based unless you have a very specific, defensible exemption rationale.
Research Copilot can take EU ePrivacy Directive Cookies and Consent from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on EU ePrivacy Directive can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU ePrivacy Directive Cookies and Consent and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for EU ePrivacy Directive Cookies and Consent.
Your CMP must (1) collect a clear choice, (2) enforce it across all trackers, and (3) log enough to prove what happened.
Make your CMP configuration exportable and versioned so you can answer complaints quickly.
Enforcement is evidence-driven. If you can't export your decisions and logs, you will struggle.
Build an evidence index and rehearse exports.