Deep DiveEU

EU ePrivacy Directive Enforcement

How regulators assess cookie banners, consent UX, and evidence.

Focus: enforcement triggers, investigation readiness, and an evidence pack you can export fast.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

ePrivacy enforcement is rarely about legal theory in isolation. It is about observable outcomes: did your site/app place or read trackers without valid consent (or without a valid exemption)? Did users have a real reject option? Can users withdraw as easily as they consented? And can you prove it with repeatable evidence (CMP configuration exports, logs, and tests)? This page shows how enforcement typically works and how to be investigation-ready.

Section 1

Who enforces the ePrivacy Directive (and why enforcement is fragmented)

The ePrivacy Directive is implemented through national laws. Enforcement competence is therefore national and can involve different bodies depending on the Member State (e.g., telecom regulators, DPAs, or other authorities).

EDPB guidance emphasizes that the Directive explicitly allows more than one national body to be competent and requires Member States to provide effective enforcement powers (cessation orders, investigative powers, cross-border cooperation).

Expect enforcement to be market-specific: the same banner pattern can be assessed differently across Member States.
Build a single evidence pack, but add country overlays (local guidance, language, and implementation nuances).
Plan for cross-border cooperation expectations for widespread services.

Recommended next step

Use EU ePrivacy Directive Enforcement as a cited research workflow

Research Copilot can take EU ePrivacy Directive Enforcement from understanding exposure and enforcement with cited answers to a reusable workflow inside Sorena. Teams working on EU ePrivacy Directive can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Research workflow

Open Research Copilot for EU ePrivacy Directive Enforcement

Start from EU ePrivacy Directive Enforcement and answer scope, timing, and interpretation questions with cited outputs.

Explore next step

Talk to Sorena

Talk through EU ePrivacy Directive

Review your current process, evidence gaps, and next steps for EU ePrivacy Directive Enforcement.

Explore next step

Section 2

What triggers enforcement in cookie banner cases (common denominator positions)

The EDPB Cookie Banner Taskforce report reflects the shared interpretation used to handle cookie-banner complaints across multiple authorities (with national requirements still applying).

Treat it as an enforcement-oriented checklist for banner UX, consent validity, and withdrawal.

No consent-by-default: consent-requiring cookies/trackers must not be set before consent is expressed by a positive action.
No "accept only" pattern: a majority of authorities considered missing reject/refuse options (on any layer that offers consent) not in line with valid consent requirements.
No confusing "double refusal" patterns: users should not have to refuse multiple times due to mixed ePrivacy and GDPR framing in deeper layers.
No legitimate interest for placement/reading: the legal basis for the placement/reading under Article 5(3) cannot be legitimate interests.
Withdrawal needs to be easy and accessible (e.g., persistent link/icon to reopen choices), assessed case-by-case.

Section 3

Investigation-ready evidence pack (what you should export in < 48 hours)

Enforcement becomes painful when teams cannot prove what happened in production. Build evidence that is attributable, versioned, and reproducible.

Design your proof so it answers: what was deployed, what users saw, what choices were available, and what trackers actually fired.

Tracker inventory and decision table: purpose, exemption rationale, vendors, and markets.
CMP/banner configuration export: purposes, vendors, default states, geo rules, and UI variants.
Consent log schema: timestamp, locale, user choice per purpose/vendor, banner version, and proof of withdrawal.
Tag manager and SDK enforcement evidence: pre-consent blocking rules and post-consent activation mapping.
Automated tests: screenshots/flows verifying "reject all", "save preferences", and "withdraw" paths.

Section 4

How to respond to a complaint or regulator inquiry (fast, consistent, and calm)

Treat enforcement response like an incident: intake -> triage -> evidence export -> remediation -> follow-up. Your goal is controlled, explainable change rather than rushed edits.

If the allegation is about cookie banners, validate production behavior with real network traces and device tests (not only CMP screenshots).

Freeze the deployed config (export CMP + tag manager settings and store them with a timestamp).
Reproduce key flows with fresh devices/browsers and capture trace evidence (what fired pre-consent vs post-consent).
Document root cause and remediate with a measured release (include regression tests).
Update your decision table and evidence index; communicate changes internally and to vendors.

Primary sources