--- title: "EU ePrivacy Directive Enforcement and Fines" canonical_url: "https://www.sorena.io/artifacts/eu/eprivacy-directive/enforcement-and-fines" source_url: "https://www.sorena.io/artifacts/eu/eprivacy-directive/enforcement-and-fines" author: "Sorena AI" description: "Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits." published_at: "2026-05-09" updated_at: "2026-07-16" keywords: - "EU ePrivacy Directive enforcement" - "Article 15a" - "ePrivacy fines" - "cookie consent enforcement" - "GDPR ePrivacy interplay" - "Article 5(3)" - "national transposition" - "EU ePrivacy Directive" - "ePrivacy enforcement" - "cookies" - "GDPR interplay" - "consent banners" - "direct marketing" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU ePrivacy Directive Enforcement and Fines Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits. *Artifact Guide* *EU* ## EU ePrivacy Directive Enforcement and Fines The ePrivacy Directive does not create a single EU-wide fine table. Article 15a requires Member States to set and implement effective, proportionate, and dissuasive penalties for national ePrivacy rules. This page helps separate EU-level duties from national enforcement, understand when GDPR supervisory practice is relevant, and maintain evidence for cookies, terminal-equipment access, communications data, and direct marketing. ePrivacy enforcement is national in operation. The Directive sets the EU-level frame: Member States must transpose the rules, provide penalties, empower competent authorities, and support cross-border cooperation. For an organization, the practical question is not "what is the EU fine amount?" but which national ePrivacy law applies to the conduct, which authority can act, whether GDPR also governs later personal-data processing, and what evidence shows the risk was controlled. ## What Article 15a actually says about penalties Article 15a is the enforcement anchor. It requires Member States to lay down rules on penalties, including criminal sanctions where appropriate, for infringements of national provisions adopted under the Directive. Those penalties must be effective, proportionate, and dissuasive, and they may cover the period of a breach even if the breach has later been corrected. The same article requires competent national authorities, and where relevant other national bodies, to be able to order cessation of infringements and to have investigative powers and resources, including power to obtain relevant information needed to monitor and enforce national ePrivacy rules. - Do not state a single EU-wide maximum fine for the current Directive unless a national law source supports it. - Map each risk to the Member State law that transposes the relevant ePrivacy duty. - Record which authority or authorities have penalty, investigation, cessation, or cooperation powers in that Member State. - Treat remedied issues as still potentially relevant, because Article 15a allows penalties to cover the period of a breach. Sources for this answer: - [Directive 2002/58/EC as amended by Directive 2009/136/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02009L0136-20201221&ref=sorena.io) - Article 15a requires Member States to set penalties and ensure competent authorities can stop, investigate, and enforce infringements of national ePrivacy provisions. - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://www.edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Explains that Member States can allocate ePrivacy enforcement to one or more bodies and that Article 15a gives discretion over penalties and enforcement design. ## Why national transposition controls fine exposure The Directive sets objectives and minimum enforcement features, but national law supplies the concrete penalty rules and authority powers. EDPB Opinion 5/2019 states that Member States have chosen different ways to allocate ePrivacy enforcement and that the Directive does not require only one national body to be competent. That means a cross-border website, app, telecom service, CRM campaign, or analytics stack needs a country-by-country enforcement map before anyone can estimate sanctions. The EU-level sources support the principle of national penalties; they do not support a universal country penalty table on this page. - Keep a transposition register for each launch country and each ePrivacy trigger: cookies, similar storage, traffic data, location data, directories, unsolicited communications, or confidentiality controls. - For each country, record the competent authority, complaint route, order-to-cease power, investigation power, and penalty source. - Separate national ePrivacy exposure from GDPR exposure for later personal-data processing. - Escalate before using one Member State's regulator guidance as a blanket EU rule. Sources for this answer: - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://www.edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Supports the distinction between EU ePrivacy obligations and nationally assigned enforcement competence, including the possibility of multiple competent bodies. - [European Commission ePrivacyEU factsheet](https://digital-strategy.ec.europa.eu/en/library/eprivacyeu-towards-future-proof-legal-framework-online-privacy?ref=sorena.io) - Commission material explains the policy goal of modernising ePrivacy and reducing divergent rules; this is useful context, not a current Directive fine table. ## How GDPR supervisory practice fits, and where it stops ePrivacy and GDPR can apply to the same user journey, but not always to the same processing operation. For cookie placement or reading, the Cookie Banner Taskforce confirmed that the applicable framework is national law transposing the ePrivacy Directive. For subsequent personal-data processing after terminal-equipment access, GDPR can apply. EDPB Opinion 5/2019 adds an important limit: GDPR supervisory authorities remain competent to enforce the GDPR, but they can directly enforce national ePrivacy rules only if national law gives them that competence. GDPR cooperation and consistency mechanisms do not apply to enforcement of national ePrivacy implementation as such, although they remain available for GDPR issues. - Split the evidence file into ePrivacy access evidence and GDPR subsequent-processing evidence. - Use GDPR consent guidance where national ePrivacy law relies on GDPR consent concepts. - Do not assume the GDPR one-stop-shop mechanism resolves an ePrivacy-only cookie complaint. - When one authority enforces both regimes, identify which legal basis supports each finding or order. Sources for this answer: - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Confirms the split between national ePrivacy law for cookie placement or reading and GDPR for subsequent processing, and notes that the GDPR one-stop-shop does not apply to ePrivacy issues. - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://www.edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Grounds the limit that data protection authorities cannot directly enforce national ePrivacy rules unless Member State law grants that competence. - [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf?ref=sorena.io) - Provides GDPR consent criteria used where ePrivacy rules depend on valid consent, including demonstrability and withdrawal requirements. ## Cookie and consent evidence that reduces enforcement risk Cookie-banner enforcement risk is usually evidentiary. Authorities and complainants can test whether non-essential cookies or similar technologies are set before consent, whether reject choices are available and understandable, whether pre-ticked boxes are used, whether design pushes acceptance, and whether withdrawal is as easy as giving consent. For Article 5(3), the technical inventory must cover more than browser cookies. EDPB Guidelines 2/2023 address storage of, or access to, information in terminal equipment across technologies, so evidence should cover SDKs, pixels, local storage, device identifiers, IoT access, and similar mechanisms where relevant. - Keep timestamped scans showing what storage or access occurs before any user choice. - Preserve screenshots and configuration exports for each banner layer, including accept, reject, settings, and withdrawal paths. - Maintain a cookie and tracker inventory with purpose, provider, duration, first-party or third-party status, exemption claim, and consent dependency. - Log consent events and withdrawal events in a way that shows the wording, version, country, language, and user choice presented at the time. - Retest after CMP, tag manager, SDK, analytics, advertising, A/B testing, and release changes. Sources for this answer: - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Identifies recurring complaint patterns, including missing reject options, pre-ticked boxes, misleading design, essential-cookie classification, and withdrawal accessibility. - [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en?ref=sorena.io) - Supports a broad technical inventory for storage or access to terminal equipment, not a cookies-only review. - [WP29 Opinion 04/2012 on Cookie Consent Exemption](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf?ref=sorena.io) - Grounds strict analysis of consent exemptions, including the need to link any exemption to a communication purpose or a service explicitly requested by the user. - [CNIL Sheet 16 on analytics for websites and applications](https://www.cnil.fr/en/sheet-ndeg16-use-analytics-your-websites-and-applications?ref=sorena.io) - Shows why analytics exemptions are fact-specific and nationally variable, so analytics evidence should not rely on an unsourced EU-wide exemption claim. ## Explicit limits for enforcement and fines claims This page intentionally avoids country fine amounts, regulator penalty matrices, and national rules not present in the cited sources. The EU-level sources support the enforcement architecture and evidence priorities, but they do not provide a complete operational answer for every Member State. They also do not turn the withdrawn 2017 ePrivacy Regulation proposal's fine levels into current ePrivacy Directive penalties. Proposal materials are historical policy context only; current Directive exposure must be checked against national transposition and the competent authority's powers. - Blocked without national sources: exact fine caps, limitation periods, appeal routes, criminal sanctions, and named competent authorities by Member State. - Blocked without product facts: whether a specific cookie, SDK, pixel, or analytics deployment is exempt from consent. - Blocked without processing facts: whether subsequent data use is GDPR-only, ePrivacy-only, or both. - Blocked without authority practice: whether a particular banner design will be accepted in a specific Member State. **Does the EU ePrivacy Directive set one EU-wide maximum fine?** No. The Directive requires Member States to set effective, proportionate, and dissuasive penalties for national ePrivacy rules, but the sources do not support one EU-wide fine amount for the current Directive. **Can a GDPR supervisory authority fine an ePrivacy breach?** Only where national law gives that authority ePrivacy competence. EDPB Opinion 5/2019 says GDPR authorities remain competent for GDPR processing, but direct ePrivacy enforcement depends on Member State law. **What evidence is most useful before a cookie enforcement complaint?** Keep pre-consent scans, banner screenshots, CMP settings, consent and withdrawal logs, cookie and SDK inventories, exemption justifications, and retest records after changes to tags, vendors, analytics, ads, or releases. Sources for this answer: - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://www.edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Supports the limits around national competence, GDPR/ePrivacy coexistence, and the need to justify enforcement under the correct legal instrument. - [European Commission proposal for an ePrivacy Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52017PC0010&ref=sorena.io) - Used only as proposal context for the Commission's attempt to harmonise supervision and penalties; it is not treated as current Directive fine law. - [Official Journal notice withdrawing the 2017 ePrivacy Regulation proposal](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52025XC05423&ref=sorena.io) - Confirms that the 2017 proposal was withdrawn, so its proposed penalty model cannot be used as current Directive law. *Recommended next step* *Placement: before sources* ## Build an ePrivacy enforcement file that separates EU duties from national penalty rules Sorena can help turn this page into country-specific research prompts, cookie and consent evidence requests, GDPR/ePrivacy separation checks, and regulator-ready source trails. - [Open Research Copilot for EU ePrivacy Directive](/solutions/research-copilot.md): Ask questions tied to cited sources about Article 15a, national enforcement competence, cookie-banner complaints, and GDPR/ePrivacy boundaries using the cited sources on this page. - [Talk through implementation](/contact.md): Review your ePrivacy enforcement evidence, country source gaps, and consent-risk workflow with Sorena. ## Primary sources - [Directive 2002/58/EC as amended by Directive 2009/136/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02009L0136-20201221&ref=sorena.io) - Primary legal source for current ePrivacy Directive enforcement, including Article 15a penalties, cessation powers, investigative powers, and cross-border cooperation. - Quote: "effective, proportionate and dissuasive" - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://www.edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Primary EDPB source for national ePrivacy enforcement competence, GDPR/ePrivacy coexistence, and limits on GDPR supervisory powers for ePrivacy-only matters. - Quote: "only if national law confers" - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Grounds cookie-banner enforcement risk patterns, including reject options, pre-ticked boxes, misleading design, essential-cookie claims, and withdrawal accessibility. - Quote: "Cookie Banner Taskforce" - [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en?ref=sorena.io) - Grounds the technical scope of storage and access to terminal equipment beyond traditional browser cookies. - Quote: "technical scope of Art. 5(3)" - [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf?ref=sorena.io) - Grounds consent-quality evidence where ePrivacy rules rely on GDPR consent concepts, including demonstrability and easy withdrawal. - Quote: "free, specific, informed and unambiguous" - [WP29 Opinion 04/2012 on Cookie Consent Exemption](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf?ref=sorena.io) - Grounds the narrow analysis required before treating cookies or similar technologies as exempt from consent. - Quote: "Cookie Consent Exemption" - [CNIL Sheet 16 on analytics for websites and applications](https://www.cnil.fr/en/sheet-ndeg16-use-analytics-your-websites-and-applications?ref=sorena.io) - Used as national regulator guidance showing analytics consent exemptions are conditional and may vary by Member State. - Quote: "subject to national variation" - [European Commission ePrivacyEU factsheet](https://digital-strategy.ec.europa.eu/en/library/eprivacyeu-towards-future-proof-legal-framework-online-privacy?ref=sorena.io) - Commission context for ePrivacy modernisation and the policy concern with divergent rules; not used as a current fine table. - Quote: "future proof legal framework" - [European Commission proposal for an ePrivacy Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52017PC0010&ref=sorena.io) - Proposal context for harmonised supervision and penalties; not treated as current ePrivacy Directive law. - Quote: "Proposal for a Regulation" ## Related Topic Guides - [Are cookie walls allowed under the EU ePrivacy Directive?](/artifacts/eu/eprivacy-directive/faq/cookie-walls.md): FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats. - [Do Analytics Cookies Require Consent under the EU ePrivacy Directive?](/artifacts/eu/eprivacy-directive/faq/analytics-cookies.md): FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats. - [ePrivacy cookie consent vs DSA ads obligations: scope-bounded comparison](/artifacts/eu/eprivacy-directive/eprivacy-vs-dsa-ads.md): Compare ePrivacy cookie and tracking-consent duties with DSA ads workstreams without merging consent, transparency, and evidence obligations. - [ePrivacy Directive vs GDPR: cookies, communications, consent, and evidence](/artifacts/eu/eprivacy-directive/eprivacy-directive-vs-gdpr.md): Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence. - [EU cookie banner requirements under the ePrivacy Directive](/artifacts/eu/eprivacy-directive/eu-cookie-banner-requirements.md): EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs. - [EU ePrivacy analytics cookies: consent, exemption, and evidence guide](/artifacts/eu/eprivacy-directive/analytics-cookies.md): Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps. - [EU ePrivacy Applicability Test for Cookies, SDKs, Pixels, Communications, and Marketing](/artifacts/eu/eprivacy-directive/applicability-test.md): A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence. - [EU ePrivacy Article 5(3) terminal equipment test](/artifacts/eu/eprivacy-directive/article-5-3-terminal-equipment-test.md): A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence. - [EU ePrivacy Confidentiality of Communications: Article 5 controls](/artifacts/eu/eprivacy-directive/confidentiality-of-communications.md): Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay. - [EU ePrivacy consent-log evidence workflow for cookies and trackers](/artifacts/eu/eprivacy-directive/consent-log-evidence-workflow.md): Build an ePrivacy consent-log workflow that records cookie and tracker decisions, banner versions, consent signals, withdrawals, vendor evidence, and audit-ready outputs. - [EU ePrivacy cookie banner UX test cases](/artifacts/eu/eprivacy-directive/banner-ux-test-cases.md): Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence. - [EU ePrivacy Cookie Scope Classifier Workflow](/artifacts/eu/eprivacy-directive/cookie-scope-classifier-workflow.md): Classify cookies, pixels, SDKs, local storage, device identifiers, and analytics tracers under Article 5(3) ePrivacy rules, with consent and exemption evidence outputs. - [EU ePrivacy direct-marketing consent checklist](/artifacts/eu/eprivacy-directive/direct-marketing-consent-checklist.md): Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats. - [EU ePrivacy Directive compliance calendar for cookies, consent, and marketing](/artifacts/eu/eprivacy-directive/deadlines-and-compliance-calendar.md): Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up. - [EU ePrivacy Directive Compliance Checklist](/artifacts/eu/eprivacy-directive/checklist.md): A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records. - [EU ePrivacy Directive Compliance Guide for Cookies, Marketing, and Communications](/artifacts/eu/eprivacy-directive/compliance.md): Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats. - [EU ePrivacy Directive Cookies and Consent: Article 5(3), exemptions, and banner evidence](/artifacts/eu/eprivacy-directive/cookies-and-consent.md): Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay. - [EU ePrivacy Directive direct marketing rules for electronic mail](/artifacts/eu/eprivacy-directive/direct-marketing-rules.md): Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats. - [EU ePrivacy Directive FAQ: cookies, consent, marketing, GDPR interplay](/artifacts/eu/eprivacy-directive/faq.md): Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence. - [EU ePrivacy Directive Member State Cookie Rules](/artifacts/eu/eprivacy-directive/member-state-cookie-rules.md): How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice. - [EU ePrivacy Directive Metadata and Location Data Guide](/artifacts/eu/eprivacy-directive/metadata-and-location-data.md): Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits. - [EU ePrivacy Directive penalties and fines: national enforcement caveats](/artifacts/eu/eprivacy-directive/penalties-and-fines.md): Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits. - [EU ePrivacy Directive Requirements: cookies, communications and marketing](/artifacts/eu/eprivacy-directive/requirements.md): Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing. - [EU ePrivacy Directive vs GDPR: cookies, communications, marketing, and evidence](/artifacts/eu/eprivacy-directive/eprivacy-vs-gdpr.md): Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing. - [EU ePrivacy Directive vs UK PECR: scope-bounded cookie and marketing comparison](/artifacts/eu/eprivacy-directive/eprivacy-vs-uk-pecr.md): Compare EU ePrivacy Directive rules with a UK PECR workstream requiring separate source review for cookies, terminal equipment, direct marketing, consent, soft opt-in, and evidence. - [EU ePrivacy soft opt-in FAQ for email marketing](/artifacts/eu/eprivacy-directive/faq/soft-opt-in.md): When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks. - [EU ePrivacy soft opt-in marketing checklist](/artifacts/eu/eprivacy-directive/soft-opt-in-marketing.md): Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats. - [EU ePrivacy soft opt-in marketing review workflow](/artifacts/eu/eprivacy-directive/soft-opt-in-marketing-review-workflow.md): Review whether an EU electronic-mail marketing send can rely on the ePrivacy soft opt-in, with checks for customer relationship evidence, similar products, opt-out, sender identity, suppression records, and national-law caveats. - [EU ePrivacy Strictly Necessary Cookie Exemptions](/artifacts/eu/eprivacy-directive/strictly-necessary-exemptions.md): Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks. - [Is a reject-all button required for EU ePrivacy cookie consent?](/artifacts/eu/eprivacy-directive/faq/reject-all-button.md): Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats. - [Strictly Necessary Cookies under the EU ePrivacy Directive](/artifacts/eu/eprivacy-directive/faq/strictly-necessary-cookies.md): FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions. - [What should CMP consent logs retain under the EU ePrivacy Directive?](/artifacts/eu/eprivacy-directive/faq/cmp-consent-logs.md): FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/eprivacy-directive/enforcement-and-fines.md