EU cookie banner requirements under the ePrivacy Directive

Require a banner or equivalent consent control before any non-exempt storage or access happens on a user's device. Article 5(3) applies to more than HTTP cookies: the EDPB technical-scope guidance covers operations involving information, terminal equipment, and either storage or gaining access, including tracking pixels, URL tracking, local processing that reports back over a network, and unique identifiers.

Do not narrow the test to personal data. Planet49 and the EDPB technical guidance both treat Article 5(3) as protecting information stored in terminal equipment regardless of whether the information is personal data. The practical question is whether the site, app, email, SDK, tag, or embedded third-party component stores information on the device or instructs the device to send back stored or generated information.

Use the exemption narrowly. WP29 Opinion 04/2012 treats Article 5(3) exemptions as limited to two cases: technical storage or access for the sole purpose of carrying out transmission, or storage or access that is strictly necessary to provide an information society service explicitly requested by the user.

The exemption is purpose-based, not label-based. A cookie called essential is not exempt if it also performs analytics, advertising, profiling, fraud measurement for ads, market research, or product improvement. If one identifier supports both an exempt and a non-exempt purpose, split the purposes technically or gate the non-exempt purpose behind consent.

For non-exempt cookies and trackers, consent must be a real affirmative choice before storage or access occurs. The EDPB Cookie Banner Taskforce recorded that, by default, cookies requiring consent cannot be set without consent and that consent must be expressed by a positive user action.

A banner that offers an accept button but no reject or refuse option on any layer with a consent button is a high-risk pattern. The taskforce reported that a vast majority of authorities considered the absence of refuse, reject, or not-consent options on any layer with a consent button inconsistent with valid consent. Put the refusal path where users can actually find it, and avoid link styling, colour contrast, or button emphasis that clearly pushes acceptance.

Do not use pre-ticked boxes, opt-out toggles, silence, scrolling, swiping, continued browsing, or participation in another flow as cookie consent. Planet49 held that consent for storing or accessing cookies is not valid when a pre-checked checkbox must be deselected to refuse. The EDPB consent guidance similarly rejects pre-ticked boxes and inactivity.

Give users clear information before consent: purposes, categories, controller or third-party access where relevant, and the duration of the cookies or similar technologies. Planet49 specifically treats cookie duration and third-party access as part of the clear and comprehensive information users need.

Make withdrawal available after consent is given and keep it as easy as giving consent. The EDPB Cookie Banner Taskforce did not require one specific withdrawal icon, but it did require easily accessible withdrawal solutions such as a visible icon or link. The EDPB consent guidance adds that withdrawal should be possible through the same electronic interface without undue effort, without charge, and without lowering service levels as a penalty.

Treat cookie walls and analytics exemptions as caveats, not shortcuts. EDPB consent guidance says access to services and functionality must not be made conditional on consent to terminal-equipment storage or access. CNIL's analytics sheet shows a narrow national approach under which certain audience-measurement trackers may move from opt-in to opt-out only if strict safeguards are met; most large audience-measurement offerings do not fall within that exemption. Because analytics exemptions vary by national implementation, keep the legal basis and country position documented instead of applying one EU-wide analytics exemption by default.