FAQEU

EU ePrivacy Directive FAQ

Fast answers with practical next steps and evidence guidance.

Grounded in ePrivacy Directive text plus EDPB/WP29 enforcement learnings.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

This FAQ is written for teams shipping products. Each answer focuses on what to do next and what evidence to keep. Always validate against national implementation and counsel.

Question 1

Do analytics cookies require consent?

In many implementations, analytics trackers are treated as requiring consent because they are not strictly necessary to provide the service explicitly requested by the user.

If you want a low-risk posture, treat analytics as consent-based unless you have a narrow, defensible exemption rationale.

Document analytics purpose, data, recipients, and retention.
Prove enforcement: analytics must not fire pre-consent.
Keep evidence: CMP config snapshots + consent logs + tests.

Question 2

What does "strictly necessary" mean for cookie exemptions?

WP29 guidance emphasizes narrow interpretation: "useful" or "improves performance" is not the same as strictly necessary.

Treat exemptions as a legal decision with acceptance criteria and approvals.

Transmission exemption: communication must not be possible without the cookie/technique.
Strictly necessary: required to provide the service explicitly requested by the user.
Exempt trackers still need governance and monitoring.

Question 3

Do cookie walls invalidate consent?

Consent validity can be challenged when access to a service is conditioned on consent to non-essential tracking.

Treat cookie walls as high-risk and require explicit legal review and alternatives.

Document conditionality risk and alternative access paths (if any).
Make choices and consequences transparent.
Store rationale and approvals in the evidence index.

Question 4

ePrivacy vs GDPR: what law applies when?

A common model: ePrivacy national law governs placement/reading of trackers; GDPR governs subsequent processing of personal data collected via those trackers.

Your documentation should separate these layers and ensure consent conditions and information duties are aligned.

Layer A (ePrivacy): tracker decision table + banner behavior.
Layer B (GDPR): lawful basis and transparency for subsequent processing.
Enforcement: one-stop-shop often does not apply to ePrivacy matters.

Question 5

What should we be able to export during a complaint/inquiry?

Enforcement is evidence-driven. Your capability is "exportability": can you produce coherent proof quickly?

Build an export pack and rehearse it annually.

Tracker decision table + CMP config snapshot + consent log schema + sample exports.
Automated test results proving pre-consent blocking and withdrawal propagation.
Marketing evidence pack: consent capture, withdrawals, suppression governance, vendor list.

Recommended next step

Use EU ePrivacy Directive FAQ as a cited research workflow

Research Copilot can take EU ePrivacy Directive FAQ from cited answers to recurring questions on this topic to a reusable workflow inside Sorena. Teams working on EU ePrivacy Directive can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Research workflow

Open Research Copilot for EU ePrivacy Directive FAQ

Start from EU ePrivacy Directive FAQ and answer scope, timing, and interpretation questions with cited outputs.

Explore next step

Talk to Sorena

Talk through EU ePrivacy Directive

Review your current process, evidence gaps, and next steps for EU ePrivacy Directive FAQ.

Explore next step

Primary sources