Do Analytics Cookies Require Consent?

In most EU analytics implementations, yes. Article 5(3) of the ePrivacy Directive covers storing information on, or gaining access to information already stored in, the terminal equipment of a subscriber or user. EDPB technical-scope guidance treats cookies, JavaScript instructions that send browser data, tracking pixels, tracked URLs, local processing results sent to a server, and unique identifier collection as potential Article 5(3) access or storage scenarios.

The answer does not turn on the vendor label "analytics". A product team should classify the real mechanism: which cookie, SDK, pixel, script, local-storage item, app identifier, or server-side measurement flow is used; what identifier or event data leaves the device; whether a third party receives or reuses it; and whether the user can use the requested service without it.

WP29 guidance says first-party analytics cookies are often useful to website operators but are not strictly necessary to provide a functionality explicitly requested by the user. That means the ordinary position is consent, unless the implementation fits a specific exemption path in the applicable national law or supervisory-authority guidance.

A limited analytics exemption is not an EU-wide rule in the Directive text. CNIL's analytics sheet is French regulator guidance: it says audience-measurement tracers generally require consent unless they fall exactly within its defined perimeter, and it warns that the position may vary under national law and local authority guidance.

CNIL Sheet 16, dated 11 June 2020, described information and objection controls, audience-measurement or A/B-testing limits, no customer-file or cross-site matching, single-editor scope, IP truncation, a 13-month tracker lifetime, and independent processing for each publisher. Treat that list as historical guidance, not a complete current French exemption test. Verify the applicable French rules before using analytics without consent.

Treat the exemption as a configuration- and jurisdiction-dependent claim. First confirm that the applicable Member State recognizes the route. Then verify the deployed product against every local condition. For a French rollout, save the current official eligibility source and map each condition to configuration and data-flow evidence. Do not approve an exemption solely because a tool matches the older Sheet 16 checklist.

For audience-measurement trackers that qualify for the French exemption, CNIL's recommendation consolidated on 16 January 2026 recommends informing users, limiting tracker lifetime to a period suitable for audience comparison such as 13 months without automatic renewal on return visits, retaining the collected information for no more than 25 months, and reviewing both periods regularly. These are CNIL recommendations for an already-exempt setup; they do not establish eligibility or an EU-wide retention rule.

Keep two evidence bundles: one for the Article 5(3) classification and one for the consent or exemption implementation. The classification file should show whether the analytics technology stores information, gains access to stored information, or instructs a browser or app to send identifiers or event data over a network.

For consent-required analytics, keep the consent banner configuration, the versioned consent text shown to the user, the category mapping that places the analytics tag behind the analytics toggle, proof that tags do not fire before consent, accept and reject UI evidence, and consent logs with timestamp, jurisdiction or locale, banner version, choice, withdrawal events, and the tag state applied after the choice.

For exemption-based analytics, keep the product and configuration evidence showing every exemption condition actually met, plus the national source used for the exemption decision. Recheck the file when the analytics vendor, SDK version, tag manager rule, data sharing setting, retention period, cookie lifetime, country rollout, or measurement purpose changes.

Document the country caveat every time the answer depends on an analytics exemption. The ePrivacy Directive is implemented through national laws, and the EDPB cookie-banner taskforce report frames cookie placement and reading complaints under national laws transposing the Directive. CNIL's exemption conditions are cited French supervisory-authority guidance, not a universal rule for every Member State.

Document the source caveat too: WP29 Opinion 04/2012 says first-party analytics cookies are not exempt under the Directive's two classic criteria, while CNIL guidance describes a conditional national opt-out path for tightly constrained audience measurement. If those sources point in different practical directions for a rollout country, escalate to local counsel or the local supervisory authority's guidance instead of inventing a country rule.