We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

EU ePrivacy Directive FAQArticle 5(3)

Strictly Necessary Cookies EU ePrivacy FAQ

A cookie can be treated as strictly necessary only when Article 5(3)'s transmission exemption or user-requested service exemption is actually met.

This answer helps separate essential session, basket, authentication, and user-centric security cookies from analytics, advertising, tracking, and convenience uses that normally need consent or a jurisdiction-specific analysis.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
3 sections6 primary sources
Overview

Under EU ePrivacy Article 5(3), storing information on a user's device or accessing information already stored there generally requires consent. fall within a narrow exemption for technical storage or access used solely to transmit a communication, or for storage or access essential to provide an information society service the user explicitly requested.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 2

Which cookies can qualify as strictly necessary?

WP29 treats first-party user-input session cookies as a core example where the user requested the feature, such as completing a form over several pages or adding items to a shopping basket. The cookie should remain tied to that action and normally expire with the session. Limited extra persistence needs its own justification based on what the user requested and reasonably expects, such as recovering a recently closed basket.

Session authentication cookies can also qualify where they are needed to keep the user authenticated across page requests for a service the user logged into. User-centric security cookies can qualify when they protect that requested login service, such as detecting repeated failed login attempts. Those examples do not authorize secondary uses such as behavioral monitoring, advertising, or cross-site tracking.

  • Shopping basket or multi-page form cookies: keep only the input or basket state needed for the user-requested transaction.
  • Session authentication cookies: use them for the authenticated service, not for advertising, profiling, or behavioral monitoring.
  • User-centric security cookies: limit them to protecting the requested login or account service from abuse.
  • Persistent login or remember-me cookies: do not assume exemption. WP29 distinguishes a persistent authentication cookie from an ordinary session cookie and states that persistence requires consent.
Question 3

How should analytics and evidence records be handled?

Do not classify analytics cookies as strictly necessary under the general Article 5(3) exemptions merely because the site operator needs measurement. WP29 states that first-party analytics are often useful but are not strictly necessary for a user-requested website feature because the user can still access the site when those cookies are disabled.

Some national implementations or regulator guidance may create narrower analytics approaches or safeguards, but this page does not state country-specific exemptions. Before relying on analytics without consent, check the Member State law and competent authority guidance that applies to the website, the user group, and the deployment.

  • Keep a cookie inventory with name, provider, domain, first-party or third-party status, purpose, duration, storage/access method, and data sent from the terminal equipment.
  • For each claimed exemption, record the requested user action, the exact service feature, why the feature fails without the cookie, and why the duration is no longer than needed.
  • Separate essential purposes from analytics, ads, social plug-ins, A/B testing, personalization, attribution, fraud measurement for advertising, and product-improvement purposes.
  • Keep evidence of banner behavior for non-essential cookies: no consent-required cookies before consent, no pre-ticked boxes, a real reject path, and consent withdrawal that is as easy as giving consent.
  • Refresh the assessment when cookie features, vendors, retention periods, domains, user journeys, Member State coverage, or terminal-equipment access techniques change.
Recommended next step

Turn each essential-cookie claim into a documented Article 5(3) assessment

Sorena can help map cookie purposes, identify non-essential tracking, collect evidence for claimed exemptions, and prepare cited-source review records for EU ePrivacy work.

Research workflow
Open Research Copilot for EU ePrivacy Directive

Ask questions tied to cited sources about Article 5(3), cookie exemptions, consent, analytics, and evidence using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through cookie consent implementation

Review your cookie inventory, strictly necessary claims, consent paths, and national-law questions with Sorena.

Explore next step
Primary sources

References and citations

WP29 Opinion 04/2012 on Cookie Consent Exemption
ec.europa.eu4 citations
Referenced sections
  • Primary guidance used for the exemption tests, shopping basket, authentication, user-centric security, persistence, third-party, multi-purpose, and analytics caveats.
  • Explains the high threshold for the transmission and user-requested service exemptions, including the user-perspective test.
  • Grounds the shopping basket, user-input session, authentication, persistent login, and user-centric security examples.
Show 1 more
  • Supports the analytics caveat and the principle that doubts should be resolved by seeking consent rather than stretching an exemption.
"Cookie Consent Exemption"
More quoted passages
"strictly necessary"
"User input cookies"
"First party analytics"
EDPB Cookie Banner Taskforce report
edpb.europa.eu3 citations
Referenced sections
  • Source for cookie-banner enforcement themes, essentiality documentation, reject/withdrawal design, and the need to apply national implementing laws and regulator guidance.
  • Warns against classifying cookies as essential when their purposes are not strictly necessary and highlights the need to demonstrate essentiality.
  • Grounds evidence expectations for essentiality, banner behavior, reject options, legitimate-interest confusion, withdrawal, and national-law caveats.
"Cookie Banner Taskforce"
More quoted passages
"essentiality"
"national laws transposing"
Directive 2009/136/EC amendment to ePrivacy Article 5(3)
eur-lex.europa.eu2 citations
Referenced sections
  • Primary legal text for the Article 5(3) cookie consent rule and the transmission and strictly necessary service exemptions.
  • Provides the Article 5(3) consent rule and the two exemptions for transmission and strictly necessary user-requested services.
"technical storage or access"
EDPB Guidelines 05/2020 on consent
edpb.europa.eu2 citations
Referenced sections
  • Consent quality source for cookies and similar technologies that do not fit an Article 5(3) exemption.
  • Grounds the quality standard for consent where a cookie does not fit an Article 5(3) exemption.
"unambiguous indication"
More quoted passages
"freely given, specific, informed"
EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive
edpb.europa.eu2 citations
Referenced sections
  • EDPB technical-scope guidance for storage or access to terminal equipment, including non-cookie techniques.
  • Shows that Article 5(3) covers storage or access to terminal-equipment information beyond classic cookies.
"technical scope"
More quoted passages
"stored or accessed"
European Commission ePrivacy overview
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission overview used for ePrivacy policy context and the confidentiality/privacy framework.
  • Commission context for the ePrivacy framework and protection of privacy in electronic communications.
"future proof legal framework"
More quoted passages
"online privacy"

Related guides

Are cookie walls allowed under the EU ePrivacy Directive?

FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.

Do Analytics Cookies Require Consent under the EU ePrivacy Directive?

FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.

EU ePrivacy soft opt-in FAQ for email marketing

When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.

Is a reject-all button required for EU ePrivacy cookie consent?

Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.

What should CMP consent logs retain under the EU ePrivacy Directive?

FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.

ePrivacy cookie consent vs DSA advertising rules

Compare ePrivacy rules for device storage and access with DSA ad labels, advertiser disclosures, targeting information, profiling limits, and VLOP/VLOSE ad repositories.

Show all related guides (32)

ePrivacy Directive vs GDPR: cookies, communications, consent, and evidence

Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence.

EU cookie banner requirements under the ePrivacy Directive

EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs.

EU ePrivacy analytics cookies: consent, exemption, and evidence guide

Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps.

EU ePrivacy Applicability Test for Cookies, SDKs, Pixels, Communications, and Marketing

A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence.

EU ePrivacy Article 5(3) terminal equipment test

A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence.

EU ePrivacy Confidentiality of Communications: Article 5 controls

Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay.

EU ePrivacy consent-log evidence workflow for cookies and trackers

Build evidence that links each cookie or tracker decision to the banner shown, the user's signal, the live technical behavior, withdrawal, and later changes.

EU ePrivacy cookie banner UX test cases

Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence.

EU ePrivacy Cookie Scope Classifier Workflow

Decide whether cookies, pixels, SDKs, local storage, identifiers, and analytics fall within Article 5(3), then document consent, an exemption, or escalation.

EU ePrivacy direct-marketing consent checklist

Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats.

EU ePrivacy Directive compliance calendar for cookies, consent, and marketing

Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up.

EU ePrivacy Directive Compliance Checklist

A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records.

EU ePrivacy Directive Compliance Guide for Cookies, Marketing, and Communications

Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats.

EU ePrivacy Directive Cookies and Consent: Article 5(3), exemptions, and banner evidence

Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay.

EU ePrivacy Directive direct marketing rules for electronic mail

Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats.

EU ePrivacy Directive Enforcement and Fines

Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits.

EU ePrivacy Directive FAQ: cookies, consent, marketing, GDPR interplay

Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence.

EU ePrivacy Directive Member State Cookie Rules

How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice.

EU ePrivacy Directive Metadata and Location Data Guide

Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits.

EU ePrivacy Directive penalties and fines: national enforcement caveats

Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits.

EU ePrivacy Directive Requirements: cookies, communications and marketing

Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing.

EU ePrivacy Directive vs GDPR: cookies, communications, marketing, and evidence

Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.

EU ePrivacy Directive vs UK PECR: cookies and direct marketing

Compare the EU ePrivacy Directive with current UK PECR rules for device storage and access, statutory exceptions, consent, electronic-mail marketing, soft opt-ins, and enforcement.

EU ePrivacy soft opt-in marketing checklist

Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats.

EU ePrivacy soft opt-in marketing review workflow

Decide whether an electronic-mail marketing audience meets every Article 13 soft opt-in condition, or must be suppressed or supported by valid prior consent.

EU ePrivacy Strictly Necessary Cookie Exemptions

Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks.