When can a cookie be treated as strictly necessary?
Treat the exemption as a cookie-by-cookie, purpose-by-purpose test. For the transmission exemption, the communication must not be possible without the cookie or similar storage/access operation; a cookie that merely helps, speeds up, measures, or improves the service is not enough.
For the user-requested service exemption, the user must have taken a positive action to request a clearly defined service or feature, and the cookie must be strictly needed for that feature to work. The test is from the user's point of view, not from the website operator's preference for measurement, monetization, personalization, or operational convenience.
- Transmission exemption: routing, ordered data exchange, or error/loss detection needed to carry the communication over the network.
- Service-request exemption: a cookie needed to deliver a specific feature the user requested, such as a multi-page form, shopping basket, authenticated session, or user-centric login security.
- Purpose separation: if the same cookie supports both essential and non-essential purposes, the exemption applies only if every distinct purpose independently qualifies.
- Technical scope: Article 5(3) is not limited to classic cookies; storage or access through local storage, pixels, client-side code, identifiers, or other terminal-equipment techniques can also fall in scope.
Provides the Article 5(3) consent rule and the two exemptions for transmission and strictly necessary user-requested services.
Explains the high threshold for the transmission and user-requested service exemptions, including the user-perspective test.
Shows that Article 5(3) covers storage or access to terminal-equipment information beyond classic cookies.