EU ePrivacy Directive Member State cookie rules

The baseline question is not limited to browser cookies. The final EDPB Guidelines 2/2023 use three criteria: the operation concerns information; it involves terminal equipment connected or connectable to a public communications network; and it constitutes storage or gaining access. The guidance analyses the public-network requirement within the terminal-equipment criterion. Local storage, pixels, SDK identifiers, device signals, and similar techniques may therefore need review when they involve terminal-equipment storage or access.

The amended directive text requires Member States to ensure that this storage or access is allowed only after consent with clear and comprehensive information, unless the activity is for transmission over an electronic communications network or is strictly necessary for a service explicitly requested by the user or subscriber.

A directive is implemented through national law, so a cookie review cannot stop at the EU text. For placement or reading of cookies, teams need the applicable national transposition rule and any binding or persuasive guidance from the authority that enforces that rule in the relevant market.

Do not choose applicable law from a single factor such as controller establishment, website language, or the user's location. Record every country in which the site or app is offered or specifically targeted, the entities involved, and where the storage or access occurs. Then obtain a case-specific jurisdiction analysis when more than one national rule could apply. This page cannot determine that conflict from Article 5(3) alone.

This page gives one national-authority example: CNIL guidance for audience measurement on websites and apps. That guidance says the position may vary nationally and directs readers to check the local data protection agency's position before relying on an exemption.

Evidence should show both the technical facts and the national-law basis for the conclusion. A reviewer should be able to see what the technology does, why consent or an exemption was chosen, which national source was checked, and how the deployed banner or preference control matches that conclusion.

CNIL Sheet 16, dated 11 June 2020, shows how detailed a national analytics assessment can be: purpose limits, objection controls, separation from other processing, publisher scope, IP handling, and duration. Verify the current French eligibility rules before relying on an exemption, and use each other country's own official sources for its conclusion.

For audience-measurement trackers that qualify for the French exemption, CNIL's recommendation consolidated on 16 January 2026 recommends informing users, limiting tracker lifetime to a period suitable for audience comparison such as 13 months without automatic renewal on return visits, retaining the collected information for no more than 25 months, and reviewing both periods regularly. These are CNIL recommendations for an already-exempt setup; they do not establish eligibility or an EU-wide retention rule.

Review this checklist before launching a new site, app, tag manager rule, analytics tool, advertising pixel, consent-management-platform change, or market expansion. The goal is to prevent an EU-level rule from being documented while the national implementation question is left blank.

If the team cannot identify the applicable national source, do not convert that gap into a rule. Mark the country-specific conclusion as unresolved and route it for legal or local authority review.