EU ePrivacy Directive Member State cookie rules

The baseline question is not limited to browser cookies. The final EDPB Guidelines 2/2023 use three criteria: the operation concerns information; it involves terminal equipment connected or connectable to a public communications network; and it constitutes storage or gaining access. The guidance analyses the public-network requirement within the terminal-equipment criterion. Local storage, pixels, SDK identifiers, device signals, and similar techniques may therefore need review when they involve terminal-equipment storage or access.

The amended directive text requires Member States to ensure that this storage or access is allowed only after consent with clear and comprehensive information, unless the activity is for transmission over an electronic communications network or is strictly necessary for a service explicitly requested by the user or subscriber.

A directive is implemented through national law, so a cookie review cannot stop at the EU text. For placement or reading of cookies, teams need the applicable national transposition rule and any binding or persuasive guidance from the authority that enforces that rule in the relevant market.

Do not choose applicable law from a single factor such as controller establishment, website language, or the user's location. Record every country in which the site or app is offered or specifically targeted, the entities involved, and where the storage or access occurs. Then obtain a case-specific jurisdiction analysis when more than one national rule could apply. This page cannot determine that conflict from Article 5(3) alone.

This page gives one national-authority example: CNIL guidance for audience measurement on websites and apps. That guidance says the position may vary nationally and directs readers to check the local data protection agency's position before relying on an exemption.

Evidence should show both the technical facts and the national-law basis for the conclusion. A reviewer should be able to see what the technology does, why consent or an exemption was chosen, which national source was checked, and how the deployed banner or preference control matches that conclusion.

For analytics, the CNIL source gives a France-specific example of the detail needed before relying on a national exemption position: purpose limits, opt-out operation, separation from other processing, single-publisher scope, IP truncation, and tracker lifetime. Those conditions cannot be exported to another Member State without a source from that jurisdiction.

The cited sources support the EU Article 5(3) baseline, the technical breadth of terminal-equipment access, the need to check national transposition and authority practice, and one national analytics example from CNIL. They also establish that Member States set penalties and provide enforcement powers under national provisions.

The cited sources do not support a reliable country-by-country cookie table. They do not provide the current transposition provision, authority guidance, penalties, and banner rules for every Member State.

Review this checklist before launching a new site, app, tag manager rule, analytics tool, advertising pixel, consent-management-platform change, or market expansion. The goal is to prevent an EU-level rule from being documented while the national implementation question is left blank.

If the team cannot identify the applicable national source, do not convert that gap into a rule. Mark the country-specific conclusion as unresolved and route it for legal or local authority review.