EU ePrivacy Directive Strictly Necessary Exemptions

The first exemption is the transmission exemption. WP29 explains that a cookie is not exempt merely because it assists, speeds up, or regulates transmission; the communication must not be possible without it. The examples WP29 ties to this logic include identifiers needed to route information, preserve packet order, or detect transmission errors or data loss.

The second exemption is the requested-service exemption. It requires both an explicit user request for a defined service or functionality and strict necessity for providing that service or functionality. If the user can use the requested functionality with the storage or access disabled, the exemption should not be used.

WP29 gives concrete examples that may qualify when they are limited to the exempt purpose and not reused for tracking, advertising, or broad analytics. User-input session cookies can keep a multi-page form or shopping basket coherent. Authentication session cookies can keep a user logged in to authorized content during the session. User-centric security cookies can protect the requested login service, for example by detecting repeated failed login attempts.

Other grounded examples include multimedia player session cookies needed for playback, load-balancing session cookies used to keep a user's requests on the correct server during a session, and short-lived user-interface customization cookies where the user has actively selected the setting. Persistent login, tracking, advertising, market research, product improvement, debugging, and cross-site profiling should not be folded into these examples.

The exemption test applies only after the team decides that Article 5(3) is technically triggered. EDPB Guidelines 2/2023 explain that Article 5(3) is not limited to classic browser cookies: it can cover stored or accessed information in terminal equipment, including information that is not personal data, information previously stored by another party, local storage, software instructions, URL and pixel tracking, local processing outputs sent over a network, certain IP-based tracking scenarios, IoT reporting, and unique identifiers.

That breadth matters for essential-cookie registers. A tag, SDK, tracking pixel, mobile identifier, local-storage key, cache mechanism, or JavaScript instruction should not escape review because it is not named as a cookie. The exemption evidence should describe the exact storage or access operation and the receiving or instructing entity.

Do not classify analytics as strictly necessary merely because the website owner needs measurement. WP29 says first-party analytics are not strictly necessary to provide a functionality explicitly requested by the user, even though limited first-party aggregated analytics may present lower privacy risk when safeguards are present. CNIL's national guidance describes a narrower audience-measurement exemption under specified conditions, including information, opt-out, limited purposes, no cross-checking, single publisher scope, IP truncation, and limited tracker lifetime.

Advertising, behavioral tracking, frequency capping, affiliate measurement, market analysis, product improvement, debugging, social plug-in tracking, and persistent login should not be treated as strictly necessary based on the sources reviewed. If consent is needed, the consent layer must meet GDPR-quality consent standards and avoid practices such as pre-ticked boxes, cookie walls that remove real choice, misleading link design, or confusing legitimate-interest framing for cookie placement.

The evidence record should prove the exemption, not simply state that the cookie is essential. The Cookie Banner Taskforce noted that website owners may need to maintain lists and provide documentation on purposes, and that tools can list placed cookies but do not determine their legal nature. Treat scanner output as the starting inventory, then add purpose, functionality, lifetime, controller or processor, and exemption reasoning.

Because ePrivacy is implemented through national law, the record should name the Member State rules or authority guidance checked for the launch market. The EDPB taskforce report also stresses that its positions are a minimum threshold and must be combined with national implementing laws and competent-authority guidance. Commission ePrivacy material likewise frames the device rule around user control over information stored on, or accessed from, devices.