EU ePrivacy Directive Strictly Necessary Exemptions

The first exemption is the transmission exemption. WP29 explains that a cookie is not exempt merely because it assists, speeds up, or regulates transmission; the communication must not be possible without it. The examples WP29 ties to this logic include identifiers needed to route information, preserve packet order, or detect transmission errors or data loss.

The second exemption is the requested-service exemption. It requires both an explicit user request for a defined service or functionality and strict necessity for providing that service or functionality. If the user can use the requested functionality with the storage or access disabled, the exemption should not be used.

WP29 gives concrete examples that may qualify when they are limited to the exempt purpose and not reused for tracking, advertising, or broad analytics. User-input session cookies can keep a multi-page form or shopping basket coherent. Authentication session cookies can keep a user logged in to authorized content during the session. User-centric security cookies can protect the requested login service, for example by detecting repeated failed login attempts.

Other cited examples include multimedia player session cookies needed for playback, load-balancing session cookies used to keep a user's requests on the correct server during a session, and short-lived user-interface customization cookies where the user has actively selected the setting. WP29 also says a social plug-in content-sharing cookie may qualify for a logged-in member who explicitly requests that function, but not for logged-out users or for tracking beyond the requested sharing function. Persistent login, advertising, market research, and cross-site profiling remain outside these examples.

The exemption test applies only after the team decides that Article 5(3) is technically triggered. EDPB Guidelines 2/2023 explain that Article 5(3) is not limited to classic browser cookies: it can cover stored or accessed information in terminal equipment, including information that is not personal data, information previously stored by another party, local storage, software instructions, URL and pixel tracking, local processing outputs sent over a network, certain IP-based tracking scenarios, IoT reporting, and unique identifiers.

That breadth matters for essential-cookie registers. A tag, SDK, tracking pixel, mobile identifier, local-storage key, cache mechanism, or JavaScript instruction should not escape review because it is not named as a cookie. The exemption evidence should describe the exact storage or access operation and the receiving or instructing entity.

Do not classify analytics as strictly necessary merely because the website owner needs measurement. WP29 says first-party analytics are not strictly necessary to provide a functionality explicitly requested by the user, even though limited first-party aggregated analytics may present lower privacy risk when safeguards are present. CNIL's Sheet 16, dated 11 June 2020, described a French audience-measurement exemption with detailed safeguards. It is historical guidance: check the current French eligibility rules and configuration before relying on an exemption, and do not export that checklist to another Member State.

Third-party advertising cookies are not exempt. WP29 also treats frequency capping, advertising financial logging, ad affiliation, click-fraud detection, research and market analysis, product improvement, and debugging as non-exempt when they are operational purposes of third-party advertising. Do not turn that passage into a universal rule for every security or debugging operation; classify the actual purpose against the two Article 5(3) tests. If consent is needed, obtain it before storage or access and meet the GDPR consent standard.

For audience-measurement trackers that qualify for the French exemption, CNIL's recommendation consolidated on 16 January 2026 recommends informing users, limiting tracker lifetime to a period suitable for audience comparison such as 13 months without automatic renewal on return visits, retaining the collected information for no more than 25 months, and reviewing both periods regularly. These are CNIL recommendations for an already-exempt setup; they do not establish eligibility or an EU-wide retention rule.

The evidence record should prove the exemption, not simply state that the cookie is essential. The Cookie Banner Taskforce noted that website owners may need to maintain lists and provide documentation on purposes, and that tools can list placed cookies but do not determine their legal nature. Treat scanner output as the starting inventory, then add purpose, functionality, lifetime, controller or processor, and exemption reasoning.

Because ePrivacy is implemented through national law, the record should name the Member State rules or authority guidance checked for the launch market. The EDPB taskforce report also stresses that its positions are a minimum threshold and must be combined with national implementing laws and competent-authority guidance. The Commission factsheet page provides non-binding explanatory background on the ePrivacy modernisation initiative.