Cookie consent: what the ePrivacy rules require

Cookie banners are the most visible part of EU privacy law and the part most often done wrong. The rules come from two instruments that work together: the ePrivacy Directive 2002/58/EC decides when consent is needed, and the GDPR defines what counts as consent.

The rule in one sentence

Article 5(3) of the ePrivacy Directive, as amended in 2009, allows storing information on a user’s device, or reading information already stored there, only if the user has given consent after receiving clear and comprehensive information, unless the storage or access is needed solely to transmit a communication or is strictly necessary to provide a service the user explicitly requested.

Three consequences follow:

• It is technology-neutral. Cookies, local storage, tracking pixels, device fingerprinting and similar techniques are all covered. The EDPB Guidelines 2/2023 explain how broadly “storage” and “access” are read.
• It is not limited to personal data. In Planet49 (C-673/17) the Court of Justice confirmed that Article 5(3) applies whether or not the stored information is personal data.
• Consent comes first. Non-essential scripts must not run before the visitor decides.

What makes consent valid

Because the ePrivacy Directive borrows the consent definition from data-protection law, the GDPR standard applies (Article 4(11), Article 7, and Article 94(2), which redirects references to the old Directive 95/46/EC to the GDPR). Consent must be:

1. Freely given: refusing must not lead to a worse deal than accepting, beyond what is strictly necessary. Cookie walls that block access unless the visitor accepts are widely regarded by EU regulators as incompatible with this.
2. Specific: separate purposes (analytics, advertising, personalisation) need separate choices.
3. Informed: the visitor must know who is collecting what, for which purpose, and for how long. Planet49 held that information on the duration of cookies and on whether third parties can access them is part of this.
4. Unambiguous: a clear affirmative act. Planet49 ruled out pre-ticked checkboxes; scrolling or “continuing to browse” is not consent either (EDPB Guidelines 05/2020).

The GDPR adds two operational duties: the controller must be able to demonstrate consent (Article 7(1)), and withdrawing consent must be as easy as giving it (Article 7(3)). In practice that means a stored consent record and a persistent way to reopen the banner.

Banner design: what regulators have objected to

In January 2023 the EDPB published the report of its Cookie Banner Taskforce, which summarises the common positions of national authorities. The practices most authorities considered problematic include:

• no “reject” button on the first layer when there is an “accept” button there;
• pre-ticked purpose or vendor boxes on the second layer;
• deceptive link design instead of a button for the reject option;
• deceptive button colours and contrast that make “accept” the only obvious choice;
• claiming “legitimate interest” for tracking that requires consent;
• classifying non-essential cookies as “essential”;
• no easy way to withdraw consent afterwards.

National enforcement follows the same lines. The French CNIL, for example, fined Google and Facebook in late 2021 (announced January 2022) because refusing cookies took more clicks than accepting them.

What is exempt

The “strictly necessary” exemption is narrow and is judged from the visitor’s perspective: storage the service cannot work without. Typical examples are a shopping-cart cookie, a session cookie after login, a load-balancing cookie, or the cookie that remembers the consent choice itself. Analytics, A/B testing, advertising and social-media pixels are generally not strictly necessary, even when they are first-party or “anonymised”. Some national authorities accept narrowly configured audience measurement without consent; check the rules of the country you target before relying on that.

Consent frameworks and tag managers

Consent management platforms (CMPs) and the IAB Transparency & Consent Framework standardise how choices are passed to advertisers. In IAB Europe (C-604/22) the Court of Justice held that the “TC String” encoding a user’s preferences can be personal data, and that the organisation running such a framework can be a joint controller. A CMP is a tool, not a guarantee: a misconfigured one still loads trackers early. Likewise, browser-side “consent modes” that adjust tag behaviour do not replace consent; they only change what is sent after the decision.

How to test your own banner in ten minutes

1. Open a private window, open the developer tools on the Network and Application tabs, and load the home page. Do not click anything.
2. Note every cookie, storage entry and third-party request. Anything beyond strictly necessary is a finding.
3. Click “reject”. Navigate to two more pages. Non-essential requests must stay off.
4. Clear everything, reload and click “accept”. Compare: the difference is what your banner actually controls.
5. Look for the way back: a link or icon that reopens the banner on every page.

Automated scanners do exactly this at scale and repeat it after each release; that is where they earn their price. Compare the services we rate on the comparison page.