EU cookie law explained: the ePrivacy Directive and the GDPR

Where the EU cookie rule comes from

The rule that most people call "the EU cookie law" is article 5(3) of the ePrivacy Directive (Directive 2002/58/EC). Since its amendment by Directive 2009/136/EC, it says that storing information on a user's device, or gaining access to information already stored there, is only allowed if the user has given consent after receiving clear and comprehensive information. Member states had to apply the amended rule from 25 May 2011.

There are two exceptions. No consent is needed for storage or access that is:

• used only to carry out the transmission of a communication over a network, or
• strictly necessary to provide a service the user has explicitly requested, such as a shopping cart, a login or saving the visitor's cookie choice.

Everything else, such as analytics, advertising, retargeting and social media pixels, needs consent in principle. Some national regulators allow narrow exemptions for privacy-friendly audience measurement; check the country guides below.

Not just cookies

The rule is technology-neutral. In its Guidelines 2/2023 on the technical scope of article 5(3), adopted in final form in October 2024, the European Data Protection Board (EDPB) explains that it also covers tracking pixels, tracking links, local storage, certain forms of fingerprinting and similar techniques. More in What are cookies?

How member states apply it

Because it is a directive, every member state has written the rule into its own law, and each has its own regulator. A few examples:

The differences are in the details: whether cookie walls are allowed, how long a choice should be remembered, whether analytics can be exempt, and how high the fines are. Our guide to cookie fines compares the enforcement side.

What the GDPR adds

The ePrivacy Directive does not define consent itself; it refers to the definition in data protection law, now the GDPR. So cookie consent must be:

• Freely given: a real choice, without pressure. Access to a website should generally not depend on accepting tracking; see Cookie walls.
• Specific: per purpose, so not one "accept" for everything without the option to choose.
• Informed: the visitor knows who places which cookies, for what purpose and for how long.
• Unambiguous: by a clear, active action. Silence, scrolling or continuing to browse is not consent.

The visitor must also be able to withdraw consent as easily as they gave it.

When cookies process personal data, as tracking cookies almost always do, the GDPR applies to that processing too: you need a legal basis, must give information and must respect data subjects' rights.

Planet49: the leading court case

In Planet49 (case C-673/17, 1 October 2019), the EU Court of Justice ruled that:

• a pre-ticked checkbox is not valid consent;
• the consent requirement applies whether or not the information is personal data;
• the information to users must include how long cookies last and whether third parties can access them.

What is changing, and what is not

The ePrivacy Regulation has been withdrawn

In 2017 the Commission proposed an ePrivacy Regulation to replace the directive. After years without agreement, it announced the withdrawal in its 2025 work programme, and the withdrawal was published in the Official Journal on 6 October 2025. The ePrivacy Directive therefore still applies.

The Digital Omnibus is a proposal, not law

On 19 November 2025 the Commission presented the Digital Omnibus (procedure 2025/0360(COD)). It proposes, among other things, to move the rules on access to devices that involve personal data from the ePrivacy Directive into the GDPR, to require a single-click option to refuse, to have websites respect a choice for at least six months, to let users set their choices centrally (for example in the browser) and to exempt certain low-risk uses, such as counting visits, from consent.

As of October 2026 this is still a proposal: the European Parliament's committees are working on their report and the Council has not adopted a position. Member states and MEPs have proposed changes, so the final text may look different. Until it is adopted and applies, the national cookie laws above stay in force.

The UK is separate

Since Brexit, the UK has its own rules: regulation 6 of PECR together with the UK GDPR, enforced by the ICO. The Data (Use and Access) Act 2025 added new exceptions, for example for some analytics, that do not exist in the EU. See UK cookie law.

How to comply across the EU

1. Scan your website for every cookie, pixel and script, including those from plugins and embeds.
2. Block everything that needs consent until the visitor agrees.
3. Offer a real choice: "Accept" and "Reject" equally visible on the first layer, and settings per purpose.
4. Inform clearly in the banner and in a cookie policy.
5. Make withdrawing easy, for example through a link on every page.
6. Keep proof of each consent.
7. Follow the strictest rules where you have visitors, or use geographic rules per country.
8. Use Google Consent Mode v2 if you use Google Ads or Analytics; see Google Consent Mode v2 explained.

Cookie Confirm covers these steps: a monthly scan with unlimited rescans, scripts blocked until consent, geographic rules per country, a banner in your own brand style shown in the visitor's language (29+ languages), a cookie declaration generated from the scan and a consent log kept for 12 months. For €7.95 per website per month, with a 7-day free trial.

Sources

• EUR-Lex: Directive 2002/58/EC (ePrivacy Directive)
• EUR-Lex: Directive 2009/136/EC
• EUR-Lex: Regulation (EU) 2016/679 (GDPR)
• CJEU: Case C-673/17, Planet49 (1 October 2019)
• EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive
• EDPB: Guidelines 05/2020 on consent
• Council of the EU: information note on withdrawn Commission proposals, OJ C/2025/5423 (October 2025)
• EUR-Lex: procedure 2017/0003(COD), ePrivacy Regulation
• European Commission: Digital Package (Digital Omnibus) FAQ
• European Parliament Legislative Observatory: procedure 2025/0360(COD)
• Wetten.nl: Telecommunicatiewet, article 11.7a
• Gesetze im Internet: § 25 TDDDG
• CNIL: Loi Informatique et Libertés (article 82)
• Garante privacy: Codice in materia di protezione dei dati personali
• BOE: Ley 34/2002 (LSSI)