# Cookie consent in Czechia: what Section 89(3) requires > Since 1 January 2022, anyone who stores or reads information on a user's device in Czechia must first obtain the user's demonstrable consent to the scope and purpose of the processing, under Section 89(3) of the Electronic Communications Act (127/2005 Coll.). Technical cookies are exempt. The Office for Personal Data Protection (ÚOOÚ) enforces the rule through the GDPR, has fined sites since 2023, and expects Accept and Reject buttons on the same layer of the banner. Source: https://cookiequiet.com/laws/czechia Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Anyone who stores or reads data in the terminal equipment of subscribers or users in Czechia: websites, apps, ad and analytics providers - **Consent model:** Opt-in: prior, demonstrable consent to the scope and purpose of processing, since 1 January 2022 - **Cookie rule:** Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications, as amended by Act No. 374/2021 Coll. - **Authority:** Úřad pro ochranu osobních údajů (ÚOOÚ), the Office for Personal Data Protection - **Maximum fine:** GDPR scale, up to 20 million euros or 4% of worldwide turnover; largest final cookie fine announced: 898,000 CZK (2023) - **Before 2022:** The rule was widely read as opt-out; the 2021 amendment made prior consent explicit ## Which Czech law regulates cookies? Czechia transposes Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) in Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications. The current wording was introduced by Act No. 374/2021 Coll., which took effect on 1 January 2022. Section 89(3) says that anyone who intends to use or uses electronic communications networks to store data, or to gain access to data stored, in the terminal equipment of subscribers or users must obtain from them in advance demonstrable consent to the scope and purpose of the processing. The obligation does not apply to technical storage or access solely for transmitting a message over an electronic communications network, or where it is necessary to provide an information society service the subscriber or user explicitly requested. Consent is read with the [GDPR](/laws/gdpr) standard: freely given, specific, informed, unambiguous and by a clear affirmative action. ## What changed on 1 January 2022? Before the amendment, the Czech text was widely read as an opt-out rule, under which sites could set cookies until the user objected. The Office for Personal Data Protection (ÚOOÚ) explains that the amendment removed any doubt: since 1 January 2022, visitors' personal data may be collected through non-technical cookies only on the basis of their demonstrable consent, under the opt-in principle. Its chairman said in August 2023 that the office had first educated and warned operators, and started fining once they had had enough time to adapt. ## Which cookies need consent in Czechia? The ÚOOÚ divides cookies by purpose into two groups: - **Technical cookies**, needed for the website to work properly. They need no consent. If a site uses only technical cookies, it does not need a cookie banner, but it must still inform visitors, because these cookies also contain unique identifiers. - **Non-technical cookies**, used to collect information about users for statistical, analytical, marketing or other purposes. They need opt-in consent first. Czech law has no analytics exemption. Statistical and analytical cookies are non-technical in the ÚOOÚ's classification, so tools like Google Analytics need consent. ## Who enforces the cookie rule in Czechia? The ÚOOÚ handles cookie cases. It treats cookies as processing of personal data because they contain unique identifiers and other information that is personal data under the GDPR. Its investigations look at the design and function of the cookie banner, the information given to visitors and whether the cookies used are really necessary for the site to run. In practice, the ÚOOÚ sanctions cookie breaches under the GDPR. In a presentation of 12 June 2024, it listed the most frequent failings and the articles it applies: - non-technical cookies used without consent (unlawful processing, Article 5(1)(a) GDPR); - defective consent, for example consent that is not informed (Article 6(1)); - incomplete information, such as missing cookies in the list, unclassified cookies or information only in a foreign language (Articles 12 and 13); - withdrawal of consent that is impossible or difficult, where at least a link in the page footer to reopen the banner is expected (Article 7(3)); - Accept and Reject options placed on different layers of the banner, which makes refusing harder (Article 4(11), supported by Article 7(3)). ## How high are the fines in Czechia? Because the ÚOOÚ applies the GDPR, the ceiling is the GDPR's: up to 20 million euros or 4% of worldwide annual turnover. The ÚOOÚ calculates fines with the EDPB's Guidelines 04/2022 on the calculation of administrative fines. On 2 August 2023, the ÚOOÚ announced that it had imposed cookie fines totaling 4,443,000 CZK since the start of 2023, of which 1,640,000 CZK were final. The largest final fine, 898,000 CZK, went to a company in the electronic communications sector, mainly for placing marketing cookies on visitors' devices without consent. Other grounds included defective consent, information available only in English, consent that was hard to withdraw and deceptive design in banners. By June 2024, the ÚOOÚ said final cookie fines had reached about 2 million CZK. ## What should a Czech cookie banner do? The ÚOOÚ's guidance on the banner (cookie lišta) is direct: - refusing must be as simple as consenting, so the Accept and Reject buttons belong on the same layer, preferably the first, with attention to their size and color (see the [Reject all guide](/guides/reject-all-button)); - the banner must not hide the content without a way to postpone the choice, such as a close button; - browser settings alone cannot replace the banner; - the banner should appear again after significant changes to the processing, such as new purposes, but not for every change to an individual cookie; - a link in the footer should let visitors reopen the banner and withdraw consent. ## Does the banner have to be in Czech? The ÚOOÚ advises giving the information in an understandable language: Czech, and the local language for foreign markets. It lists information provided only in a foreign language among the frequent breaches it fines. ## How Cookiequiet fits Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, so the cookie list is complete and classified, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Czech to visitors whose browser asks for it, among 24 languages. A link or icon reopens the banner for withdrawal, each choice goes into a consent log, and geo-targeting is included on every plan, [including Free](/pricing). Start with the [cookie scanner](/tools/cookie-scanner). ## Questions ### When did Czechia switch to opt-in consent for cookies? On 1 January 2022, when Act No. 374/2021 Coll. amended Section 89(3) of the Electronic Communications Act. Since then, non-technical cookies need prior, demonstrable consent. ### Who fines websites for cookies in Czechia? The Office for Personal Data Protection (ÚOOÚ). It treats cookies as personal data processing and sanctions breaches under the GDPR. It has been issuing fines since 2023, the largest final one announced being 898,000 CZK. ### Do analytics cookies need consent in Czechia? Yes. The ÚOOÚ classifies statistical and analytical cookies as non-technical, so they need opt-in consent. Only technical cookies needed for the site to work are exempt. ### Does a Czech site that only uses technical cookies need a banner? No consent banner is needed in that case, according to the ÚOOÚ. The site must still inform visitors about the cookies, because technical cookies also contain unique identifiers. ## Sources - [Zákon č. 127/2005 Sb., o elektronických komunikacích, Section 89 (consolidated text), Zákony pro lidi](https://www.zakonyprolidi.cz/cs/2005-127) - [Zákon č. 374/2021 Sb. (amendment in force since 1 January 2022), Zákony pro lidi](https://www.zakonyprolidi.cz/cs/2021-374) - [ÚOOÚ, Uděleny pokuty ve výši téměř 4,5 mil. Kč (2 August 2023)](https://uoou.gov.cz/udeleny-pokuty-ve-vysi-temer-45-mil-kc) - [ÚOOÚ, Praxe ÚOOÚ v oblasti cookies (presentation of 12 June 2024)](https://uoou.gov.cz/media/seminare-uoou/prezentace/2024-06-12-p04-praxe-uoou-v-oblasti-cookies.pdf) - [EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042022-calculation-administrative-fines-under_en)