# The ePrivacy Directive: the actual EU cookie law > The ePrivacy Directive is the law that makes cookie banners necessary in Europe. Its Article 5(3) says that storing information on a visitor's device, or reading information already there, requires the visitor's prior consent after clear and comprehensive information, with two exceptions: what is needed to transmit a communication and what is strictly necessary for a service the visitor asked for. It applies to cookies, pixels, local storage and fingerprinting alike, whether or not personal data is involved, and it is enforced by each country's own authority under its own fines. Source: https://cookiequiet.com/laws/eprivacy-directive Published: 2026-10-20 Publisher: Cookiequiet ## Quick facts - **Applies to:** Anyone who stores or reads information on the device of a user in the EU or EEA: websites, apps, email senders, connected devices - **Consent model:** Prior opt-in consent, defined by reference to the GDPR, for every tracker that is not exempt - **Cookie rule:** Article 5(3), as amended in 2009: consent after clear and comprehensive information, except for communication-only and strictly necessary storage - **Exemptions:** Strictly necessary cookies everywhere; first-party audience measurement in some countries under strict conditions (France since 2020) - **Maximum fine:** Set by each member state; in France, breaches of Article 82 can be fined up to 10 million euros or 2% of worldwide annual turnover (Article 20 of the Loi Informatique et Libertés) - **Authority:** National authorities (CNIL, ICO before Brexit, Garante, AEPD, the German state authorities and others), without the GDPR's one-stop shop - **In force since:** Directive of 12 July 2002; cookie consent rule added by Directive 2009/136/EC, to be transposed by 25 May 2011 ## What is the ePrivacy Directive? Directive 2002/58/EC, the Directive on privacy and electronic communications, is often called the ePrivacy Directive or simply the cookie law. It was adopted on 12 July 2002 to protect the confidentiality of communications. In 2009 the Citizens' Rights Directive (2009/136/EC) rewrote its Article 5(3): instead of a right to refuse cookies, users now had to consent before anything was stored on or read from their equipment. Member states had until 25 May 2011 to transpose the new rule. Because it is a directive, each country has its own implementing law: Article 82 of the French Data Protection Act, section 25 of the German TDDDG, Article 122 of the Italian Privacy Code, Article 22.2 of the Spanish LSSI, and so on. The wording and the enforcement style differ, but the core obligation is the same everywhere. A replacement, the ePrivacy Regulation, was proposed by the European Commission in January 2017 and never agreed. The Commission withdrew the proposal in its 2025 work program on 11 February 2025, so the Directive and the national laws remain the applicable rules for the foreseeable future. ## Who does it apply to? Article 5(3) protects the terminal equipment of users in the EU and EEA. It does not care where the website is hosted or where the company sits, and it does not require the stored information to be personal data: the Court of Justice confirmed in Planet49 (C-673/17, 1 October 2019) that the consent requirement applies whether or not the information is personal data. The EDPB's Guidelines 2/2023 (final version of 7 October 2024) explain how far it reaches: cookies, local storage, tracking pixels, URL parameters that identify a user, device fingerprinting, IP-based tracking and the reporting done by connected objects can all be storage or access within the meaning of Article 5(3). ## What does it require for cookies and trackers? The rule has three parts. 1. **Information first.** The user must receive clear and comprehensive information, in line with the [GDPR](/laws/gdpr), about the purposes of the storage or access. In Planet49 the Court said this includes the lifetime of the cookies and whether third parties can read them. 2. **Prior consent.** Consent is the GDPR's consent: freely given, specific, informed, unambiguous, by a clear affirmative action, and withdrawable at any time. Nothing non-exempt may be stored or read before that action. Pre-ticked boxes, continued browsing and cookie walls do not qualify. 3. **Two exemptions.** No consent is needed for storage or access whose sole purpose is to carry out the transmission of a communication, or that is strictly necessary for an information society service the user has explicitly requested. The Article 29 Working Party's Opinion 04/2012 lists the usual cases: session identifiers, shopping carts, authentication, security, load balancing, interface preferences, and the cookie that stores the consent choice itself. A cookie is not strictly necessary because the site owner finds it useful; the test is the user's request. Analytics is the gray zone. The Directive has no exemption for audience measurement, but some authorities accept a narrow one. The CNIL exempts analytics trackers that are limited to audience measurement and A/B testing, do not cross-reference data with other processing, track only one publisher's site, truncate the IP address, live at most 13 months, and come with information and a right to object. Google Analytics in its standard configuration does not meet those conditions. In the United Kingdom, a comparable exception for statistical purposes exists since 5 February 2026 under the [UK rules](/laws/uk-gdpr-pecr). In Germany, Italy or Spain, analytics cookies need consent unless the tool is configured so that no identifier is stored. Legitimate interest is not a legal basis for the storage or access itself. The EDPB's cookie banner task force wrote in January 2023 that Article 5(3) leaves no room for it, and that any processing that follows an unlawful cookie cannot be lawful under the GDPR either. ## What must a compliant banner do? Under the Directive a banner is only lawful if it actually holds the trackers back. The order of operations matters: the page loads, the banner appears, nothing else runs; the visitor accepts, refuses or customizes; only then do the tags for the accepted categories execute. A banner that appears while Google Ads and Meta Pixel are already firing fails the test, however nice it looks. Our guide on [blocking scripts until consent](/guides/block-scripts-until-consent) covers the mechanics. The banner must also present the choice honestly: a Reject option on the first screen as visible as Accept (the CNIL's and the EDPB task force's position), purposes explained, nothing pre-ticked, and an easy way back to change the choice later. ## Enforcement and fines Each member state sets its own penalties and runs its own enforcement, and the GDPR's one-stop shop does not apply, so a company headquartered in Ireland can be fined by the French, Spanish or Italian authority for cookies set on their residents' devices. France is by far the most active: the CNIL fined Google 100 million euros and Amazon 35 million euros on 7 December 2020, Google 150 million euros and Facebook 60 million euros on 31 December 2021, Microsoft 60 million euros on 19 December 2022, TikTok 5 million euros on 29 December 2022, Yahoo 10 million euros on 29 December 2023, and on 1 September 2025 Google 325 million euros and Shein 150 million euros. The reasoning is consistent: cookies set before any choice, refusing harder than accepting, purposes not explained, consent that cannot be withdrawn freely. Other authorities act through orders rather than headline fines. The Spanish AEPD and the Italian Garante publish cookie guidance and fine smaller sites regularly, and the EDPB task force report of 2023 gives all EU authorities a common baseline for handling the hundreds of complaints filed by noyb against cookie banners. ## How Cookiequiet handles the ePrivacy Directive Cookiequiet does the blocking part by design: scripts marked with a category and embeds marked with a data attribute run only after consent for that category, markup from CookieYes and Cookiebot is understood, and an auto-blocker holds scripts and iframes injected by tag managers or lazy loaders from about 80 known trackers until the visitor chooses. The honest limit: a tracker hard-coded in the HTML before our script, without the marking, runs before we can stop it, which is why the install guides say to load our script first. The banner shows Accept all and Reject all with equal weight, with [Google Consent Mode v2](/guides/google-consent-mode-v2) defaults set to denied, and the consent log keeps the proof. Geo-targeting can limit the banner to the EEA and the other countries with a consent law, which matters for the [eight CNIL decisions above](/blog/cnil-cookie-guidelines-explained). ## Questions ### Is the ePrivacy Directive the same as the GDPR? No. The ePrivacy Directive is the older, narrower law that decides whether you may store or read anything on a user's device; the GDPR governs the personal data you then process. They overlap on consent, because the Directive uses the GDPR's definition. Cookie fines are issued under the national ePrivacy laws, with the GDPR's consent standard. ### Did the ePrivacy Regulation replace the Directive? No. The Regulation proposed in 2017 was never adopted and the European Commission withdrew it on 11 February 2025. The Directive, as amended in 2009, and the national laws that transpose it remain in force. ### Do I need consent for analytics cookies under the ePrivacy Directive? In most EU countries, yes. The Directive has no analytics exemption. France exempts first-party audience measurement that meets the CNIL's conditions (no cross-site tracking, truncated IP, 13-month lifetime, right to object), and privacy-focused tools configured without identifiers can fall outside the rule altogether. A standard Google Analytics 4 setup needs consent. ### Does the Directive apply to pixels, local storage and fingerprinting? Yes. Article 5(3) covers any storage of information on, or access to information from, the user's device. The EDPB's Guidelines 2/2023 confirm that tracking pixels, local storage, identifying URL parameters, fingerprinting and IP-based tracking are within scope. ## Sources - [Directive 2002/58/EC (ePrivacy Directive) on EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng) - [Directive 2009/136/EC amending Article 5(3) (the 2009 cookie amendment)](https://eur-lex.europa.eu/eli/dir/2009/136/oj/eng) - [EDPB, Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive (version 2.0, 7 October 2024)](https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en) - [CNIL, Sheet n°16: Use analytics on your websites and applications (conditions of the consent exemption)](https://www.cnil.fr/en/sheet-ndeg16-use-analytics-your-websites-and-applications) - [CNIL restricted committee, deliberation SAN-2020-012 of 7 December 2020 (Google, 100 million euros), Legifrance](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706) - [European Commission, 2025 work program (withdrawal of the ePrivacy Regulation proposal, 11 February 2025)](https://commission.europa.eu/strategy-and-policy/strategy-documents/commission-work-programme/commission-work-programme-2025_en)