# Cookie consent in Poland: what Article 399 requires > In Poland, storing or reading cookies and similar trackers on a visitor's device requires clear prior information and the visitor's consent, under Article 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej), in force since 10 November 2024. Consent follows the GDPR standard, strictly necessary storage is exempt, and the President of the Office of Electronic Communications (UKE) can fine breaches up to 3% of the previous year's revenue. The data protection authority, UODO, handles the personal data side under the GDPR. Source: https://cookiequiet.com/laws/poland Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Anyone who stores or reads information on the device of a user in Poland: websites, apps, ad and analytics providers - **Consent model:** Opt-in after clear prior information; consent rules of the data protection law apply (Article 400) - **Cookie rule:** Article 399 of the Electronic Communications Law of 12 July 2024 (Dz.U. 2024 poz. 1221) - **Authority:** President of UKE for Article 399 (fines); President of UODO for the GDPR side - **Maximum fine:** Up to 3% of the previous year's revenue, imposed by the President of UKE (Articles 444(1)(82) and 446(1)) - **In force since:** 10 November 2024, replacing Article 173 of the Telecommunications Law of 16 July 2004 ## Which Polish law regulates cookies? Poland transposes Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) in Article 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej) of 12 July 2024, published as Dz.U. 2024 poz. 1221. The act entered into force on 10 November 2024. It replaced the Telecommunications Law of 16 July 2004, whose Article 173 carried the cookie rule for two decades. The new act also transposes the European Electronic Communications Code, which is why cookies now sit in a long telecoms statute next to rules on numbering, spectrum and roaming. Article 399 has the same structure as the Directive. Storing information on the end user's terminal equipment, or accessing information already stored there, is allowed only if three conditions are met: 1. **Prior information.** The user is told beforehand, in a clear, easy and understandable way, about the purpose of the storage or access and about how to set the conditions of storage or access through the settings of their software or the configuration of the service. 2. **Consent.** After receiving that information, the user consents. 3. **No configuration changes.** The stored information or the access does not change the configuration of the user's device or the software installed on it. Article 400 adds that the rules of data protection law apply to obtaining that consent. In practice this imports the [GDPR](/laws/gdpr) definition: freely given, specific, informed, unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. ## Which cookies are exempt from consent? Article 399(3) lifts the conditions when storage or access is necessary to carry out the transmission of a message over a public network, or to provide a telecommunications service or an electronically supplied service that the user requested. This is the Directive's strictly necessary exemption. Session identifiers, shopping carts, login and security cookies, load balancing and the cookie that stores the consent choice fit here. Polish law has no separate exemption for analytics. Audience measurement cookies, advertising pixels, social media embeds and session replay tools need consent unless they are configured so that nothing is stored on or read from the device. Article 399(4) adds a specific rule for installing software on the user's device: the user must be told the purpose, how the provider will use it and how to remove it, and must consent before installation. ## Can browser settings count as consent in Poland? Article 399(2) says the user may give consent through the settings of software installed on the device or through the configuration of the service. The old Article 173 had a similar clause, and many Polish sites long relied on a notice saying that continuing to browse with cookies enabled meant consent. That reading is hard to square with Article 400 and the GDPR standard: default browser settings that accept cookies are not a clear affirmative action, and the Court of Justice ruled in Planet49 (C-673/17, 1 October 2019) that pre-ticked or passive consent is not valid. The safe reading is that browser settings can express a choice only if the user actively made it. A banner that blocks trackers until the visitor clicks is the approach that holds up under both laws. ## Who enforces cookie rules in Poland? Two authorities are involved, and the split matters. - **The President of UKE** (Urząd Komunikacji Elektronicznej, the Office of Electronic Communications) enforces the Electronic Communications Law. Article 444(1)(82) makes it a finable breach to store or access information on a user's device, or to install software there, contrary to Article 399. Article 444(2)(8) adds a fine for failing to obtain the end user's consent under Article 399. - **The President of UODO** (Urząd Ochrony Danych Osobowych, the Personal Data Protection Office) enforces the GDPR. When cookies carry personal data, which most identifiers do, the later processing of that data falls under UODO. Under the old law, UODO examined cookie complaints using Articles 173 and 174 of the Telecommunications Law together with the GDPR. Under the new act, the fine for the cookie rule itself sits with UKE. ## How high are the fines? Under Article 446(1), fines imposed by the President of UKE under Article 444 reach up to 3% of the revenue the company earned in the previous calendar year. Where revenue in the three preceding years did not exceed 500,000 zloty, Article 446(3) caps the fine at 15,000 zloty. Under Article 444(4), UKE can also fine the person managing a telecommunications undertaking up to 300% of their monthly salary, but that applies to telecoms operators, not to ordinary website owners. GDPR breaches handled by UODO follow the GDPR scale, up to 20 million euros or 4% of worldwide annual turnover. We found no published fine by UKE under Article 399 as of October 2026. The rule is new and enforcement has so far focused on telecoms operators, so the risk for a typical website comes mainly from complaints to UODO and from the general consent standard set by the EDPB. ## What should a cookie banner in Poland do? A banner that meets Article 399 and the GDPR together: - appears before any non-essential cookie is set and blocks those scripts until the visitor chooses; - explains in Polish, clearly and simply, what each category does, who sets the cookies and how long they last; - offers Accept and Reject options of equal prominence on the first screen, as the EDPB's cookie banner task force expects (see the [Reject all guide](/guides/reject-all-button)); - lets visitors choose by purpose, with nothing pre-ticked; - lets visitors change or withdraw their choice at any time; - keeps a record of each consent so you can show it was given. ## Does the banner have to be in Polish? The Polish Language Act of 7 October 1999 requires Polish in dealings with consumers in Poland, including offers and the information for consumers that other laws make mandatory (Articles 7 and 7a). A foreign-language version may be shown, but a Polish version must be provided at the same time. Since Article 399 itself demands information that is clear, easy and understandable, a cookie notice aimed at Polish visitors should be in Polish. ## How Cookiequiet fits Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Polish to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting is included on every plan, [including Free](/pricing). Run the [cookie scanner](/tools/cookie-scanner) first to see which trackers your site sets before any choice. ## Questions ### Is Article 173 of the Telecommunications Law still the Polish cookie rule? No. Since 10 November 2024 the rule is Article 399 of the Electronic Communications Law of 12 July 2024, which replaced the Telecommunications Law. The substance is similar, but the new act links consent to data protection law and gives the President of UKE a specific fine for breaches. ### Who can fine a website for cookies in Poland? The President of UKE can fine breaches of Article 399, up to 3% of the previous year's revenue. The President of UODO can fine GDPR breaches linked to the personal data collected through cookies, on the GDPR scale. ### Do analytics cookies need consent in Poland? Yes. Article 399 only exempts storage needed to transmit a message or to provide a service the user requested. Polish law has no analytics exemption, so Google Analytics and similar tools need consent unless they store and read nothing on the device. ### Is a cookie notice that relies on browser settings enough in Poland? It is risky. Article 399(2) allows consent through browser settings, but Article 400 applies the GDPR consent standard, which requires a clear affirmative action. Default settings that accept cookies are not an active choice, so a banner with real Accept and Reject options is the safer design. ## Sources - [Ustawa z dnia 12 lipca 2024 r. Prawo komunikacji elektronicznej (Dz.U. 2024 poz. 1221), ISAP](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240001221) - [Prawo komunikacji elektronicznej, metadata and text via the Sejm ELI API (entry into force 10 November 2024)](https://api.sejm.gov.pl/eli/acts/DU/2024/1221) - [Ustawa z dnia 7 października 1999 r. o języku polskim (Polish Language Act), ISAP](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU19990900999) - [EDPB, Report of the work undertaken by the Cookie Banner Taskforce (17 January 2023)](https://www.edpb.europa.eu/documents/task-force-report/report-of-the-work-undertaken-by-the-cookie-banner-taskforce_en) - [Court of Justice of the EU, Planet49 (C-673/17, 1 October 2019), press release](https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf)