EU cookie compliance combines device-storage and access rules under ePrivacy with GDPR requirements where personal data is processed. Start with the operations and purposes, identify applicable national rules, and make the website follow the user's valid choice where consent is required.
This guide is the legal and operational overview. Use our cookie banner examples for interface design and our analytics consent guide for assessing measurement exemptions. Neither a banner vendor nor a browser setting determines compliance on its own.
GDPR and ePrivacy address different questions
Article 5(3) of the ePrivacy Directive addresses storing information on, or accessing information from, a user's device. It requires consent, subject to exceptions for transmission and operations strictly necessary to provide an explicitly requested service. National implementing law matters. GDPR separately governs personal-data processing, including its lawful basis and transparency. ePrivacy Directive, GDPR
| Review question | Evidence to collect |
|---|---|
| What device operations occur? | Cookies, storage, scripts, requests and technical identifiers |
| What purpose does each operation serve? | A concrete function, not merely a vendor category |
| Which national rules apply? | Scope assessment and relevant authority guidance |
| What personal-data processing follows? | Recipients, purposes, lawful basis, retention and transfers |
| Does the deployed site match the decision? | Tests before consent, after refusal and after withdrawal |
Do not use GDPR legitimate interests to bypass a separate consent requirement for device access. Conversely, do not assume all backend processing requires cookie consent simply because it relates to a website. Assess each operation and its legal basis.
Does GDPR apply to a website outside the EU?
A business outside the EU can fall within GDPR's scope for relevant processing when it offers goods or services to people in the Union or monitors their behaviour there. Processing in the context of an EU establishment can also be covered even when the processing itself takes place elsewhere. Mere website accessibility from the EU is not enough to establish targeting. Citizenship is not the test. EDPB territorial-scope guidance
Illustrative assessment: a retailer deliberately markets and delivers to customers in EU countries and uses advertising profiles to analyse their behaviour. Its scope review should examine those activities, rather than relying on the location of its headquarters or hosting provider.
Assess national cookie-law scope separately. Do not infer that one GDPR finding settles every ePrivacy question. An IP-based region rule can help deliver the chosen configuration, but it is not the legal assessment. Document what happens when location is unavailable and test that fallback. UK GDPR and PECR need a separate review; do not automatically extend an EU exemption to UK visitors.
Which cookies may be strictly necessary?
Start with the service the person requested and the operation needed to deliver it. A business finding data useful is not the same as the operation being necessary for that service. The examples below are review prompts, not blanket exemptions for products or cookie names.
| Illustrative operation | What to establish |
|---|---|
| Remembering a basket during shopping | The identifier is needed for that requested basket function and is not repurposed for advertising |
| Maintaining a signed-in session | The storage supports the requested authenticated service, with justified scope and lifetime |
| Saving cookie preferences | The record implements the choice and does not become a general tracking identifier |
| Preventing abuse | The specific security operation is necessary and proportionate; the vendor label alone is insufficient |
| Advertising or audience measurement | A separate consent or specific exemption assessment exists; business value is not the justification |
CNIL lists basket, authentication and saved-choice trackers among its French examples of exemptions, subject to their function. CNIL cookie guidance
Record additional uses explicitly. For example, an identifier used to keep a basket available may later be sent to an advertising destination. The basket justification does not automatically cover that second use. Keep the purpose, recipient, lifetime and justification together in the inventory. The analytics consent guide covers restricted audience measurement separately.
Cookie rules extend beyond cookie files
The EDPB's Guidelines 2/2023 interpret the technical scope of Article 5(3), including pixels, URL tracking, local processing and certain IP-based tracking operations. They clarify existing provisions rather than create a new statutory requirement. They explicitly leave exemption analysis to case-specific assessment under relevant national rules. EDPB technical-scope guidance
A practical inventory should therefore follow data through the whole implementation. Record what a script accesses, what leaves the browser, what a server adds and which destinations receive it. “No cookies detected” is a limited observation, not a conclusion about every privacy obligation.
For terminology, see first-party vs third-party cookies. For collection architecture, see server-side tracking.
What valid consent requires
GDPR Articles 4 and 7 require a freely given, specific, informed and unambiguous choice, demonstrable by the controller. Consent must be withdrawable as easily as it was given. Silence, inactivity and preselected choices do not establish the necessary affirmative agreement. GDPR consent provisions
In Planet49, the CJEU rejected pre-ticked cookie consent and addressed information about cookie duration and third-party access. This makes both the choice and the supporting notice relevant. CJEU Planet49 summary
For an implementation review, ask whether the purpose is clear, whether the person can refuse, and whether the choice maps accurately to processing. A visually polished banner with an incorrect purpose-to-vendor mapping can still produce an outcome the person did not select.
Banner design: distinguish requirements from recommendations
Our recommended starting point for optional tracking is clear acceptance and rejection on the first layer, with comparable effort and readability, plus settings for meaningful purpose choices. Treat this as an implementation recommendation to check against applicable national guidance.
The EDPB Cookie Banner Taskforce report records common positions and differences between authorities. It calls for case-specific assessment of potentially misleading colours and contrast; it does not impose a universal colour standard. EDPB taskforce report
Do not turn a design recommendation into a claim that a particular arrangement guarantees compliance. Check the language, interaction, accessible controls, notices and tag behaviour together. The banner examples guide provides adaptable wording and testing scenarios.
Analytics exemptions require a configuration assessment
Restricted audience measurement may qualify for an exemption under applicable national rules. That is not a general exemption for everything called analytics. France's CNIL guidance provides a configuration-based assessment, and warns against describing solutions as CNIL-certified or validated. CNIL audience-measurement guidance
Ask which conditions support the conclusion and what would invalidate it. Review settings, recipients, identifiers and actual outputs rather than relying on a product name. Our analytics cookies and consent guide separates device access, personal-data processing and national exemption conditions.
Rejection and withdrawal must reach the data flow
Inspect the whole journey after the person refuses or changes a choice. Test saved preferences on the next page, subsequent cookie reads, browser events, server forwarding and queued retries.
CNIL's 2025 SHEIN decision concerned failures including cookies before consent, incomplete information and ineffective refusal or withdrawal. The relevant lesson is to test actual operations rather than only the state of a button. The decision concerns French cookie law; it should not be presented as a general penalty formula for every European site. CNIL decision summary
If Google tags are involved, distinguish technical Consent Mode settings from legal permission. Use basic vs advanced Consent Mode to define expected requests and Consent Mode troubleshooting to investigate mismatches.
Withdrawal is not the same as deleting every record
Withdrawn consent must stop the processing that relies on it. It does not retrospectively make earlier consent-based processing unlawful. Where no other legal ground supports keeping the personal data, Article 17 provides for erasure. A separate legal obligation to retain a transaction record does not authorise continuing to use it for optional advertising. GDPR Articles 7 and 17
Illustrative failure: a visitor disables advertising, the browser stops sending new events, but the backend continues retrying queued advertising events using an old preference. Include that route in the withdrawal test and define how pending work is reassessed. Clearing a cookie alone does not resolve a downstream queue or stored profile.
Evidence, retention and asking again
Keep proportionate evidence that connects the displayed notice and purposes with the user's choice. A useful implementation record can include the timestamp, notice version, purpose states, relevant configuration version and a suitable reference for the preference. These are suggested fields, not a universal statutory schema.
Document how you will prove what was shown without unnecessarily collecting additional identifiers. Restrict access and define retention separately for preference records, audit evidence and raw logs. GDPR's accountability and storage-limitation principles apply; there is no general cookie-consent rule requiring every site to keep all logs for three to six years. GDPR Articles 5 and 7
Avoid repeatedly requesting a choice that the person has already made. CNIL describes remembering acceptance and refusal for six months as a general good practice, with context relevant to the duration. This is not a universal EU minimum or a guarantee that old consent covers changed purposes. CNIL cookie recommendation
A practical review sequence
- Inventory: list device operations, purposes, recipients and server routes.
- Assess: identify applicable rules and document consent requirements or specific exemptions.
- Explain: align the notice and purpose controls with that assessment.
- Implement: establish defaults and propagate updates to every relevant destination.
- Test: cover no interaction, refusal, partial consent, acceptance, withdrawal and return visits.
- Maintain: review new vendors, purpose changes, notice versions and configuration releases.
Record expected and observed results. A successful consent-platform scan should be supplemented with manual journeys and server checks where those routes exist. The GDPR readiness assessment helps organise a broader review.
FAQ
Does GDPR replace ePrivacy cookie rules?
No. Device storage and access and personal-data processing are related but distinct questions. Review the national ePrivacy implementation and GDPR obligations relevant to the operation.
Does hosting outside the EU avoid GDPR?
No. Hosting location alone does not determine scope. Examine establishment, offering goods or services to people in the Union, and monitoring behaviour there. National device-storage rules also need their own scope assessment.
Does withdrawal mean every historical record must be deleted?
Not automatically. Stop the processing that relied on the withdrawn consent and assess erasure and any separately justified retention. Do not treat retaining an order for a legal obligation as permission to keep using it for marketing.
Are first-party cookies exempt?
Not automatically. Assess their purpose and the applicable conditions. A first-party identifier can still support optional advertising or measurement.
Must every website display a cookie banner?
Not necessarily. Assess whether the site performs operations requiring consent. Necessary or otherwise exempt operations still need an appropriate assessment and relevant information, and unrelated optional embeds must not be overlooked.
Does a consent platform or TCF string prove compliance?
No. A platform and its signals can support an implementation. They do not establish that the choice was valid, the information was complete or all recipients followed it.
Is consent or pay covered by these examples?
No. Conditional-access and paid-alternative models require a separate assessment of the service, choice, applicable law and current guidance. Do not treat an ordinary banner example as approval for that model.
Review your EU consent setup
Use the banner examples to inspect the interface and the analytics consent decision guide to review measurement. For practical support, explore cookie consent implementation or request a free consent audit.
