EU Cookie Law (ePrivacy Directive) Explained (2026)

Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, amended by 2009/136/EC) requires websites to obtain prior informed consent before placing any non-essential cookie on a visitor's device. Strictly necessary cookies are exempt. The Directive operates alongside the GDPR as lex specialis for electronic communications and terminal equipment.

The ePrivacy Directive is the EU law that specifically governs how websites use cookies and similar tracking technologies. While the GDPR commands most of the attention in privacy discussions, the ePrivacy Directive is the instrument that directly requires cookie consent banners on virtually every website accessible from Europe.

Formally known as Directive 2002/58/EC on Privacy and Electronic Communications, the law was adopted in 2002 and significantly amended in 2009 by Directive 2009/136/EC. That 2009 amendment introduced the opt-in consent requirement that transformed the online experience for hundreds of millions of users.

The landscape has shifted significantly since 2024. The long-stalled replacement regulation was formally withdrawn, and a new proposal embedded cookie rules directly into the GDPR. This guide covers the Directive's legal text, consent requirements, how it interacts with GDPR, country implementations, the withdrawn Regulation, the November 2025 Digital Omnibus proposals, enforcement, and what organizations need to do.

Quick Answer

The ePrivacy Directive requires websites to obtain user consent before placing non-essential cookies (analytics, advertising, preference cookies) on a visitor's device. Strictly necessary cookies are exempt. The GDPR sets the consent standard: it must be freely given, specific, informed, and based on a clear affirmative action. Pre-ticked boxes and "continue browsing" do not count. The law is a Directive, transposed differently by each EU member state, so penalty structures vary. A proposed Regulation to replace the Directive was withdrawn, with the withdrawal taking effect on its publication in the Official Journal on October 6, 2025. A November 2025 Digital Omnibus proposal now seeks to fold cookie rules into the GDPR through new Articles 88a and 88b, but it remains a draft pending legislative approval.

What Is the ePrivacy Directive?

The ePrivacy Directive (Directive 2002/58/EC) is an EU legislative instrument that regulates the processing of personal data and the protection of privacy in the electronic communications sector. It covers cookies and tracking, unsolicited marketing, traffic data, location data, and confidentiality of communications.

The Directive entered into force on July 31, 2002. It operated alongside the original Data Protection Directive (95/46/EC), which was replaced by the GDPR in May 2018. While the GDPR replaced the general data protection framework, the ePrivacy Directive was retained as the sector-specific rule for electronic communications.

The 2009 Amendment: Birth of Cookie Consent

The original 2002 Directive allowed cookies with a simple opt-out mechanism. Browser settings were considered sufficient protection.

Directive 2009/136/EC changed the standard from opt-out to opt-in. Article 5(3) of the amended Directive states that storing information or accessing information already stored in a user's terminal equipment is allowed only "on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information."

This single change triggered the wave of cookie consent banners that now appear on websites worldwide.

Article 5(3): The Core Cookie Provision

Article 5(3) of the amended Directive states:

"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with [the data protection framework], inter alia, about the purposes of the processing."

The provision then carves out a narrow exception: "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

Article 5(3) is also technology neutral, and the EDPB has said so in detail. In Guidelines 2/2023 on the technical scope of Article 5(3), adopted in version 2.0 on October 7, 2024, it confirmed that the consent requirement reaches tracking pixels including pixels embedded in emails, tracking links and URL parameters, local storage, SDK and connected-device reporting, tracking based on IP address alone, and any unique identifier written to or read from a device. The Guidelines were written to address the tracking methods replacing third-party cookies, so a compliance programme scoped to cookies alone will miss techniques the EDPB treats as equally covered.

Because the ePrivacy Directive is a Directive rather than a Regulation, each EU member state transposed Article 5(3) into its own national law. The substance is consistent, but the penalty structures, enforcement priorities, and some procedural details vary country by country.

How the ePrivacy Directive and GDPR Interact

The ePrivacy Directive and the GDPR are separate instruments that work together but cover different ground. Confusion between the two leads to compliance mistakes.

Scope and the Lex Specialis Relationship

The GDPR is the general data protection regulation that applies to all processing of personal data. The ePrivacy Directive is a lex specialis (specific law) that applies to electronic communications and terminal equipment. Under Article 95 of the GDPR, where the ePrivacy Directive contains specific rules on a topic, those rules take precedence over the GDPR's general provisions.

In practical terms: the ePrivacy Directive governs the act of placing a cookie on a device. The GDPR governs what happens with any personal data collected through that cookie afterward.

Key Differences at a Glance

Why Legitimate Interest Cannot Justify Advertising Cookies

A critical consequence of this relationship: organizations cannot rely on the GDPR's "legitimate interest" basis to set analytics or advertising cookies. Under the ePrivacy framework, consent is the only available legal basis for non-essential cookies. The ePrivacy Directive also applies to cookies that do not involve personal data at all, which the GDPR would not cover. For detailed guidance on what constitutes valid GDPR consent, see our GDPR consent requirements guide.

Cookie Categories Under the Directive

The ePrivacy Directive does not itself define cookie categories. The widely used framework comes from guidance issued by the Article 29 Working Party (now the European Data Protection Board) and national data protection authorities.

Strictly Necessary Cookies

These are exempt from the consent requirement under Article 5(3). They enable core functionality that the user explicitly requested. Examples include:

• Session cookies that maintain a logged-in state
• Shopping cart cookies that remember items during a purchase
• Security cookies that detect authentication abuse or fraud
• Load-balancing cookies that distribute traffic across servers
• Accessibility setting cookies requested by the user

The exemption is narrow. A cookie is strictly necessary only if the service would genuinely fail without it and the user specifically requested that service. A cookie that improves performance or adds convenience but is not essential does not qualify.

Functional Cookies

Functional cookies remember user choices beyond what is strictly necessary. Video player settings fall here and need consent. A display preference the visitor explicitly requested, such as a font size, is exempt under the WP194 Criterion B carve-out when stored for the session or a short period; a long-lived preference cookie, or one set without an explicit request, needs consent.

User-selected display preferences are treated more carefully. Article 29 Working Party Opinion 04/2012 (WP194), section 3.6, treats a language preference cookie set because the user explicitly asked the site to remember the choice as exempt under Criterion B, but only where it is a session or short-term cookie. A long-lived preference cookie, or one set without an explicit request from the user, needs consent.

Analytics Cookies

Analytics cookies track user behavior for statistical purposes. Tools like Google Analytics and Adobe Analytics rely on them. They require consent. Some national regulators have created narrow exemptions for privacy-preserving, first-party analytics, but third-party analytics tools that transfer data externally consistently require consent across all EU jurisdictions.

Advertising and Tracking Cookies

These cookies build user profiles for targeted advertising, retargeting, and cross-site tracking. They include third-party cookies placed by advertising networks, social media pixels, and fingerprinting scripts. They always require explicit consent and attract the most regulatory enforcement attention. See our cookie consent laws by country guide for jurisdiction-by-jurisdiction details.

Consent Requirements

The 2009 amendment aligned cookie consent with the broader EU consent standard. The GDPR reinforced that standard through its definition of consent under Article 4(11) and conditions under Article 7. For a full breakdown, see our GDPR consent requirements article.

What Valid Consent Requires

Valid cookie consent must be:

• Freely given. Users cannot be forced to accept cookies as a condition of accessing the site.
• Specific. Consent must be requested for each purpose separately, not bundled into a single "accept all" checkbox.
• Informed. Users must receive clear information about what cookies are used, what data they collect, who receives the data, and how long the cookies persist.
• Unambiguous. Consent requires a clear affirmative action. Scrolling, continuing to browse, or pre-ticked checkboxes do not constitute valid consent.
• Withdrawable. Users must be able to withdraw consent as easily as they gave it.

The Planet49 Ruling

The Court of Justice of the EU (CJEU) clarified the consent standard in Case C-673/17 (Planet49), decided on October 1, 2019. The court ruled:

1. Pre-ticked checkboxes do not constitute valid consent for cookies.
2. Consent must be active and specific, not passive.
3. Users must be informed of the duration of cookie operation and whether third parties have access to the cookies.
4. The requirement applies whether or not the cookie data constitutes personal data.

This ruling eliminated remaining ambiguity about the opt-in standard.

Reject Must Be as Easy as Accept

Several national data protection authorities, France's CNIL and Italy's Garante among them, require that refusing cookies be no more difficult than accepting, and that a single-click "Accept all" button on the first layer be paired with an equally prominent "Reject all" button. Those requirements come from the national authorities themselves.

The EDPB's Cookie Banner Taskforce, whose report was adopted on January 17, 2023, agreed something narrower. A vast majority of the participating authorities considered that a banner offering no refuse option on any layer cannot produce valid consent, while a few took the view that Article 5(3) does not expressly mention a reject option. The taskforce did not agree that the reject button must sit on the same layer as accept.

"Consent or Pay" Cookie Walls

A cookie wall blocks website access unless the user consents to all cookies. A variant, "consent or pay," allows users to avoid tracking by subscribing to a paid service instead. Both remain contested under EU law.

The EDPB's April 2024 Opinion on "Consent or Pay"

In Opinion 08/2024 issued on April 17, 2024, the EDPB found that "in most cases" large online platforms offering only a "pay or consent to behavioral advertising" model do not produce freely given consent. The opinion states that users should be offered an equivalent alternative that does not require payment of a fee and does not involve behavioral advertising.

The European Commission followed this on April 23, 2025 with a formal decision finding Meta in non-compliance with the Digital Markets Act on the same facts, holding that Meta's paid subscription offered no genuine equivalent alternative free service, and fining Meta €200 million.

On December 8, 2025 Meta undertook to give EU users of Facebook and Instagram a third option, sharing less personal data in exchange for less personalised advertising. The Commission said the options would be presented to EU users in January 2026 and that it would seek evidence on their uptake.

Smaller Sites and Publishers

The EDPB opinion targets "large online platforms." National authorities have reached different conclusions about whether smaller news sites and publishers can operate consent-or-pay models. The Dutch Autoriteit Persoonsgegevens treats consent as invalid where a visitor who refuses cookies is denied access to the site or cannot use it normally. France's CNIL requires that rejecting consent be as easy as accepting it but has not categorically banned all paywall-based consent models for publishers. This question remains unresolved at the EU-wide level.

EDPB Cookie Banner Taskforce

The EDPB established a cookie banner taskforce in September 2021 in response to a wave of complaints from the non-governmental organization noyb (None of Your Business) targeting 422 websites for unlawful consent banners. The taskforce comprised 21 EU and EEA supervisory authorities.

Its January 2023 report records the common positions the participating authorities reached for handling those complaints. The report is a coordination document, not binding law: its own disclaimer says the positions "do not constitute stand-alone recommendations or findings" and "do not prejudge the analysis that will have to be made by the authorities of each complaint and each website concerned." The main positions were:

• A vast majority of the authorities considered that a banner offering no refuse option on any layer is an infringement, though a few did not, on the ground that Article 5(3) does not explicitly mention a reject option.
• Deceptive design (dark patterns) that visually steers users toward consent is non-compliant.
• Consent must be withdrawable at any time, as easily as it was given.
• The banner must give a clear indication of what it is about, of the purpose for which consent is sought, and of how to consent. The taskforce did not require the full cookie information itself on the first layer.

Following the report, national DPAs conducted enforcement sweeps and imposed fines on organizations whose banners failed these standards.

Country-by-Country Implementation

Because the ePrivacy Directive is a Directive, each member state transposed it into national law. Key variations:

France

France implements the Directive through Article 82 of the Loi Informatique et Libertes. The CNIL is among the most active cookie enforcement authorities in Europe. In December 2021 the CNIL fined Google €150 million and Facebook €60 million for making cookie rejection harder than acceptance. On September 1, 2025 the CNIL fined Google €325 million (deliberation SAN-2025-004) on two grounds: displaying advertisements between Gmail users' emails in the Promotions and Social tabs without consent, and placing advertising cookies without valid consent when users created a Google account. The same day it fined Infinite Styles Services Co. Ltd, the company operating shein.com, €150 million (SAN-2025-005) for cookies that were set before users made any choice and that continued to be placed or read after they clicked Refuse all.

The CNIL requires a reject button that is as prominent as the accept button and allows a limited exemption for first-party, aggregated audience measurement cookies under strict conditions. It amended its cookie recommendation by deliberation no. 2025-131 of December 18, 2025 to cover multi-terminal consent, publishing the consolidated recommendation on January 16, 2026, and on March 12, 2026 it adopted a recommendation on tracking pixels in emails that applies EDPB Guidelines 2/2023 to email tracking under Article 82.

Germany

Germany implements cookie consent in section 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). For an ordinary commercial website the supervising authority is the data protection authority of the federal state, not the federal commissioner: section 1(1) no. 8 TDDDG leaves digital services to the authorities competent under Land law and to section 40 of the Federal Data Protection Act. The BfDI is competent for section 25 only where the storage or access is carried out by a telecommunications provider or a federal public body (sections 28(3) no. 2 and 29(2) TDDDG).

A breach of section 25(1) is an administrative offence under section 28(1) no. 13, fineable up to €300,000 under section 28(2), and GDPR fines apply when personal data is involved. The Bundesgerichtshof adopted the CJEU's Planet49 standard on May 28, 2020 in Cookie-Einwilligung II (I ZR 7/16). Since April 1, 2025 the Einwilligungsverwaltungsverordnung has allowed recognised consent management services under section 26 TDDDG.

Ireland

Ireland implemented the Directive through S.I. No. 336 of 2011. The Data Protection Commission (DPC) enforces these rules. Because major technology companies headquartered in Ireland are subject to DPC oversight, Irish enforcement decisions carry outsized influence across the EU. Our guide explains how to make a data protection complaint to the DPC in Ireland.

Italy

Italy's Garante per la protezione dei dati personali issued updated cookie guidelines in June 2021 requiring a visible reject button on the first banner layer. Italy also requires a cookie policy separate from the general privacy policy.

Spain

Spain transposed the Directive through Ley 34/2002 (LSSI). A cookie consent breach is a light infringement under article 38.4(g) LSSI, fined up to €30,000 by article 39.1(c). A repeat within three years becomes a serious infringement under article 38.3(i), fined €30,001 to €150,000, and the law's overall ceiling, for very serious infringements, is €600,000. The AEPD fined Vueling Airlines €30,000 for a banner that offered no way to refuse cookies (PS/00300/2019, paid at the reduced figure of €18,000), and fined Iberia €30,000 on the same provision in October 2020 (PS/00032/2020, appeal dismissed). It has also clarified maximum retention periods for analytics cookies.

Netherlands

The Netherlands implemented the Directive through the Telecommunicatiewet. The Autoriteit Persoonsgegevens (AP) holds that a cookie wall cannot produce valid consent, because a visitor who is denied access after refusing tracking cookies has no real choice.

The AP has been enforcing that position steadily. In April 2025 it wrote to 50 organizations about misleading cookie banners or unlawful tracking, the first batch of the 500 warnings a year it plans to send, giving each three months to fix the banner before an investigation. On November 11, 2025 it reported that it had warned more than 200 websites, that about three quarters had adjusted their banners, and that it was opening investigations into those that had not.

Belgium

Belgium's data protection authority (APD) issued a landmark decision on February 2, 2022 finding that the IAB Europe Transparency and Consent Framework (TCF) violated the GDPR, fining IAB Europe €250,000 and ordering an action plan. On the appeal, the CJEU held on March 7, 2024 in Case C-604/22 that the TC String is personal data and that IAB Europe is a joint controller for the recording of users' preferences, while declining to extend that joint controllership to the later processing carried out by third parties.

The Brussels Market Court closed the case on May 14, 2025. It annulled the 2022 decision on procedural grounds but endorsed the authority's reasoning, confirmed the infringements and the €250,000 fine, and held that IAB Europe is not a controller for processing that takes place entirely inside the OpenRTB protocol.

The Withdrawn ePrivacy Regulation

The European Commission proposed an ePrivacy Regulation in January 2017 to replace the aging Directive with a directly applicable, uniform EU-wide rule. Unlike a directive, a regulation would have eliminated the implementation patchwork entirely.

Why a Regulation Was Proposed

The Commission identified several problems with the Directive:

• Fragmented national implementations creating compliance complexity
• Outdated technology references (the 2002 text predates smartphones and modern tracking)
• Inconsistent enforcement across member states
• The need to align with GDPR's updated data protection framework
• "Cookie consent fatigue" caused by poorly designed consent mechanisms

What the Draft Would Have Changed

The proposed ePrivacy Regulation would have applied directly in all member states, extended scope to over-the-top communications (WhatsApp, Signal, Messenger), introduced browser-based consent as a valid mechanism, aligned penalties with the GDPR framework (up to 4% of global turnover), and regulated metadata more comprehensively.

Formal Withdrawal: October 2025

After eight years of stalled negotiations, the European Commission announced in Annex IV of its 2025 Work Programme, published on February 11, 2025, that it intended to withdraw the proposed ePrivacy Regulation. The work programme was a statement of intent, not the withdrawal itself. The Commission approved the withdrawal at its meeting on July 16, 2025, and the withdrawal took legal effect when the notice "Withdrawal of Commission proposals" appeared in the Official Journal on October 6, 2025 (OJ C, C/2025/5423), listing COM(2017) 10 final, procedure 2017/0003 (COD). The Commission stated that "no agreement is expected from the co-legislators" and that "the proposal is outdated in view of some recent legislation in both the technological and the legislative landscape."

The existing ePrivacy Directive and its national transpositions remain fully in force. The withdrawal means no new ePrivacy Regulation is coming through the 2017 proposal. However, rather than simply abandoning modernization of cookie rules, the Commission pursued a different legislative path through the Digital Omnibus.

The November 2025 Digital Omnibus: Cookie Rules Enter the GDPR

On November 19, 2025, the European Commission adopted a package of proposed amendments to the EU's digital rulebook, published as the Digital Omnibus. The package amends the GDPR, the ePrivacy Directive, the Data Act, and several other instruments simultaneously.

The Core Proposal: Articles 88a and 88b

The Digital Omnibus proposes two new articles in the GDPR that would absorb the cookie consent function currently performed by Article 5(3) of the ePrivacy Directive.

Article 88a would govern cookie and tracking consent within the GDPR framework. Key elements:

• Cookie consent must remain granular, specific, and obtained before cookies are set.
• A data subject must be able to refuse consent "in an easy and intelligible manner with a single-click button or equivalent means."
• Where a user has refused consent, the controller may not request consent again for the same purpose for at least six months.
• The strictly necessary exemption is carried over and widened. Article 88a(3) would also cover first-party audience measurement carried out by the controller of the service solely for its own use, and processing needed to maintain or restore the security of the service.

Article 88b would regulate how consent, refusal, and objection signals are technically expressed. It would require:

• Online interfaces to accept and respect automated, machine-readable consent signals from browsers and operating systems.
• Browser providers (other than SMEs) to enable the technical infrastructure for such signals.
• Two different clocks. Controllers' online interfaces would have to accept and respect the signals 24 months after entry into force (Article 88b(5)), while browser providers that are not SMEs would have to supply the technical means from 48 months (Article 88b(7)). Article 88a itself would apply from six months (Article 88a(5)).

What This Means in Practice

If adopted, the Digital Omnibus changes would mean that a user could configure their browser once to reject tracking across all websites, and websites would be legally required to honor that signal. Cookie banners would not disappear entirely under the proposal but would become less necessary as machine-readable signals take effect.

The EDPB and the European Data Protection Supervisor (EDPS) published a joint statement in 2026 broadly supporting the simplification goals while raising concerns about some provisions and the speed of the legislative timeline.

Current Status

The Digital Omnibus is a Commission proposal, not law. It entered the ordinary legislative procedure on November 19, 2025, and must be reviewed and approved by both the European Parliament and the Council of the EU. As of September 2026 the file (procedure 2025/0360(COD)) is still in first reading. The joint LIBE and ITRE committees published their draft report on June 22, 2026 and discussed it on July 13, 2026, and more than 1,750 amendments were tabled by the July 15, 2026 deadline. The Council has not agreed a negotiating mandate, a scheduled vote on one having been cancelled in June 2026, and no trilogue has opened. The proposal may still change substantially. The existing ePrivacy Directive and GDPR remain the operative law until any replacement enters into force.

Enforcement and Penalties

Because the ePrivacy Directive is transposed through national laws, maximum penalties vary. In practice, most regulators use GDPR fine structures (up to €20 million or 4% of global annual turnover) when cookies involve personal data processing.

Major Enforcement Actions (2021 to 2026)

Enforcement Trends

Enforcement has intensified across Europe since 2021. Several patterns stand out:

• Design parity is required. The reject option must be as prominent and accessible as the accept option. Asymmetric button designs, smaller fonts, and gray-out effects on the reject button are treated as dark patterns.
• First-layer reject button. France, Italy, Belgium, and several other jurisdictions now explicitly require a "Reject all" option on the initial banner, not only behind a settings link.
• Coordinated sweeps. The EDPB coordinates Coordinated Enforcement Framework (CEF) actions where multiple national DPAs simultaneously audit the same sector.
• Advertising cookies drive fines. The largest monetary penalties have consistently involved third-party advertising and tracking cookies placed without valid consent.

Practical Compliance Steps

Organizations with websites accessible from the EU should take the following steps.

Audit First

Run a cookie scan on your website, including all third-party scripts. Document every cookie's name, purpose, retention period, and data recipient. Classify each as strictly necessary, functional, analytics, or advertising.

Build a Compliant Banner

Display a consent banner before any non-essential cookies are set. The banner must:

• Block non-essential cookies until the user makes a choice (prior consent, not post-hoc notice)
• Offer granular category options
• Present accept and reject buttons with equal visual prominence on the first layer
• Avoid pre-ticked checkboxes for any category
• Provide clear, plain-language explanations of each cookie category

Maintain Ongoing Records

Store consent records (what the user chose, when, and which version of the banner was shown). Provide an accessible mechanism to withdraw consent at any time. Re-audit cookies regularly, as third-party scripts often add new cookies without notice.

This is general legal information, not legal advice. Compliance requirements depend on the specific jurisdictions your website serves, the types of cookies used, and the nature of the data collected. Consult a data protection attorney for advice specific to your situation.