European Union cookie rules require many websites to obtain permission before using non-essential cookies and similar tracking technologies.
The main rules come from the ePrivacy Directive and national laws implementing it. The GDPR also applies when cookies or other technologies process personal data.
This guide explains when consent is required, which technologies may qualify for an exception, and what an EU cookie banner should include.
EU websites generally need prior consent before activating advertising, profiling, cross-site tracking, and many analytics technologies.
Consent must involve a clear positive action. Non-essential technologies should remain disabled until the visitor makes a choice, and refusing consent should be as easy as accepting it.
What Are EU Cookie Consent Laws?
There is no single European Union law called the “cookie law.” Website cookies and similar technologies are mainly regulated through:
- the ePrivacy Directive: controls when a website may store information on or access information from a visitor’s device;
- national ePrivacy laws: implement the directive in individual EU Member States;
- the GDPR: applies when the collected information identifies or relates to a person;
- national regulatory guidance: explains how the rules are interpreted and enforced in each country.
The central cookie requirement appears in Article 5(3) of the ePrivacy Directive. It applies to more than files traditionally labelled as browser cookies.
If you need a broader international comparison, start with our guide to cookie consent laws around the world.
What Is the Difference Between the GDPR and the ePrivacy Directive?
The ePrivacy Directive and the GDPR work together, but they control different parts of online tracking.
| Rule | Main Purpose | When It Applies |
|---|---|---|
| ePrivacy Directive | Controls storage and access technologies | When information is stored on or accessed from a visitor’s device |
| GDPR | Controls the processing of personal data | When cookie or tracking information identifies or relates to a person |
The ePrivacy rules apply to information, not only personal data. A technology can therefore fall under Article 5(3) even when it does not directly identify someone.
If the collected information is personal data, the website must also meet GDPR requirements such as transparency, purpose limitation, data minimisation, security, and an appropriate legal basis.
Where ePrivacy requires consent for a particular technology, a website cannot normally avoid that requirement by choosing legitimate interests under the GDPR.
An advertising cookie stores an identifier in a visitor’s browser. The ePrivacy rules control whether the website may place or access that cookie. If the identifier is linked to the visitor or used to build a profile, the GDPR also applies.
Why Can Cookie Rules Differ Between EU Countries?
The ePrivacy Directive sets an EU-wide framework, but each Member State implements it through national legislation.
This means the basic principles are similar across the European Union, while some details can differ. These differences may include:
- how narrowly an exception is interpreted;
- whether certain audience measurement tools may qualify for an exemption;
- the information that must appear on each banner layer;
- how cookie walls and consent-or-pay models are assessed;
- which authority enforces the national cookie rules;
- the penalties available under national law.
A banner that is appropriate in one EU country is not automatically compliant in every other Member State.
Website owners should consider where their visitors are located and check the guidance published by the relevant national authorities.
Do not assume that following the guidance of one EU authority guarantees compliance throughout the European Union. National implementation and enforcement practices can differ.
Which Technologies Are Covered by EU Cookie Rules?
Article 5(3) of the ePrivacy Directive is not limited to traditional cookies. It can apply whenever a website stores information on or accesses information from a visitor’s device.
Technologies that may fall within its scope include:
- browser cookies;
- tracking pixels and web beacons;
- local storage and session storage;
- advertising identifiers;
- scripts and tags;
- device fingerprinting techniques;
- link decoration and tracking parameters;
- embedded video, map, or social media services;
- mobile app identifiers and software development kits;
- technologies used on smart TVs and connected devices.
The European Data Protection Board explains the technical scope in its Guidelines 2/2023 on Article 5(3).
Whether a technology is first-party or third-party does not determine whether the rules apply. The important questions are what the technology does, which information it accesses, and why it is being used.
Learn more about the technologies you may find during an audit in our guide to the different types of cookies and trackers.
When Is Cookie Consent Required in the EU?
Prior consent is generally required when a cookie or similar technology does not meet one of the limited ePrivacy exceptions.
Websites should normally obtain consent before using technologies for:
- online and personalised advertising;
- cross-site or cross-device tracking;
- visitor profiling;
- social media tracking;
- advertising measurement;
- personalised content based on behaviour;
- recording individual visitor sessions;
- building audience segments;
- many analytics purposes.
Consent must be collected before these non-essential technologies are activated. Loading them when the page opens and asking for permission afterwards does not meet the prior-consent requirement.
Legitimate interests under the GDPR cannot normally replace a consent requirement created by the ePrivacy rules. If ePrivacy requires consent, the technology should wait until valid consent has been received.
Which Cookies Can Be Used Without Consent?
Article 5(3) of the ePrivacy Directive contains two main exceptions. They should be interpreted according to the exact purpose of the technology.
| Exception | What It Covers | Possible Example |
|---|---|---|
| Communication | Storage or access used solely to transmit a communication over an electronic communications network | A load-balancing technology required to route the communication |
| Strictly Necessary | Technology essential to provide a service explicitly requested by the visitor | A shopping cart or login cookie required for a requested function |
| Non-Essential | Technology used for purposes that are not necessary to deliver the requested service | Advertising, profiling, or cross-site tracking cookies |
A cookie does not become strictly necessary simply because it is helpful to the website owner or improves the website’s business results.
Communication exception
The communication exception is narrow. The storage or access must be used solely to transmit a communication over a network.
If the same technology is also used for analytics, advertising, profiling, or another separate purpose, the exception may no longer cover those additional uses.
Strictly necessary exception
The strictly necessary exception applies when the technology is essential to provide a function the visitor has actively requested.
Possible examples include:
- remembering products in an online shopping basket;
- maintaining a secure login session;
- authenticating a user;
- supporting essential payment or security functions;
- remembering a visitor’s cookie choices;
- load balancing required to deliver the website.
The exception depends on the purpose. A security cookie may be necessary, while an advertising identifier used on the same page is not.
Do Analytics Cookies Require Consent in the EU?
Analytics cookies often require consent, particularly when they track individual visitors, create profiles, combine information across services, or share information with third parties.
However, the position is not completely uniform throughout the European Union. Some national authorities recognise limited exemptions for narrowly configured audience measurement.
Where such an exemption exists, it may require conditions such as:
- using analytics only to measure the performance of the website;
- collecting aggregate rather than individual-level information;
- avoiding cross-site tracking;
- not using the information for advertising or profiling;
- limiting data retention;
- reducing the information stored in identifiers;
- providing visitors with clear information and an opt-out method;
- ensuring the provider does not reuse the information for its own purposes.
These national exemptions should not be treated as a universal EU rule. A standard third-party analytics setup does not automatically qualify.
Our separate guide explains what website owners should consider when configuring Google Analytics cookie consent.
What Counts as Valid Cookie Consent?
When consent is required under the ePrivacy rules, the GDPR standard of consent is generally used.
Consent should be:
- freely given;
- specific;
- informed;
- unambiguous;
- given through a clear positive action.
Continuing to browse a website is not a sufficiently clear consent action. Silence, inactivity, and pre-ticked boxes are also insufficient.
The Court of Justice of the European Union confirmed in the Planet49 decision that a pre-selected checkbox does not provide valid cookie consent.
Before making a choice, visitors should be able to understand:
- which types of technologies the website wants to use;
- the purpose of each category;
- which third parties are involved;
- how long the technologies remain active;
- how to accept, reject, or customise their choices;
- how to withdraw consent later.
Consent should also be recorded so the website can demonstrate when and how it was obtained.
Want a beginner-friendly explanation of valid consent under the GDPR?
EU Cookie Banner Requirements
A cookie banner is not automatically required for every website. The correct consent mechanism depends on the technologies the website uses.
If a website uses non-essential cookies or trackers, its EU consent banner should generally:
- appear before non-essential technologies are activated;
- clearly explain why cookies and similar technologies are used;
- provide an option to accept non-essential technologies;
- provide an equally accessible option to reject them;
- offer granular controls for different purposes;
- avoid pre-enabled non-essential categories;
- identify relevant third parties;
- provide access to more detailed information;
- allow visitors to change or withdraw their choices later;
- work correctly on desktop and mobile devices.
Example of an appropriate first layer
A simple first layer could include:
- Accept All
- Reject Non-Essential
- Customise Choices
The second layer can provide category controls and more information about purposes, providers, and duration.
Banner designs to avoid
An EU cookie banner should not:
- activate marketing cookies before a choice is made;
- treat scrolling or continued browsing as consent;
- use pre-ticked checkboxes;
- include only an “Accept” button;
- hide rejection behind several unnecessary steps;
- use confusing colours or wording to push visitors towards acceptance;
- make withdrawing consent more difficult than giving it.
See our complete guide to cookie banner requirements for more design and configuration guidance.
Does an EU Cookie Banner Need a Reject All Button?
The ePrivacy Directive does not prescribe one exact button label for every website. However, visitors must be able to refuse non-essential technologies as easily as they can accept them.
The European Data Protection Board’s Cookie Banner Taskforce reported that authorities considered the absence of a reject option on the first layer to be inconsistent with valid consent where an accept button was available there.
For a standard cookie banner, displaying “Accept All” and “Reject Non-Essential” with comparable visibility is therefore the clearest approach.
Hiding rejection inside a settings menu while placing a prominent acceptance button on the first layer can create an unnecessary imbalance.
A banner displays three visible controls: “Accept All,” “Reject Non-Essential,” and “Customise.” Advertising and analytics technologies remain disabled unless the visitor actively enables them.
Does an EU Website Need a Cookie Policy?
Website owners must provide clear and comprehensive information about the storage and access technologies they use.
A cookie policy should normally explain:
- which cookies and similar technologies are used;
- the purpose of each technology;
- which organisation or provider controls it;
- whether it is first-party or third-party;
- how long it remains active;
- whether consent is required or an exception is being used;
- how visitors can manage or withdraw their choices.
The information should be easy to find and written in language that ordinary visitors can understand.
Learn how to structure this information in our guide on how to create a cookie policy page.
Do EU Cookie Laws Apply to Websites Outside the EU?
A business does not necessarily avoid European privacy requirements because its company or website is located outside the European Union.
Under Article 3 of the GDPR, the regulation can apply to a non-EU organisation when its processing relates to:
- offering goods or services to people in the EU; or
- monitoring their behaviour while that behaviour takes place in the EU.
Online behavioural advertising, profiling, and tracking visitors across websites may constitute monitoring.
The territorial application of national ePrivacy rules must also be assessed separately. Relevant factors can include visitor location, the service being provided, and the national law implementing the directive.
Do not determine the applicable law only from the location of your company. Visitor location, service targeting, tracking activities, and the type of information collected may also matter.
What Happens If a Website Does Not Comply?
Cookie rules are generally enforced by national authorities. Depending on the Member State, this may be a data protection authority, telecommunications authority, or another designated regulator.
Possible regulatory action can include:
- requests for information;
- website and banner investigations;
- orders to change how technologies are used;
- requirements to delete unlawfully collected information;
- national ePrivacy penalties;
- GDPR sanctions where personal data processing also infringes the GDPR.
A cookie violation does not automatically result in the highest possible GDPR fine. The applicable enforcement framework depends on the violated rule, national legislation, the seriousness of the infringement, and the personal data processing involved.
Incorrect tracking can also create complaints, loss of visitor trust, inaccurate consent records, and problems with advertising or analytics providers.
Are EU Cookie Rules Changing?
The European Commission introduced a Digital Omnibus proposal in November 2025 that includes proposed changes affecting the ePrivacy Directive, the GDPR, and other EU digital legislation.
The proposal may change how certain storage and access technologies are handled and how visitor preferences can be expressed.
However, a legislative proposal is not the same as an adopted law. As of August 2026, procedure 2025/0360/COD remains part of the EU legislative process.
Website owners should continue following the current ePrivacy Directive, applicable national laws, and the GDPR. Proposed Digital Omnibus changes should not be treated as effective requirements unless the legislation is adopted and enters into force.
Practical EU Cookie Compliance Checklist
Website owners can use the following steps to review their EU cookie consent setup.
Use these steps to identify and manage the cookie requirements that may apply to your website.
- Identify your technologies. Check cookies, pixels, scripts, tags, local storage, embeds, and fingerprinting.
- Record each purpose. Explain why every technology is being used.
- Separate essential technologies. Do not classify a cookie as necessary only because it is useful.
- Review visitor locations. Identify the EU countries your website serves.
- Check national rules. Review guidance from the relevant Member State authorities.
- Block non-essential technologies. Keep advertising and other non-exempt tracking disabled before consent.
- Provide balanced choices. Make refusing non-essential technologies as easy as accepting them.
- Offer granular controls. Let visitors choose between relevant purposes.
- Name third parties. Explain which providers receive or access information.
- Publish clear information. Keep your cookie and privacy information accurate.
- Allow withdrawal. Give visitors an accessible way to reopen their settings.
- Keep consent records. Record when and how choices were made.
- Test the banner. Confirm that technologies respond correctly to every visitor choice.
- Repeat the review. Check again when plugins, tags, embeds, or providers change.
A cookie audit can help identify the technologies your website currently loads.
After configuring your consent solution, follow our guide on how to test a cookie banner.
Official EU Cookie Guidance
Website owners can consult the following official European Union sources:
- ePrivacy Directive;
- General Data Protection Regulation;
- EDPB Guidelines 05/2020 on consent;
- EDPB Guidelines 2/2023 on the technical scope of Article 5(3);
- EDPB Cookie Banner Taskforce report;
- Digital Omnibus legislative procedure 2025/0360/COD.
Because the ePrivacy Directive is implemented nationally, website owners should also consult the regulator responsible for cookie rules in each relevant Member State.
Conclusion
EU cookie consent laws are mainly based on the ePrivacy Directive, national implementing laws, and the GDPR.
Websites generally need prior consent before activating advertising, profiling, cross-site tracking, and other non-essential technologies. Consent must be informed, specific, and given through a clear positive action.
Strictly necessary technologies may qualify for an exception, but the exception depends on their exact purpose. Analytics rules can vary between Member States and should not be treated as uniform throughout the EU.
The practical starting point is to identify what the website loads, determine why each technology is used, check the relevant national requirements, and block everything else until valid consent is received.
Not sure whether your current setup actually requires consent? Continue with our guide explaining whether your website needs a cookie banner.
This article provides general information about cookie consent and privacy requirements. It does not constitute legal advice.
Frequently Asked Questions
Common questions about this topic
No. A cookie banner is generally needed when a website uses cookies or similar technologies that require consent. A website using only strictly necessary technologies may not need a consent banner, but it must still provide clear information about their use.
Advertising, profiling, cross-site tracking, social media, and many analytics cookies generally require prior consent. Strictly necessary cookies used to provide a service explicitly requested by the visitor may qualify for an exception.
Usually not. Analytics technologies often require consent, especially when they track individual visitors, share information with third parties, or support advertising. Some EU countries recognise limited exemptions for narrowly configured audience measurement, but this is not a universal EU rule.
Where the first layer provides an Accept All button, visitors should also have an equally accessible way to reject non-essential cookies. A visible Reject Non-Essential or Reject All button is generally the clearest approach.
No. Consent must result from a clear positive action. Pre-ticked boxes, inactivity, silence, scrolling, or simply continuing to use the website do not provide valid cookie consent.
They can. The GDPR may apply when a non-EU website offers goods or services to people in the EU or monitors their behaviour there. The territorial scope of the relevant national ePrivacy law should also be checked.
Yes. Withdrawing consent should be as easy as giving it. Websites should provide an accessible link, button, or settings icon that allows visitors to reopen their cookie preferences and change their choices.
