Poland requires informed consent before a website stores or reads any cookie that is not strictly necessary, under Article 399 of the Electronic Communications Law in force since 10 November 2024. The President of the Office of Electronic Communications (UKE) enforces that rule, with fines of up to 3% of the previous year's revenue, while the UODO enforces the GDPR for the personal data cookies collect. Consent through browser settings is still allowed, but because that consent must meet the GDPR standard, a website in practice needs its own banner.
Two laws apply: RODO and the Electronic Communications Law
Poland applies two overlapping laws to cookies and tracking technologies. The first is the GDPR, known in Polish as RODO (Rozporządzenie o Ochronie Danych Osobowych), which governs any processing of personal data collected through cookies. The second is the ePrivacy Directive transposition - until recently the 2004 Telecommunications Law (Prawo telekomunikacyjne), and since 10 November 2024, the new Electronic Communications Law (Prawo komunikacji elektronicznej, or ECL).
This new law replaced the old Telecommunications Law and broadened its scope to cover email providers, instant messaging services, and online meeting tools alongside traditional telecoms.
For website owners, the practical effect is straightforward: you need a legal basis under both laws before setting non-essential cookies on a visitor's device. RODO covers the data processing side, while the ECL covers the act of storing information on (or reading it from) terminal equipment.
What Article 399 of the ECL requires
Article 399(1) of the new Electronic Communications Law sets out three conditions for placing cookies or similar technologies on a user's device:
The user must be informed in advance, in a clear, easy and understandable way, about the purpose of storing and accessing the information and about their ability to set the conditions for it through software settings or the service configuration.
The user must give consent after receiving that information.
The stored information must not cause configuration changes to the user's device.
Article 399(2) adds that the user may give that consent through the settings of software on the device, such as a browser, or through the service configuration. The route is still in the statute. The consent itself, however, must meet the GDPR standard: active, informed, specific and freely given, as the CJEU confirmed in its Planet49 ruling. A browser left on its defaults, or set to accept every cookie, tells you nothing about specific purposes, so it is unlikely to count as consent to your analytics or marketing cookies. In practice, a website needs its own banner to collect that consent.
Article 399(3) exempts storage or access that is necessary to transmit a message over a public network, or to provide a service the user requested.
Who enforces cookie rules in Poland
Two authorities share responsibility. The UODO (Urząd Ochrony Danych Osobowych, Poland's data protection authority) enforces RODO and handles complaints about personal data processing, including data collected via cookies like _ga or _fbp. The President of the Office of Electronic Communications (UKE) enforces the ECL provisions on storing and accessing information on terminal equipment.
Penalties differ between the two regimes. RODO violations can attract fines of up to 20 million EUR or 4% of global annual turnover. Under Articles 444(1) and 446(1) of the ECL, storing or reading information in breach of Article 399 carries a fine of up to 3% of the previous calendar year's revenue, imposed by the President of UKE.
In practice, a single cookie banner violation could trigger scrutiny from both regulators.
UODO enforcement: recent actions
The UODO has become increasingly active. In a decision of 17 March 2025, it imposed its largest fine to date - PLN 27.1 million - on Poczta Polska for processing voters' personal data without a valid legal basis during the 2020 postal election plans. Poczta Polska is challenging the fine before the Voivodeship Administrative Court in Warsaw. While not a cookie case, it signals the authority's willingness to impose significant penalties.
In a decision of 20 August 2024, mBank received a fine of PLN 4,053,173 for failing to notify the people affected by a personal data breach. The UODO has also penalised organisations for insufficient technical and organisational security measures, a finding that can apply to websites that leak personal data to third parties through misconfigured tags.
Cookie categories and consent requirements
Polish law follows the same category-based approach seen across the EU. The table below summarises the consent position for each cookie type:
| Cookie category | Examples | Consent required? |
|---|---|---|
| Strictly necessary | PHPSESSID, csrf_token, load balancer cookies | No - exempt under Article 399(3) |
| Functional / Preferences | Theme or layout settings | Yes - opt-in required, unless needed for a service the user requested |
| Analytics / Performance | _ga, _ga_<container-id> | Yes - opt-in required |
| Marketing / Advertising | _fbp, _gcl_au, IDE | Yes - opt-in required |
Users must be able to consent to each cookie category separately. Bundling all non-essential cookies into a single "accept all" option without granular controls does not meet the standard.
Valid consent under Polish law: six tests
Drawing from both RODO and the ECL, valid cookie consent in Poland must pass these tests:
Prior - no cookies set before consent is given
Informed - clear explanation of purposes and cookie types
Freely given - no cookie wall blocking access to content
Specific - separate consent for each purpose or category
Unambiguous - an affirmative action (click, toggle) rather than pre-ticked boxes or continued browsing
Withdrawable - equally easy to withdraw as to give
Article 7(3) of the GDPR requires that withdrawing consent be as easy as giving it. If your "reject" button requires three extra clicks compared to "accept", that design is unlikely to survive scrutiny.
Consent Mode for Polish visitors, and the US contrast
Poland is in the European Economic Area, so Google requires sites that use its advertising and measurement tags for Polish visitors to send consent signals through Google Consent Mode v2, as it has since March 2024. For Polish visitors, the four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) should start as denied and change to granted only after the visitor accepts the matching category in your banner.
The United States works differently. There is no federal cookie consent law, and California's CCPA follows an opt-out model for the sale and sharing of personal information rather than opt-in consent before cookies. A site with visitors in both countries usually needs an opt-in banner for Poland and a different configuration for US visitors.
How Poland compares to neighbouring EU countries
Poland's cookie rules broadly align with the EU standard, but enforcement intensity and specific interpretations vary across the region.
| Country | Authorities | ePrivacy transposition | Notable feature |
|---|---|---|---|
| Poland | UKE (cookie rule) and UODO (GDPR) | Electronic Communications Law (2024) | Dual enforcement by UODO and UKE |
| Germany | State DPAs | TDDDG (the TTDSG of 2021, renamed in May 2024) | Decentralised enforcement across 16 states |
| Czech Republic | UOOU | Electronic Communications Act | Lighter enforcement historically |
| Austria | Telecom authorities (TKG) and DSB (GDPR) | TKG 2021 | Active cookie enforcement since noyb complaints |
The key difference in Poland is the updated ECL from November 2024, which modernised cookie provisions that had remained largely unchanged since 2004. Organisations already following CNIL guidelines in France or German TDDDG rules will find Poland's requirements familiar. The global compliance hub covers the rest of the EU and beyond.
Checklist for Polish websites
Before launch
Run a cookie scan to identify every cookie and tracker on your site
Classify each cookie into the correct category (strictly necessary, functional, analytics, marketing)
Draft a cookie policy in Polish, written in plain language
Make sure no non-essential cookies fire before consent is collected
Cookie banner configuration
Display the banner on first visit with clear purpose descriptions
Offer granular category-level controls - not just "accept all"
Make "reject all" equally prominent as "accept all"
Store consent records with timestamps for audit purposes
Set up region rules so Polish visitors receive the correct banner configuration
Ongoing maintenance
Re-scan periodically - new tags added by marketing teams can introduce undisclosed cookies
Update your cookie policy when categories or purposes change
Integrate Google Consent Mode v2 if you use Google Analytics or Google Ads
Short answers on Polish cookie rules
Does Poland require cookie consent for analytics cookies?
Yes. Under both RODO and the Electronic Communications Law, analytics cookies like _ga require prior opt-in consent. Only strictly necessary cookies are exempt.
Can browser settings count as cookie consent in Poland?
Article 399(2) of the Electronic Communications Law still allows consent through browser or other software settings, or the service configuration. That consent must meet the GDPR standard, though, and a general browser setting rarely shows specific, informed consent to your purposes, so in practice a website needs its own banner.
What is the maximum fine for cookie violations in Poland?
Cookie-related fines can reach up to 3% of the previous year's revenue under the Electronic Communications Law (enforced by UKE) or up to 20 million EUR or 4% of global turnover under RODO (enforced by UODO), depending on which law is breached.
Do I need a cookie banner in Polish for Polish visitors?
While no specific legal requirement mandates the Polish language, the ECL requires that information be provided in a clear, easy and understandable way. For Polish-speaking visitors, a banner in their language is the most reliable way to meet that standard.
Is UODO the only regulator that can fine for cookie issues?
No. The UODO enforces RODO (data protection), while UKE (the Office of Electronic Communications) enforces the ECL provisions on cookie storage and access. Both can impose separate penalties for the same violation.
Does the new 2024 Electronic Communications Law change cookie rules?
The ECL, effective 10 November 2024, carried Poland's cookie rule into Article 399 and extended coverage to new communication services. It kept the option of consent through browser settings, and the core consent standard remains aligned with the ePrivacy Directive and CJEU case law.
Meet both Polish cookie regimes with one banner
If your website targets visitors in Poland, cookie consent has to satisfy both RODO and the Electronic Communications Law. Start with a free scan to see which cookies your site sets, then set up a banner with granular category controls and a record of each choice.
