The ePrivacy Directive is the EU law that requires consent before a website stores or reads information on a visitor's device, which is why most websites need a cookie banner. Officially Directive 2002/58/EC, amended in 2009, it also governs the confidentiality of electronic communications, traffic and location data, and email and SMS marketing. As of October 2026 it is still the law: the planned ePrivacy Regulation was withdrawn in 2025, and a proposal to move the cookie rule into the GDPR has not been adopted.
While the GDPR gets most of the headlines, the ePrivacy Directive is the law regulators usually apply when they fine organisations for cookie violations. On 1 September 2025, the French data protection authority, the CNIL, fined Google 325 million euros, over adverts shown between Gmail emails and cookies set when users created a Google account, and Shein 150 million euros, over cookies placed before visitors made any choice. Both decisions applied French law that transposes the ePrivacy rules, not the GDPR directly.
What the ePrivacy Directive covers
The Directive covers four main areas of electronic privacy. The best known is Article 5(3), which regulates the storage of information on, or access to information from, a user's device. This is the provision that governs cookies - but its scope extends far beyond them.
The full scope includes:
| Area | Key articles | What it covers |
|---|---|---|
| Cookies and tracking | Article 5(3) | Any storage of or access to information on a user's terminal equipment, including cookies, tracking pixels, device fingerprinting, and local storage |
| Confidentiality of communications | Articles 5(1), 5(2) | Prohibition on intercepting, recording, or surveilling electronic communications without consent |
| Traffic and location data | Articles 6, 9 | Rules on processing metadata such as IP addresses, timestamps, and geolocation from communications |
| Unsolicited communications | Article 13 | Rules on direct marketing via email, SMS, and automated calling systems (the "spam" rules) |
Article 5(3) of the ePrivacy Directive is technology-neutral. It does not mention the word "cookie" at all. Instead, it refers to "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user." This means that tracking pixels, JavaScript fingerprinting scripts, localStorage, and even certain uses of ETags can all fall within its scope.
The relationship between the ePrivacy Directive and the GDPR
This is where most website owners get confused. The ePrivacy Directive and the GDPR are separate legal instruments that work together rather than replacing each other. In legal terms, the ePrivacy Directive is lex specialis to the GDPR's lex generalis. Article 95 of the GDPR explicitly establishes this relationship: where the ePrivacy Directive provides a specific rule for a particular type of processing, that rule takes precedence over the more general GDPR provisions.
What does this mean in practice? When a visitor lands on your website and a cookie is placed on their device, the requirement for that placement comes from the ePrivacy Directive (Article 5(3)), not from the GDPR. The GDPR's consent rules under Article 4(11) and Article 7 define how that consent must be obtained - freely given, specific, informed, and unambiguous - but the obligation to obtain consent comes from the ePrivacy Directive.
Any subsequent processing of personal data collected through those cookies, however, falls squarely under the GDPR. So if you collect a visitor's browsing behaviour via an analytics cookie, the ePrivacy Directive governs the cookie placement, while the GDPR governs what you do with the data afterwards. Both laws apply, at different stages of the same process.
Why implementation varies by country
A directive is not the same as a regulation. Under EU law, a regulation (like the GDPR) applies directly and uniformly in every member state. A directive, by contrast, instructs member states to achieve a particular result but leaves them free to choose how to transpose it into national law.
This has created a patchwork of national implementations across Europe. France transposed Article 5(3) into Article 82 of the French Data Protection Act, giving the CNIL authority to enforce cookie rules and impose fines up to 2% of worldwide annual turnover. The UK implemented it through the Privacy and Electronic Communications Regulations 2003 (PECR), enforced by the ICO. Germany's transposition was notoriously problematic: the old Telemedia Act (TMG) allowed pseudonymous tracking profiles on an opt-out basis, which contradicted the Directive's opt-in requirement for years until the TTDSG took effect on 1 December 2021. That law was renamed the TDDDG in May 2024.
The practical consequence for website owners operating across multiple EU countries is that enforcement standards, fine levels, and specific requirements can differ. The CNIL has been far more active on cookie enforcement than most other DPAs, issuing nine-figure fines where others have favoured warning letters.
Article 5(3): the cookie rule in detail
Article 5(3) is the single most important provision for anyone running a website that targets EU visitors. It sets a plain default rule: you must obtain informed consent before storing information on, or accessing information from, a user's device.
There are only two exemptions. A cookie (or similar technology) can be placed without consent if it is:
- Strictly necessary to carry out the transmission of a communication over the network - for example, load-balancing cookies that route traffic between servers.
- Strictly necessary to provide an information society service explicitly requested by the user - for example, a session cookie (
PHPSESSID) that keeps you logged in, or a shopping cart cookie that remembers items you have added.
Everything else requires prior, informed consent. Google Analytics cookies such as _ga and _ga_<container-id>? Consent required. Advertising cookies like _fbp from Meta Pixel? Consent required. A/B testing scripts that store variant assignments in localStorage? Consent required. Regulators have shown little patience for arguments that legitimate interest can justify cookie placement: the ePrivacy Directive does not recognise legitimate interest as a basis for Article 5(3) operations.
The Planet49 ruling: a turning point for cookie consent
The CJEU's judgment in Planet49 (Case C-673/17, 1 October 2019) settled several questions that had been ambiguous since the Directive's 2009 amendment. It ruled that pre-ticked checkboxes do not constitute valid consent, that GDPR-standard consent (active, unambiguous, specific) applies to Article 5(3) regardless of whether the cookie contains personal data, and that website operators must inform users about both the duration of cookies and whether third parties have access to them.
The ruling removed any remaining justification for implied consent mechanisms - the "by continuing to browse this site, you consent to cookies" banners that were once commonplace across Europe. Active, affirmative action from the user is required. Scrolling, clicking through, or ignoring a banner does not count.
The ePrivacy Regulation was withdrawn
The European Commission proposed an ePrivacy Regulation on 10 January 2017 to replace the Directive. On 11 February 2025, the Commission announced its withdrawal in its 2025 work programme, and it formally withdrew it on 6 October 2025, according to the Legislative Observatory file 2017/0003(COD). The Directive, last amended in 2009, therefore remains the governing law. A separate article on the Regulation covers its history and why it failed.
EDPB guidelines on Article 5(3): beyond cookies
With no Regulation coming, the European Data Protection Board (EDPB) has been updating how the existing Directive is read. On 7 October 2024, the EDPB adopted the final version of Guidelines 2/2023 on the technical scope of Article 5(3), expanding on older guidance from the Article 29 Working Party.
These guidelines confirmed that Article 5(3) applies to far more than HTTP cookies. The EDPB identified three criteria for the provision to apply: the operation must involve "information" (not limited to personal data), it must involve "terminal equipment" connected to a public communications network, and it must constitute either storage or access to stored information. Under this framework, the following technologies all fall within Article 5(3):
- URL and pixel tracking (including the tracking pixels in marketing emails)
- Device fingerprinting via JavaScript APIs
- Local storage mechanisms (
localStorage,sessionStorage,IndexedDB) - Unique identifiers derived from hashed personal data (such as hashed email addresses used for cross-site matching)
- Internet of Things (IoT) device data where the device connects to a public network
The guidelines also confirmed that "terminal equipment" includes smartphones, tablets, laptops, smart TVs, connected cars, and IoT devices - essentially any device with a network interface, whether the connection is direct (cellular) or indirect (via Wi-Fi or Bluetooth relay).
How enforcement works
One critical difference between ePrivacy enforcement and GDPR enforcement is jurisdiction. The GDPR's one-stop-shop mechanism allows a company to deal primarily with the data protection authority in the EU country where its main establishment is located. The ePrivacy Directive has no such mechanism. Each national authority can enforce its own transposition of the Directive independently.
This means a company like Google can face cookie enforcement actions from the CNIL in France and the AEPD in Spain without any coordination requirement, and from the ICO under the UK's separate PECR. The CNIL's 2025 fine against Google was based on French national law, and Google's Irish establishment offered no jurisdictional shield.
Recent enforcement trends show regulators focusing on three areas:
| Enforcement focus | Examples | Typical outcome |
|---|---|---|
| Cookies placed before consent | Advertising and analytics cookies firing on page load before the banner is interacted with | Fines ranging from tens of thousands to hundreds of millions of euros |
| Dark patterns in cookie banners | Asymmetric button design (prominent "Accept All", hidden or greyed-out "Reject"), misleading labels, required extra clicks to refuse | Formal notices, fines, mandatory redesign orders |
| Inadequate information | Vague purpose descriptions ("improve your experience"), missing cookie categories, no details on duration or third-party access | Orders to comply, fines for repeat offenders |
On 12 December 2024, the CNIL issued formal notices to website publishers over misleading cookie banners, giving them one month to change them. In the UK, the ICO wrote to the operators of the most-visited websites in January 2025, and reported in December 2025 that 979 of the top 1,000 UK websites now met its cookie standards.
What the ePrivacy Directive means for your website
If your website is aimed at visitors in the EU, the ePrivacy Directive's national transpositions apply to the cookies you set on their devices, and the UK's PECR applies to UK visitors. The core requirements are clear, even if implementation can be fiddly.
Before any non-essential cookie or tracking technology is placed on a visitor's device, you need their informed, active consent. The consent mechanism must make it equally easy to accept and refuse cookies - no dark patterns, no pre-ticked boxes, no "accept" button in bright green next to a tiny grey "reject" link. You must tell visitors what cookies you set, what each category does, how long they last, and which third parties receive data from them.
Strictly necessary cookies - session identifiers, CSRF tokens, load-balancing cookies, user-input cookies for forms - can be set without consent. The exemption is narrow, but it covers some preference cookies. A cookie that remembers a language the visitor chose is generally exempt if it is not linked to other identifiers and lasts no longer than it needs to: the Article 29 Working Party's Opinion 04/2012 on cookie consent exemption treats such user-interface customisation cookies as exempt when the user explicitly asked for the setting. A cookie that guesses a language from tracking data is not. See the guide on functional cookies for more on this distinction.
A cookie scanner is a practical starting point. Many websites set cookies they are unaware of, particularly when third-party scripts are loaded via tag managers. Kukie.io's cookie scanner detects both first-party and third-party cookies across your site, sorts them into categories, and flags those that need consent.
Direct marketing rules under Article 13
Article 13 of the ePrivacy Directive is less discussed than Article 5(3) but equally important for marketers. It requires prior opt-in consent before sending direct marketing communications by email, SMS, or automated calling systems.
There is one exception, commonly called the "soft opt-in." If you obtained a customer's email address in the context of a sale of a product or service, you may send marketing emails promoting similar products or services without prior consent, provided you gave the customer a clear opportunity to opt out at the time of collection and in every subsequent message.
The Directive also prohibits sending commercial emails that disguise or conceal the sender's identity, and it requires that every marketing email include a valid opt-out mechanism.
What happens next
The 2002 Directive (as amended in 2009) remains the law, and no change applies yet. On 19 November 2025, the European Commission proposed the Digital Omnibus, which would move the rule on storing and reading information on devices into the GDPR. As of October 2026, it is still a proposal: the European Parliament's committees published a draft report on 22 June 2026 and have not voted.
In the meantime, enforcement is intensifying rather than relaxing. The EDPB's interpretation of Article 5(3) means that newer tracking techniques - fingerprinting, hashed email matching, and server-side setups that still read identifiers from the device - are within scope. The CNIL's sanctions in 2025 totalled about 487 million euros across all its work, with 21 organisations sanctioned over trackers, according to its review of 2025.
For website owners, the message is clear: the ePrivacy Directive may be old, but it is very much alive, and the fines for getting it wrong have never been higher.
Short answers on the ePrivacy Directive
Is the ePrivacy Directive the same as the GDPR?
No. The ePrivacy Directive (2002/58/EC) is a separate law that specifically governs cookies, electronic communications, and direct marketing. It works alongside the GDPR as lex specialis, meaning its specific rules on cookies and tracking take precedence over the GDPR's more general provisions. Both laws can apply to the same processing activity at different stages.
Does the ePrivacy Directive apply outside the EU?
The Directive itself only binds EU member states, but national transpositions can reach websites based elsewhere. If your website targets visitors in France, Germany, or another EU country, the local ePrivacy rules apply to the cookies you set on those visitors' devices, regardless of where your business is based. The UK's PECR continues to apply post-Brexit with similar requirements.
Which cookies are exempt from consent under the ePrivacy Directive?
Only cookies that are strictly necessary to transmit a communication over the network, or strictly necessary to provide a service the user has explicitly requested, are exempt. This covers session cookies, authentication tokens, shopping cart cookies, CSRF protection cookies, and short-lived cookies that remember a choice the user made, such as a language. Analytics and advertising cookies require consent.
What happened to the ePrivacy Regulation?
The European Commission announced the withdrawal of its ePrivacy Regulation proposal on 11 February 2025 and formally withdrew it on 6 October 2025, after eight years without agreement. The ePrivacy Directive remains in force. A Digital Omnibus proposal from November 2025 would move the cookie rule into the GDPR, but as of October 2026 it has not been adopted.
Can I use legitimate interest instead of consent for cookies?
No. Article 5(3) of the ePrivacy Directive only allows non-essential information to be placed on a user's device with consent, unless one of the two strictly necessary exemptions applies. Legitimate interest under GDPR Article 6(1)(f) does not apply to the initial cookie placement, though it may apply to subsequent processing of data collected through a cookie where the GDPR governs that processing.
How much can regulators fine for ePrivacy cookie violations?
This varies by member state because fines are set by national law. France's CNIL can impose fines of up to 2% of worldwide annual turnover for cookie violations under Article 82 of the French Data Protection Act, and in September 2025 it fined Shein 150 million euros over cookies. In the UK, PECR fines can reach 17.5 million pounds or 4% of global turnover since 5 February 2026.
Does the ePrivacy Directive apply to mobile apps?
Yes. Article 5(3) applies to any storage of or access to information on terminal equipment, which includes smartphones and tablets. Mobile SDKs that store identifiers, tracking pixels within in-app browsers, and locally stored data all fall within scope. The EDPB's 2024 guidelines confirmed that any device connected to a public communications network - directly or indirectly - qualifies as terminal equipment.
Find out what your site stores on visitors' devices
If you are unsure what cookies and trackers your website sets, a free scan is the fastest way to find out. Kukie.io finds and sorts every cookie on your site, blocks the non-essential ones until visitors choose and shows a banner with an equal "Reject all" on the first layer.
