ePrivacy is a directive — each member state implements it through its own law. Here is an overview of the major European markets and what actually applies in each.
A regulation (GDPR) applies identically across the EU. A directive (ePrivacy) does not — it must be transposed.
EU law has two main instruments. A regulation applies directly in all member states — that's why GDPR is identical everywhere. A directive sets a goal but leaves the means to each member state. ePrivacy is a directive from 2002, so each member state had to translate it into its own national law.
In practice, this means that the core cookie rules are the same everywhere (you need consent, the strictly-necessary exception, the right to withdraw), but the details vary — who supervises, what the fines are, what special exceptions exist. Here is an overview of the six largest EU markets.
Which specific law applies in each country, and who enforces it.
Act No. 127/2005, § 89
The Act on Electronic Communications, §89(3), implements Article 5(3) of the ePrivacy Directive. It requires prior, demonstrable consent for all cookies except those strictly necessary. Amended in 2022.
Regulator: Office for Personal Data Protection (ÚOOÚ)
TDDDG (formerly TTDSG)
Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, in force since December 2021 (originally TTDSG, renamed in May 2024). One of the strictest — fines up to €300,000 per individual breach.
Regulator: Federal and state data protection authorities (BfDI + Länder)
Loi 78-17 + CNIL guidelines
The Data Protection Act (1978, amended) plus binding CNIL guidelines from 2020 and 2021. CNIL is famous for aggressive enforcement — Google, Amazon, and Facebook have all received fines in the tens of millions of euros.
Regulator: Commission Nationale de l'Informatique et des Libertés (CNIL)
LSSI-CE, Art. 22.2
Ley de Servicios de la Sociedad de la Información, Article 22.2, implements the cookie rules. Supplemented by binding AEPD guidance from 2023, which clarifies what the consent mechanism must look like.
Regulator: Agencia Española de Protección de Datos (AEPD)
Codice Privacy + Garante 2021
The Italian Privacy Code plus binding guidelines from the Garante (June 2021). The Italian authority is one of the most active — regularly issuing guidance and fining sites for non-compliant cookie banners.
Regulator: Garante per la protezione dei dati personali
Telecommunicatiewet, Art. 11.7a
The Telecommunications Act, Article 11.7a, implements ePrivacy. The Dutch authority Autoriteit Persoonsgegevens issues clear guidance and actively audits sites — particularly in healthcare and finance.
Regulator: Autoriteit Persoonsgegevens (AP)
The skeleton is identical everywhere. The details — who, how fast, and how much — differ.
Yes. If your site targets users in a given country (e.g. localised content, a .de domain, or shipping to that country), the local law applies. In practice this means complying with the strictest relevant regulation — which automatically covers you everywhere else.
Our cookie banner is configured to meet the strictest EU standards (typically CNIL/France + Garante/Italy). That automatically satisfies milder laws in other countries. We offer jurisdiction-specific settings where needed.
The UK has its own UK GDPR and PECR (Privacy and Electronic Communications Regulations), which are functionally identical to EU ePrivacy. The regulator is the ICO. Consentio supports UK sites too — no special configuration usually needed.
For EU users, ePrivacy and national laws apply. For the US, often CCPA/CPRA (California). For other countries, local rules. Consentio detects visitor location and applies the appropriate behaviour — opt-in banner for the EU, opt-out mode for the US.
