The ePrivacy Directive
The European directive that says you need consent before your site stores any cookies. Here is what it actually requires — and what it means for your site.
What is the ePrivacy Directive?
Often called "the cookie law" — an EU regulation that has been in force for over two decades.
The ePrivacy Directive is officially Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector. Adopted in 2002, it complements the rules for marketing emails, telephone marketing, location data — and, crucially, cookies.
A key amendment arrived in 2009 (Directive 2009/136/EC), tightening the rules for cookies. Before this amendment, simply informing users about cookies was enough. From 2009, prior consent is required.
Unlike GDPR — which is a regulation directly applicable in all member states — ePrivacy is a directive. That means each member state must transpose it into national law. So in Czechia you meet Act 127/2005, in Germany TTDSG, in France CNIL rules.
Article 5(3) — why you need consent
One sentence decided that the cookie banner is not a luxury, but an obligation.
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information.
Article 5(3), Directive 2002/58/EC (as amended by 2009/136/EC)
The key phrase is "storing of information or gaining access to information". This covers every cookie — regardless of whether it contains personal data or not. It also covers pixels, local storage, fingerprinting and similar technologies.
The only exception is cookies "strictly necessary" for providing a service explicitly requested by the user. That means cookies for login, shopping carts, or security. Everything else — analytics, marketing, personalisation — requires prior consent.
What Article 5(3) actually requires
Four rules that every site targeting users in the EU must meet.
Prior consent
Consent must be obtained BEFORE cookies are stored. No pre-ticked checkboxes, no cookies "just in case" before the user clicks "Accept".
Clear information
Users must know which cookies are stored, what they do, who has access, and how long they will be active. Hidden lists in the footer are not enough.
Easy refusal
Declining cookies must be as easy as accepting them. No labyrinthine settings, no cookie walls blocking content.
Withdrawal
Users can withdraw consent at any time. The site must provide an easily accessible way to change preferences (typically a "Cookie settings" link in the footer).
ePrivacy vs. GDPR
Two regulations that overlap but do not duplicate each other. Here is the difference.
Special regulation for electronic communications
ePrivacy specifically addresses cookies, behavioural tracking, email marketing and confidentiality of communications. It covers ALL cookies — even those without personal data. As a "lex specialis", ePrivacy takes precedence over GDPR when the two conflict.
General personal-data regulation
GDPR governs personal data processing in general — from HR systems to cloud services. In the context of cookies, it defines what "consent" must look like (freely given, specific, informed, unambiguous) and how data must be handled afterwards.
In practice: for cookies, ePrivacy answers "whether", GDPR answers "how". Our consent mechanism satisfies both at once.
Frequently asked questions
Does the ePrivacy Directive apply to sites outside the EU?
Yes, if they target EU users or process their data. Like GDPR, ePrivacy has extraterritorial reach. A US e-shop selling to European customers must have a cookie banner.
When will the ePrivacy Regulation arrive, and what will change?
The proposed ePrivacy Regulation (which would replace the directive) has been under negotiation since 2017 but is still not adopted. It is expected to tighten rules for cookies, tracking, and messaging platforms (WhatsApp, Skype). The adoption date is unclear — we monitor developments and update Consentio accordingly.
If I comply with GDPR, is ePrivacy automatically covered?
No. GDPR and ePrivacy overlap but do not duplicate. For cookies, both apply simultaneously — ePrivacy says "you need consent for all cookies except strictly necessary ones", and GDPR says "this is what that consent must look like". You must comply with both.
What happens if I don't comply with ePrivacy?
Enforcement is carried out by national data protection authorities (in the Czech Republic, ÚOOÚ). Fines depend on the national law but often align with the GDPR ceiling — up to €20 million or 4% of global annual turnover. In practice, EU authorities have issued hundreds of millions of euros in cookie-related fines.
Solve cookies today.
Sleep peacefully tomorrow.
Try for free - No card required
- 5 minutes to implementation
- Made in EU