Cookies and Consent

The legal framework

Two sets of rules apply to cookies. The ePrivacy Directive 2002/58/EC (Article 5(3)) governs storing information on, or gaining access to information stored on, a user's device. Each member state implements it in its own law, so details and enforcement differ per country. The GDPR governs the processing of personal data that follows. The rules apply to cookies, pixels, local storage, software development kits in apps and similar technologies.

The ePrivacy rule is that prior consent is required, with one exception: cookies strictly necessary to provide a service the user has explicitly requested, or for the sole purpose of transmitting a communication. Examples are a session cookie for a shopping basket, a login cookie or a load-balancing cookie. Analytics, advertising, social-media plug-ins, A/B testing and personalisation generally need consent. The "strictly necessary" exception is read narrowly.

What consent means

The GDPR definition applies (Articles 4(11) and 7): freely given, specific, informed and unambiguous, given by a clear affirmative act. The Court of Justice held in Planet49 (Case C-673/17) that pre-ticked boxes do not produce valid consent. Consequences:

• no non-essential cookie before the user has chosen;
• no consent by scrolling, continued browsing or silence;
• accepting and refusing must be equally easy, which in practice means both options at the first layer of the banner;
• consent per purpose, with a way to give or refuse separately;
• no access to the site made conditional on accepting tracking ("cookie wall") where that deprives the user of a free choice;
• withdrawal as easy as giving consent, typically through a permanent link to the settings;
• the user must be told who the third parties are and what each purpose is.

National authorities publish guidance in this spirit, and the European Data Protection Board has issued guidelines on consent. Several of them have cookie checklists for website operators. These create no new obligations, but they show what an authority expects, including the reject option on the first layer. Check the current guidance of the country you target before you rely on it.

Information and records

Cookies that collect personal data also trigger the information duties in Articles 13 and 14. You should be able to show what the user agreed to and when, so keep consent records. Children's consent is a special case: under Article 8 GDPR the default age for consent to information society services is 16, and member states may set it lower, but not below 13. Check the age in each country you target.

In practice

A furniture retailer has a banner with a large "Accept all" button and a small grey link "Manage preferences". Analytics and advertising scripts fire as soon as the page loads, before any click. A scan shows 23 cookies, of which only six are strictly necessary. Under the rules above, the retailer has two problems: the non-essential cookies are placed without consent, and refusing takes several clicks while accepting takes one.

The fix is technical as much as legal. Tags must be blocked until consent is given, the banner needs an equal "Reject all" button, categories must be accurate, and the retailer needs a settings link in the footer. The privacy notice should list the cookies and their retention. After the changes, the retailer checks again, since a new marketing tool added by the agency can undo the work in a week.

Website technology audits describe how this verification works.

Beyond the banner

Analytics that uses a cross-site identifier, advertising networks and session replay tools involve joint controllership, transfers and sometimes a DPIA. Use the record of processing to list each tool, its purpose and its legal basis.

Frequently asked questions

Do we need a banner if we only use analytics?

If the analytics tool stores or reads information on the device, yes, prior consent is required, unless the tool falls within the narrow exception. A server-side measurement that does not touch the device is assessed under the GDPR only.

Is "legitimate interest" an alternative to consent for cookies?

Not for the storing and reading of information on the device. That step needs consent under the ePrivacy rules unless the cookie is strictly necessary.

How long does a cookie choice last?

There is no fixed legal period. Choose a reasonable one, ask again when your cookies or purposes change, and keep the choice available for withdrawal at any time.

Who is responsible if a third-party script sets cookies?

The website operator is responsible for what its website does, and may be a joint controller with the third party for the data the script collects.

How this connects

Cookie compliance is a standing item in DPO as a Service. The register records the tools involved, and a DPIA is needed when tracking is extensive. The client portal is where your team and the DPO work through these items.