Introduction
The ePrivacy Directive—often called the cookie law—is the EU framework that governs electronic communications privacy. It sits alongside GDPR and focuses specifically on storing or accessing information on a user's device, which includes cookies, local storage, pixels, and similar technologies.
National implementations vary in detail, but the core expectation is consistent: before you place non-essential cookies or read device identifiers for analytics or advertising, you generally need informed consent. Strictly necessary cookies—for example session security or load balancing—are treated differently.
Website owners feel ePrivacy most directly in cookie banners, tag firing rules, and scanner findings. Understanding this law helps you explain why Accept and Reject must be meaningful, not decorative.
What it means
Article 5(3) of the ePrivacy Directive requires consent before storing or accessing information on terminal equipment, unless an exception applies. Courts and regulators interpret this broadly: analytics cookies, advertising IDs, A/B testing identifiers, and many fingerprinting techniques fall inside the rule.
Consent under ePrivacy must be informed, specific, and freely given—aligned with GDPR's high standard. Implied consent from continued browsing, pre-selected categories, or banners that only offer Accept without Reject have been rejected repeatedly by European data protection authorities.
The directive also covers marketing communications—email, SMS, and similar channels—but this guide focuses on website storage. Email rules (opt-in for B2C marketing) often live in the same national laws that implement ePrivacy, such as PECR in the UK.
ePrivacy is implemented nationally, not as a single EU regulation text on your server. Germany's TTDSG, France's guidelines from CNIL, and the UK's PECR all translate the same principles with local enforcement nuance. Your obligations follow where your users are, not only where you host.
The proposed ePrivacy Regulation would harmonize rules EU-wide, but until it fully replaces the directive, you should follow the strictest reasonable interpretation across markets you serve—prior consent for non-essential cookies, clear information, and easy withdrawal.
Why it matters
Cookie enforcement has been one of the most active areas of EU privacy regulation. Supervisory authorities publish annual sweep reports listing sites that load trackers before consent, use dark patterns, or mislabel essential cookies.
Third-party scanners—including Cookiebot, Complianz checks, and NGO tools—test ePrivacy-style requirements by loading pages in a fresh session and counting cookies and requests. Failures are visible to competitors, customers, and journalists.
Ad and analytics vendors increasingly require Consent Mode or equivalent signals. Without valid ePrivacy consent, you risk both legal exposure and degraded campaign data—not because the law is vague, but because enforcement and platform policies converged on the same standard.
Common mistakes
- Calling all cookies essential to avoid showing a banner.
- Firing Google Analytics or Meta Pixel on page load, then asking for consent afterward.
- Using cookie walls that block the entire site unless users accept marketing cookies.
- Hiding Reject in settings while promoting a large Accept button.
- Assuming server-side tracking bypasses ePrivacy—it often still uses identifiers subject to consent.
- Copying US-centric CMP text that references CCPA opt-out instead of EU opt-in.
- Not updating the cookie list when marketing adds a new tag through GTM.
Practical checklist
- Inventory cookies and storage set on first visit without interaction.
- Classify each item as strictly necessary or requiring consent.
- Block non-essential tags until the user opts in.
- Provide equally prominent Accept and Reject controls.
- Document cookie purposes, lifetimes, and third parties in your policy.
- Allow users to change or withdraw consent without friction.
- Re-test after GTM container publishes or theme updates.
- Align Consent Mode signals with actual user choices.
How GDPRChecker helps
GDPRChecker's compliance scanner simulates a first visit and reports pre-consent network requests, cookie-setting behavior, and consent UI detection—exactly the issues ePrivacy enforcement targets.
The dashboard tracker-blocking rules let you classify scripts by category and enforce blocks at runtime, so analytics and marketing tags do not execute until consent is granted. Runtime verification confirms the guard script loads before GTM and that blocking still works after deploys.
When you publish your CMP configuration, GDPRChecker records consent choices and surfaces them in compliance reports, helping you demonstrate that storage access matches what users agreed to—not what your tag manager would do by default.