In short: Article 5(3) of the ePrivacy Directive says you may only store or read information on a visitor's device (cookies, local storage, pixels, fingerprinting scripts) once they have consented, unless the operation is strictly necessary for the service they asked for. It applies to any website or app used by people in the EU, through the national law of each member state. National regulators enforce it directly, without waiting for a lead authority, and the largest cookie fines in Europe have been issued on this basis.
ePrivacy Directive: what is it?
The ePrivacy Directive, officially Directive 2002/58/EC on privacy and electronic communications, was adopted on 12 July 2002. Member states had until 31 October 2003 to bring it into national law. It was substantially amended by Directive 2009/136/EC of 25 November 2009, which rewrote the cookie rule into the opt-in requirement we know today. That is why it is often nicknamed the "cookie law".
The cookie rule sits in a single sentence, Article 5(3). Storing information on, or accessing information already stored in, the terminal equipment of a subscriber or user is only allowed if that person "has given his or her consent, having been provided with clear and comprehensive information" about the purposes. Two exceptions follow, which we cover below.
Three features make this text different from the GDPR:
- It protects the device, not just personal data. Recital 24 treats terminal equipment and the information stored on it as part of the user's private sphere. The Court of Justice confirmed in Planet49 (C-673/17, 1 October 2019) that the protection applies whether or not the information is personal data.
- It is a directive, not a regulation. It does not apply directly. Each EU country has written Article 5(3) into its own law, for example Article 82 of the French Data Protection Act, which the CNIL applies. In the UK, the equivalent rules sit in PECR, enforced by the ICO.
- It sets the trigger, the GDPR sets the standard. Since 2018, "consent" in the directive means consent as defined by the GDPR: freely given, specific, informed and unambiguous.
Territorial scope. The rule applies to devices of users in the EU, through each country's transposing law. A business outside the EU that places trackers on European visitors' browsers is in the same position as a local one.
The European Commission proposed in 2017 to replace the directive with an ePrivacy Regulation. Negotiations never concluded, and the Commission approved the withdrawal of the proposal on 16 July 2025 (announced in the Official Journal on 6 October 2025). The directive remains the reference.
Who does ePrivacy Directive apply to?
Article 5(3) is not limited to telecom operators. It applies to any entity that stores or reads information on a user's device, which in practice means:
- Website owners whose pages set cookies or run scripts that write to or read from the browser (local storage, session storage, IndexedDB).
- Mobile app publishers whose SDKs read device identifiers or store data on the phone.
- Third parties such as ad networks, analytics providers and social media platforms whose tags run on your pages. The EDPB notes that storage and access do not need to be performed by the same party.
- Email senders who use tracking pixels to detect when a message is opened.
- Makers of connected devices (smart TVs, connected cars, IoT sensors) that send stored data back to a server.
Company size does not matter, and neither does whether you are the advertiser, the publisher or the vendor: whoever instructs the device to store or send back information is concerned.
What ePrivacy Directive requires for cookies and consent
Legal basis: consent, nothing else
For anything that is not exempt, the only legal basis is consent. The EDPB cookie banner taskforce confirmed in January 2023 that legitimate interest cannot justify placing or reading cookies under Article 5(3). Where no valid consent is obtained, any later processing of the resulting data cannot be GDPR compliant either.
What counts as "storing" or "accessing": the technical scope
This is where the directive reaches much further than most people think. The EDPB Guidelines 2/2023 (final version adopted on 7 October 2024) set three criteria: the operation concerns information (personal or not), it involves a user's terminal equipment, and it amounts to storage or gaining access. Applied to common techniques:
- Tracking pixels and tracking links. Delivering a pixel or a tagged URL to the device counts as storage, at least through the browser cache, and collecting the identifier sent back counts as gaining access.
- Local storage and similar browser APIs. Writing to or reading from them is covered exactly like cookies.
- Local processing. When code running on the device computes something (a profile, a score) and sends the result to a server, that is gaining access, even though the information was produced locally.
- Fingerprinting. Reading device characteristics to build an identifier was already covered by the Article 29 Working Party in 2014, and the EDPB builds on that.
- IP-based tracking. Collecting an IP address to track browsing can fall within Article 5(3) when the address originates from the user's device, which is the case for IPv6 and for static IPv4 from a home router.
- Unique identifiers. Hashing an email address on the device and sending it to partners is gaining access, even though the user typed the information in.
The practical message: moving from cookies to "cookieless" tracking does not by itself remove the need for consent. What matters is whether the method stores or reads information on the device.
Exemptions
Article 5(3) allows two kinds of storage or access without consent:
- operations for the sole purpose of carrying out the transmission of a communication over a network;
- operations strictly necessary to provide an information society service explicitly requested by the user.
Recital 66 of Directive 2009/136/EC adds that these exceptions should be limited to what is strictly necessary for the legitimate purpose of enabling a specific service. Typical exempt uses are session and cart cookies, authentication, load balancing, security, and storing the user's consent choice. The EDPB taskforce warned that marketing or analytics cookies are sometimes mislabelled as "essential", and that site owners must be able to justify each classification. Some national authorities accept limited first-party audience measurement without consent under strict conditions: check the guidance of the regulator in each country you target.
Prior consent, information, withdrawal and proof
- Before, not after. No non-exempt cookie may be set and no tracking script may read the device until consent is given.
- Clear and comprehensive information about the purposes must come before the choice.
- Withdrawal must be possible at any time and as easy as giving consent, because the directive uses the GDPR's consent conditions.
- Proof. As consent under the directive follows the GDPR's conditions, you should keep a record showing that consent was given before any tracker fired.
The directive sets no duration for cookies or for consent. That is left to national laws and regulator guidance.
An ePrivacy Directive-compliant cookie banner
The directive does not describe a banner, but the regulators who enforce it agree on the essentials:
- explain what the trackers do and who places them before asking;
- offer Accept and Reject at the same level: a vast majority of authorities in the EDPB taskforce considered that a banner with no refuse option on a layer containing an accept button does not produce valid consent;
- keep all boxes unticked by default (the Court of Justice ruled in Planet49 that a pre-ticked checkbox is not valid consent);
- do not make access to the content conditional on accepting (cookie walls are under close scrutiny);
- make the refusal effective: once someone clicks Reject, no non-exempt tracker should be written or read, including after pop-ups and later page views;
- provide a permanent way to change the choice, such as a floating icon or footer link.
Design tricks matter as much as the buttons: a reject link hidden in a paragraph or a button with unreadable contrast can invalidate consent. See what the CNIL prohibits in consent banners and our GDPR-compliant cookie banner guide for practical layouts.
Penalties and enforcement
Article 15a of the directive leaves penalties to member states, which must make them "effective, proportionate and dissuasive". There is therefore no single EU cap: the amount depends on the national law, and in France the CNIL fines on the basis of Article 82 of the Data Protection Act. Because the GDPR one-stop-shop does not apply to ePrivacy matters (as the EDPB taskforce recalled), each national authority can act against a foreign company for trackers placed on devices in its country. Real cases:
- Google, €325 million (CNIL, 1 September 2025). The CNIL fined Google LLC €200 million and Google Ireland Limited €125 million. On cookies, it found that during Google account creation, users were steered towards personalised advertising cookies and not clearly told that access to the service could depend on accepting them, so consent was neither free nor informed. The CNIL also ordered compliance within six months, under a penalty of €100,000 per day of delay for each company.
- SHEIN, €150 million (CNIL, deliberation SAN-2025-005 of 1 September 2025). On shein.com, the CNIL found advertising cookies placed as soon as a visitor arrived on the home page, before any interaction with the banner. It also found that after a user clicked "Refuse All", new advertising cookies were still written and existing ones still read. The fine was imposed for breaching Article 82 of the French Data Protection Act.
- Planet49 (Court of Justice of the EU, 1 October 2019). Not a fine, but the ruling that set the rules every regulator now applies: a pre-ticked checkbox is not valid consent, consent to cookies must be specific, users must be told how long cookies last and whether third parties can access them, and all of this applies whether or not the data is personal.
Compliance checklist
- Inventory every technique that touches the device: cookies, local storage, pixels, tagged links, fingerprinting and SDKs, not just what appears in the cookie list.
- Classify each one as exempt (transmission or strictly necessary) or consent-based, and document the reasoning.
- Block every non-exempt script until consent, including email tracking pixels where they apply.
- Do not treat cookieless or server-side tracking as automatically exempt: check whether it reads information from the device.
- Show Accept and Reject side by side, with no pre-ticked boxes.
- Test that Reject really works: no new trackers written and no old ones read after a refusal.
- Explain purposes and third parties clearly before the choice.
- Offer a permanent way to withdraw and keep a record of each choice.
- Check the national rules of each country where your audience lives, as transposition and guidance differ.
How FlowConsent helps you comply with ePrivacy Directive
FlowConsent applies the Article 5(3) rule where it matters: in the browser. Its automatic scan finds the cookies and trackers your pages set, and scripts are blocked before consent, so nothing non-exempt runs until the visitor accepts. You decide which services are strictly necessary and which require consent, as explained in our documentation on services and legal basis. The banner shows Accept and Reject side by side, Google Consent Mode v2 is built in, every choice is saved as exportable proof of consent, and data is hosted in Europe. Setup takes about ten minutes. Run our free scanner to see what your site stores today, then create your free account: free up to 25,000 sessions per month, Pro at €14.99 per month up to 100,000 sessions.
Further reading
These articles explore the practical side of the ePrivacy rule. Read what the ePrivacy Regulation would have changed for the legislative background, and the CNIL sanctions overview for more enforcement cases. The others cover cookie walls, cookieless analytics, server-side tagging and how to audit the trackers on your site.