Home › Law library › ePrivacy cookie rule
ePrivacy cookie rule
Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive), Article 5(3)
Confirmed by two sources. Last verified 10 October 2026
Next full re-check due: . Regulator news is checked monthly; changes are logged in the change log.
Cite this page: GlanceDesk Jurisdiction, “ePrivacy cookie rule (European Union (EEA))”, glancedeskjurisdiction.com/laws/eu-eprivacy-cookies, last verified 10 October 2026.
European Union (EEA) Privacy
- Status
- In force since 2002; cookie consent rule as amended by Directive 2009/136/EC (transposed from 2011).✓
- Who it applies to
- Anyone storing or reading information on users' devices in the EU (cookies, pixels, SDKs, fingerprinting, local storage), whether or not the data is personal.✓
- Size thresholds
- None — applies regardless of size.✓
- Regulator
- National authorities designated in each Member State (often the DPA, sometimes telecoms/consumer regulators)✓
- Cookies and consent
- Prior consent, after clear and comprehensive information, is required to store or access information on a device. Exempt only: purely technical transmission, or what is strictly necessary for a service the user explicitly requested.✓
- Maximum penalty
- Set nationally; must be effective, proportionate and dissuasive (varies by country).✓
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do✓
- Block non-essential cookies and trackers until the user gives consent.
- Explain what each cookie or tracker is for before asking for consent.
- Make refusing as easy as accepting and let users withdraw at any time.
- Treat tracking pixels, URL tracking and device identifiers as covered, not just cookies.
- Audit tags and SDKs regularly; keep proof of consent.
Recent changes
EDPB Guidelines 2/2023 (final version adopted 7 Oct 2024) confirm Art 5(3) covers pixels, URL tracking, IP-based tracking and IoT. Digital Omnibus (Nov 2025, still pending Oct 2026) proposes consent exemptions (e.g. audience measurement, security) and browser-level consent signals.✓
Termly
Set up a cookie consent banner and cookie policy for EU, UK and US visitors.
Set up your cookie banner with TermlyPartner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure
Sources
- Primary source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02002L0058-20091219
- Second source: https://www.hunton.com/privacy-and-cybersecurity-law-blog/edpb-adopts-guidelines-on-scope-of-eprivacy-directive
- Regulator: National authorities designated in each Member State (often the DPA, sometimes telecoms/consumer regulators)
Sources used for the independent check (12)
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02002L0058-20091219
- https://www.dlapiperdataprotection.com/index.html?t=law&c=IE
- https://edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/edpb-adopts-guidelines-on-scope-of-eprivacy-directive
- https://iapp.org/news/a/cnils-eprivacy-fines-reveal-potential-enforcement-trend
- https://edpb.europa.eu/about-edpb/our-members_en
- https://edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf
- https://www.insideprivacy.com/eu-data-protection/edpb-publishes-report-of-cookie-banners-taskforce/
- https://www.legislation.gov.uk/eur/2016/679/article/7/adopted
- https://www.lw.com/en/insights/Digital-Omnibus-EU-Commission-Proposes-to-Streamline-GDPR-and-EU-AI-Act
- https://www.heuking.de/en/news-events/newsletter-articles/detail/gdpr-ai-and-cookies-what-the-eus-data-omnibus-could-change-for-companies.html
- https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360(COD)
= confirmed by two independent sources, at least one official. How we verify
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@