Which Cookies Need Consent Under the GDPR and the ePrivacy Directive

How the GDPR and the ePrivacy Directive Decide Which Cookies Need Consent

Article 5(3) of the ePrivacy Directive requires consent before a site stores a cookie on the device of a visitor or reads a cookie from the device. The General Data Protection Regulation (GDPR) defines what valid consent is. Each EU country writes Article 5(3) into its own law, and the authority of each country enforces the rule. The ePrivacy Directive decides whether a cookie needs consent, and the GDPR decides whether the consent counts.

Article 5(3) covers more than cookies. The European Data Protection Board (EDPB) applies the rule to local storage, tracking pixels, link tracking, and other techniques that store or read information on the device. The EDPB sets out that scope in its Guidelines 2/2023 on the technical scope of Article 5(3), adopted in October 2024.

Which Cookies Need No Consent Under the ePrivacy Directive

Article 5(3) exempts 2 kinds of cookies from consent: cookies used only to carry a communication over a network, and cookies strictly necessary for a service the visitor explicitly requests. A shopping cart cookie, a login session cookie, a load balancing cookie, and a bot protection cookie such as __cf_bm fit the second kind.

Analytics, advertising, and social media cookies need consent, since the visitor asks for none of those purposes. A few national authorities exempt audience measurement under strict conditions, such as the CNIL in France for tools set up to its rules. Check the rules of each country where your visitors live.

What Valid Consent Looks Like Under the GDPR

Article 4(11) of the GDPR defines consent as a freely given, specific, informed, and unambiguous indication of the wishes of the visitor. The visitor gives that indication by a statement or by a clear affirmative action. Article 7 of the GDPR asks the site to prove the consent, and to let the visitor withdraw consent as easily as the visitor gave it.

The Court of Justice of the European Union ruled in Planet49 (case C-673/17, 1 October 2019) that a pre-ticked checkbox gives no valid consent. The same judgment applies the consent rule to every cookie, whether or not the cookie holds personal data.

The EDPB Guidelines 05/2020 on consent, adopted in 2020, treat scrolling or further browsing as no consent, and a cookie wall as no freely given consent. Most EU authorities treat a consent banner without a reject option on its first layer as a breach, according to the EDPB cookie banner taskforce report of January 2023. Give your consent banner an "I decline" button next to "I agree", with the same size and the same weight.

Cookie Categories Under the GDPR and the ePrivacy Directive

The table gives the rule of the GDPR and the ePrivacy Directive for each cookie category of the Cookie Consent cookie database. The page of each cookie adds the conditions that change the answer for a single tool.

The table describes what the GDPR and the ePrivacy Directive requires and is not legal advice. Whether the GDPR and the ePrivacy Directive applies to your site depends on where your visitors are, where your business is based, and how you set up each tool.

Cookies in the Database and Their Rule Under the GDPR and the ePrivacy Directive

The database gives the rule of the GDPR and the ePrivacy Directive for 19 cookies. Open a cookie to read the reason and the setup that changes the answer.