EU Cookie Law Guide: Consent Rules and Compliance in 2026

The EU cookie law is one of the most misunderstood pieces of digital regulation in Europe, and one of the most actively enforced. If your website uses analytics, advertising pixels, or embedded video, and anyone in the European Union can visit it, you need valid consent before those EU cookies are set. This guide covers exactly which cookies need consent, what a compliant banner looks like, and what regulators are actually fining companies for. It is educational rather than legal advice, so consult a qualified attorney for guidance specific to your business.

What the EU Cookie Law Actually Is

There is no single statute called the "EU cookie law." The term refers to Article 5(3) of the ePrivacy Directive (2002/58/EC), as amended in 2009, combined with the consent standard set by the General Data Protection Regulation (GDPR).

Article 5(3) states that storing information, or gaining access to information already stored, on a user's terminal equipment is only allowed if the user has given consent after receiving clear and comprehensive information. The rule is technology-neutral. It covers cookies, but also local storage, session storage, pixels, device fingerprinting, and SDK identifiers.

The GDPR supplies the definition of consent. Article 4(11) requires consent to be a freely given, specific, informed, and unambiguous indication of the user's wishes, given by a statement or clear affirmative action. Article 7 adds that you must be able to demonstrate consent was given and that withdrawing it must be as easy as giving it.

Two consequences follow from this structure:

• The ePrivacy Directive is a directive, not a regulation. Each EU member state transposes it into national law, so enforcement details and penalty ceilings differ between France, Germany, Ireland, and Spain.
• Consent under the EU cookie rules is not limited to personal data. Article 5(3) triggers on the act of storing or reading information on a device, even if the identifier is not obviously personal.

Which EU Cookies Require Consent

The dividing line is the "strictly necessary" exemption in Article 5(3). A cookie is exempt only when it is strictly necessary to deliver a service the subscriber or user has explicitly requested. Everything else needs prior opt-in consent.

The Article 29 Working Party Opinion 04/2012 remains the reference document for this analysis. Based on it, these categories are exempt:

• Session cookies that maintain a logged-in state during a browsing session.
• Shopping cart cookies on e-commerce sites.
• Load balancing cookies that route a request to a particular server.
• Security cookies that detect repeated failed login attempts.
• User interface customization the visitor actively chose, such as a language selector.
• Consent state cookies that record the visitor's own cookie choices.

These categories always require consent:

• Analytics cookies, including Google Analytics 4, Matomo in its default configuration, Hotjar, and Mixpanel.
• Advertising and retargeting cookies, such as the Meta Pixel, Google Ads conversion tags, and TikTok Pixel.
• Social media embeds from YouTube, Instagram, X, and LinkedIn that set cookies on page load.
• A/B testing and personalization tools that identify returning visitors.
• Chat widgets and heatmaps that track behavior beyond the immediate support session.

A frequent mistake is treating first-party analytics as exempt. Regulators have rejected this repeatedly. In 2022 the Austrian DSB and the French CNIL both found standard Google Analytics implementations unlawful, and the CNIL's own guidance grants an analytics exemption only for narrowly configured, first-party audience measurement with no cross-site tracking and no data sharing.

The Third-Party Vendor Problem

Most sites underestimate how many EU cookies they set. A typical WordPress site with a theme, a contact form, a video embed, and a marketing tag can easily place 25 to 40 cookies from a dozen domains.

You are responsible for disclosing every one of them. Article 13(1)(e) of the GDPR requires you to name the recipients or categories of recipients of personal data, and cookie declarations that list "third-party cookies" without naming the vendors have been cited in enforcement decisions as inadequate.

What Valid EU Cookie Consent Looks Like

Regulators have converged on a fairly detailed picture of a compliant banner. The European Data Protection Board Guidelines 05/2020 on consent, plus the EDPB Cookie Banner Taskforce report published in January 2023, set out the operative rules.

A compliant EU cookie banner must:

1. Block non-essential cookies before consent. Setting analytics or ad cookies on page load and asking afterward is the single most common violation.
2. Offer rejection as prominently as acceptance. A visible "Accept all" next to a hidden or greyed-out reject option fails. The reject control must be on the first layer, in the same visual style.
3. Avoid pre-ticked boxes. The Court of Justice of the European Union settled this in Planet49 (C-673/18, October 2019). Pre-checked consent is not consent.
4. Name the purposes specifically. "Improve your experience" is not a purpose. "Measure page traffic and audience behavior" is.
5. Identify the third parties. Either list them on the first layer or make them reachable in one click from it.
6. Allow withdrawal at any time. A persistent link or floating icon that reopens the preference panel satisfies Article 7(3).
7. Log proof of consent. Store the timestamp, the version of the banner text, the purposes accepted, and the consent identifier, per Article 7(1).

Design patterns that regulators treat as invalid include colored accept buttons paired with plain-text reject links, closing the banner with an X interpreted as acceptance, continued-browsing consent, and misleading contrast that steers the eye toward acceptance. The EDPB taskforce report named all four as deceptive design.

Penalties and Enforcement for EU Cookies Violations

Because the ePrivacy Directive is implemented nationally, the penalty depends on which authority acts and under which legal basis.

Authority	Legal basis used	Maximum exposure
CNIL (France)	French Data Protection Act, ePrivacy transposition	2% of global turnover, or 4% for repeat violations
ICO (UK)	PECR 2003	500,000 GBP under PECR, plus UK GDPR fines
Garante (Italy)	GDPR plus national code	GDPR ceilings under Article 83
DPC (Ireland)	ePrivacy Regulations 2011	5,000 EUR per offence, plus GDPR exposure

Where the authority uses the GDPR as its basis, Article 83(5) allows fines up to 20 million EUR or 4% of global annual turnover, whichever is higher.

Real enforcement has been substantial. The CNIL fined Google 150 million EUR and Meta 60 million EUR in December 2021, specifically because rejecting cookies took more clicks than accepting them. In January 2022 the CNIL fined Google an additional 100 million EUR and Amazon 35 million EUR for placing advertising cookies without prior consent. Smaller enforcement is broader than the headlines suggest: the CNIL has issued dozens of formal notices to mid-sized sites, and noyb has filed complaints against thousands of websites over banner design.

Cookie Policy Requirements Under EU Law

The banner handles consent. The cookie policy handles the "clear and comprehensive information" half of Article 5(3), together with the transparency obligations in GDPR Articles 13 and 14.

Your cookie policy needs to include:

• A plain-language explanation of what cookies are and how your site uses them.
• A complete cookie table listing each cookie by name, its provider, its purpose, its type (first-party or third-party), and its retention period.
• The legal basis for each category, which will be consent for everything outside the strictly necessary set.
• Named third parties and links to their own privacy policies.
• Whether any cookie data transfers outside the European Economic Area, and the transfer mechanism used, such as Standard Contractual Clauses under Article 46.
• Clear instructions for withdrawing consent and for managing cookies in the browser.
• A last-updated date.

The cookie table is where most policies fail. Copying a generic template produces a document that does not match the cookies your site actually sets, which is itself a transparency failure. A cookie policy generator that builds the table from a real scan of your site avoids the mismatch. TermsBox scans your pages, identifies the cookies and trackers present, and generates the declaration from those findings rather than from a template guess.

Keeping the Policy Accurate Over Time

Cookie declarations drift. Marketing adds a pixel, a plugin updates and introduces a new vendor, or an embedded widget changes providers. The declaration you published in January no longer describes the site in July.

Regulators expect accuracy at the time of collection, not at the time of drafting. Practical controls:

• Rescan the site at least monthly, and after any deployment that touches tags or third-party scripts.
• Require marketing to route new tags through a tag manager with an approval step.
• Version the policy and keep a change log so you can show what a given consent record referred to.

How the EU Cookie Rules Differ From CCPA

If you serve both European and Californian visitors, you are working with two different default positions, and you cannot satisfy one by implementing the other.

Aspect	EU cookie rules	CCPA/CPRA
Default state	Opt-in. No non-essential cookies until consent	Opt-out. Collection allowed until the consumer objects
Trigger	Storing or reading anything on a device	Sale or sharing of personal information
Required control	Granular consent banner with equal reject option	"Do Not Sell or Share My Personal Information" link
Who is covered	Any site reaching EU users	Businesses over 25 million USD revenue, 100,000+ consumers, or 50%+ revenue from selling or sharing personal information
Signal handling	Consent record and, where used, TCF signals	Global Privacy Control must be honored

The workable pattern is geo-targeted consent: show a full opt-in banner to EU and UK visitors, show an opt-out notice to California visitors, and record which regime applied to each consent event. Serving the strict EU banner worldwide is also valid and simpler to operate, at the cost of some analytics coverage in markets that do not require it. For a fuller side-by-side of the underlying regimes, see the GDPR vs CCPA comparison.

Practical Steps to Comply With EU Cookie Requirements

Work through these in order. Each step depends on the one before it.

1. Scan your site. Load every template type, including the home page, a product page, a blog post, and checkout, and record every cookie and storage item set. Browser DevTools works for a spot check, and an automated scanner catches what manual checks miss.
2. Classify each cookie. Assign every item to strictly necessary, functional, analytics, or advertising. When a classification is genuinely arguable, treat it as requiring consent.
3. Implement prior blocking. Configure your consent management platform so non-essential scripts do not execute until the matching consent category is granted. Test with a fresh browser profile and confirm no analytics or ad cookies appear before you click anything.
4. Build the banner correctly. Equal-weight accept and reject controls on the first layer, granular purpose toggles behind one click, and no pre-ticked boxes.
5. Publish the cookie policy. Generate the declaration from the scan results, link it from the banner and the footer, and keep it current.
6. Store consent records. Timestamp, purposes, banner version, and consent identifier, retained for as long as you rely on that consent plus your limitation period.
7. Add a withdrawal path. A persistent control that reopens preferences, reachable from every page.
8. Retest quarterly. Verify the banner still blocks correctly after site changes, and confirm the declaration matches the live cookie set.

Automated scanning turns steps 1, 2, and 8 from a manual audit into a scheduled job. TermsBox runs monthly scans on the $12 per month Starter tier and weekly scans on the $25 per month Pro tier, with the cookie policy updating as the scanner detects changes, and includes geo-targeted consent for teams that need different banners for EU and US visitors.

Common EU Cookie Compliance Mistakes

These are the failures that show up most often in enforcement decisions and audits.

• Firing tags before consent. Google Tag Manager containers that load on page ready, with consent logic applied only to some tags, leak cookies before the user acts.
• Treating the banner as the whole obligation. A banner without an accurate cookie declaration behind it satisfies neither Article 5(3) nor GDPR Article 13.
• Assuming legitimate interest covers analytics. Article 5(3) of the ePrivacy Directive requires consent for the storage itself. Legitimate interest under GDPR Article 6(1)(f) does not substitute for it.
• Ignoring local storage and pixels. Article 5(3) is not limited to cookies. Storing an identifier in localStorage triggers the same requirement.
• Making withdrawal harder than consent. One click to accept and a support email to withdraw breaches Article 7(3) directly.
• Copying a competitor's cookie table. Their vendor list is not yours, and an inaccurate declaration is a transparency violation regardless of where it came from.
• Forgetting the UK. After Brexit, the UK operates PECR alongside the UK GDPR. The substance is close to the EU position, and the ICO enforces separately.

What Changes With the ePrivacy Regulation

The ePrivacy Regulation was proposed in 2017 to replace the 2002 Directive and align it with the GDPR. It remains unadopted as of 2026, having stalled repeatedly in trilogue negotiations between the Council, Parliament, and Commission.

Plan for the current rules, not the proposal. If the Regulation is eventually adopted, expect a transition period of at least 24 months, and expect the core consent requirement to survive largely unchanged. The main proposed shifts under discussion have been broader browser-level consent signals and a slightly wider exemption for audience measurement.

In the meantime, the direction of travel in the EU is toward consolidation rather than relaxation. The EDPB's cookie banner taskforce has pushed national authorities toward a common interpretation, and Germany's TTDSG (now TDDDG) already codifies the consent requirement in national law with its own enforcement regime. Building to the strict interpretation now is the lower-risk position.

Frequently Asked Questions

Which cookies require consent under EU law?

Every cookie that is not strictly necessary for a service the user explicitly requested requires prior consent under Article 5(3) of the ePrivacy Directive. That includes analytics, advertising, social media, personalization, and A/B testing cookies. Session cookies for logins, shopping carts, and security load balancing are exempt.

Does the EU cookie law apply to non-EU websites?

Yes. The ePrivacy Directive combined with Article 3 of the GDPR applies to any website that stores or reads information on the devices of people located in the EU, regardless of where the company is based. A US-based store selling to customers in Germany must meet the same consent standard as a German store.

Are cookie walls legal in the EU?

Pure cookie walls that block all access unless the visitor accepts tracking are generally not compliant, because consent must be freely given under Article 4(11) of the GDPR. The European Data Protection Board addressed this in Guidelines 05/2020. Some regulators, including CNIL and the Austrian DSB, permit paid alternatives to consent under strict conditions.

How long can EU cookie consent last before I ask again?

EU law sets no fixed expiry, but CNIL recommends renewing consent every six months and most regulators treat 12 months as the practical outer limit. You must also re-ask whenever you add a new purpose or new third-party vendor, since the original consent did not cover it.

What is the difference between the ePrivacy Directive and the GDPR for cookies?

The ePrivacy Directive Article 5(3) decides when you need consent to store or read anything on a device, including cookies and similar identifiers. The GDPR defines what valid consent means under Article 4(11) and Article 7, and governs the personal data you process afterward. Both apply together.

Do I need a separate cookie policy or is a privacy policy enough?

A separate cookie policy is standard practice and easier to keep accurate, though the law only requires that the information reaches the user in a clear and complete form. Whichever format you choose, you must list each cookie, its purpose, its duration, and the third party that sets it, as required by GDPR Articles 13 and 14.