GDPR5 min read
ePrivacy Directive vs. GDPR: how cookie rules really work
The ePrivacy Directive decides when cookies need consent; the GDPR defines what valid consent means. Here is how the two EU laws fit together in practice.
The ePrivacy Directive and the GDPR split the cookie question in two. The ePrivacy Directive decides whether you need consent to store or read information on someone’s device. The GDPR defines what valid consent looks like and governs any personal data you process afterward. For most analytics and advertising cookies, you need to satisfy both laws at once.
What does the ePrivacy Directive say about cookies?
Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC) allows storing information on a user’s device, or accessing information already stored there, only if the user has consented after receiving clear and comprehensive information. There are two narrow exemptions.
The first covers storage or access used solely to carry out the transmission of a communication over a network. The second covers storage or access that is strictly necessary to provide a service the user explicitly requested, such as a login session or a shopping cart. Everything else, including analytics, advertising and most social media features, needs consent.
The rule is deliberately technology-neutral. “Device” means any terminal equipment, from laptops and phones to smart TVs. “Information” covers cookies, local storage, IndexedDB, device identifiers and techniques that read device characteristics. Since a 2009 amendment, the default has been consent; before that, informing users and letting them refuse was enough.
Most importantly, Article 5(3) applies whether or not the information is personal data. A cookie holding a random value with no link to any person is still in scope.
What does the GDPR add to the cookie rules?
The GDPR contributes two things: the definition of consent that cookie banners must meet, and the rules for any personal data you process once a cookie has been set or read.
The ePrivacy Directive does not define consent itself. It borrows the definition from EU data protection law, which today means the General Data Protection Regulation (GDPR). Article 4(11) requires consent to be freely given, specific, informed and unambiguous, and Article 7 adds conditions such as easy withdrawal and the ability to demonstrate consent. In Planet49 (C-673/17, 2019), the Court of Justice of the EU (CJEU) applied this standard to cookies and held that a pre-ticked checkbox is not valid consent.
After the device access step, the GDPR takes over. If your analytics vendor receives page views tied to a cookie ID, that is processing of personal data. You need a legal basis under Article 6, a transparent privacy notice, contracts with processors, safeguards for international transfers and a process for access and deletion requests.
For tracking and profiling that starts with a consent-based cookie, regulators generally expect consent to be the legal basis for what follows too. That is why legitimate interest rarely works for cookies.
How do the ePrivacy Directive and the GDPR compare?
The differences are easiest to see side by side.
| Aspect | ePrivacy Directive (Art. 5(3)) | GDPR |
|---|---|---|
| Legal form | Directive, implemented through national laws | Regulation, directly applicable in every EU country |
| What it regulates | Storing or accessing information on a user’s device | Processing of personal data |
| Personal data required? | No | Yes |
| Permitted grounds | Consent, or one of two narrow exemptions | Six legal bases in Article 6, including consent and legitimate interest |
| Who enforces | Authority designated by each country, often but not always the data protection authority | National data protection authorities, with a cross-border cooperation mechanism |
| Penalties | Set by national law | Up to €20 million or 4% of worldwide annual turnover for the most serious infringements (Art. 83(5)) |
Which law applies to a given cookie?
Often both, one after the other. Think of it as a two-step test: the ePrivacy Directive governs the moment of storing or reading, and the GDPR governs the personal data processing that follows.
Common cases look like this:
- Analytics cookie. Setting the client ID cookie needs ePrivacy consent. Sending page views linked to that ID to an analytics provider is personal data processing under the GDPR.
- Login session cookie. The cookie is exempt from consent because it is strictly necessary for a service the user requested. The account data behind it is still personal data, so the GDPR applies, usually on a basis such as performance of a contract.
- Advertising pixel. Reading or writing identifiers needs ePrivacy consent, and the profiling that follows needs a GDPR legal basis, which in practice means consent.
- Server-side processing without device access. If nothing is stored on or read from the device, Article 5(3) may not be triggered, but the GDPR still applies to personal data such as IP addresses. Regulators read “access” broadly, so check their guidance before relying on this.
The order matters. A valid GDPR legal basis for step two cannot fix missing ePrivacy consent at step one.
Why does the directive-versus-regulation difference matter?
Because each country implements the ePrivacy Directive in its own law, the same banner can be judged by different regulators applying slightly different rules. That affects who can act against you and how.
National laws differ on details such as which authority enforces the cookie rules, how regulators view analytics exemptions and how long a refusal should be remembered.
The GDPR’s one-stop-shop mechanism, which normally routes cross-border cases to a single lead authority, does not extend to national ePrivacy rules. That is how France’s data protection authority, the CNIL, could act directly against Google and Facebook in December 2021, fining them €150 million and €60 million because refusing cookies was harder than accepting them. Our breakdown of cookie enforcement lessons covers what those decisions mean for ordinary sites.
The practical takeaway: design for the strictest standard among your markets. The United Kingdom follows a parallel model, the UK GDPR plus the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner’s Office (ICO). Our guide to UK GDPR and PECR explains where the UK differs.
Is the ePrivacy Directive going to be replaced?
Possibly at some point, but plan around the law as it stands. A proposed ePrivacy Regulation intended to replace the directive was negotiated for years without agreement, and the European Commission announced in 2025 that it would withdraw the proposal.
Newer EU initiatives to simplify digital rules have since put cookie consent back on the agenda. None of this alters your obligations until it is adopted and in force, so keep following Article 5(3) as implemented in each country and check current guidance from your regulator before acting on any announced reform.
Bottom line
The ePrivacy Directive answers “do I need consent to touch the device?” and the GDPR answers “what does consent mean, and what are my duties for the data?” Treat them as two gates that both need to be passed, and never let a GDPR legal basis talk you out of ePrivacy consent. Tools like Cookiesh can show different banners by region, but working out which law applies to each tracker is still worth doing yourself.
This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.
Frequently asked questions
Is the ePrivacy Directive the same thing as the EU cookie law?
Largely, yes. 'Cookie law' is the informal name for Article 5(3) of the ePrivacy Directive and the national laws that implement it. The directive also covers other topics, such as the confidentiality of communications and unsolicited electronic marketing.
Has the ePrivacy Directive been replaced by an ePrivacy Regulation?
Not as of this writing. A proposed ePrivacy Regulation stalled for years and the European Commission announced its withdrawal in 2025. EU cookie rules remain under discussion, so check current guidance from your regulator.
Does the GDPR one-stop-shop apply to cookie enforcement?
Not to the ePrivacy part. The GDPR mechanism that routes cross-border cases to a lead authority does not cover national ePrivacy rules, so a national regulator can act directly against a foreign company's cookie practices affecting people in its country.
Does the UK follow the same model?
Broadly, yes. The UK applies the UK GDPR alongside the Privacy and Electronic Communications Regulations (PECR), both enforced by the ICO. UK rules have started to diverge from the EU's, so check the ICO's current guidance.
Sources
Cookiesh Editorial Team
Privacy engineers and compliance specialists writing practical guidance on consent, cookies and data protection for product teams.
