Cookie consent (ePrivacy Directive)
The EU rule that a site needs consent before storing or reading anything on a user’s device, except what is strictly necessary for the requested service.
Article 5(3) of the ePrivacy Directive covers cookies, local storage, pixels and fingerprinting, not only cookies. Consent has to meet the GDPR standard: no pre-ticked boxes, and regulators expect rejecting to be as easy as accepting. Analytics and ad tags usually need consent; login sessions and a shopping cart do not. The Digital Omnibus would reform these rules: in October 2026 the Council agreed a position with one-click refusal and a pause before asking again, but Parliament has not voted, so the current rules still apply.
Related terms
- GDPR: The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.
- Global Privacy Control (GPC): A browser signal that tells every site the person does not want their data sold or shared; California and other states treat it as a legal opt-out.
- First-party analytics proxy: Sending analytics through a path on your own domain, so ad blockers that block known analytics hosts do not drop the data.
- Session replay: A reconstruction of what a user saw and did on a site: clicks, scrolls, page changes and errors, played back like a video.
- GDPR lawful basis (consent vs legitimate interest): Every use of personal data under GDPR needs one of six legal bases; consent is only one of them, and often not the best one.
