- Article 5(3) of Directive 2002/58/EC asks for the user’s consent before information is stored on their device or read from it.
- Two narrow exceptions sit in the same article: the transmission of a communication, and what is strictly necessary for a service the user explicitly asked for.
- Consent carries the meaning the GDPR gives it: freely given, specific, informed, unambiguous, and as easy to withdraw as to give.
A cookie banner is often the first thing a new visitor sees of your product. It is also one of the few screens where EU law shapes what your interface has to do. The rule is short. Most of the confusion around it comes from reading summaries of summaries instead of the text.
This guide is not legal advice, and it says nothing about whether your product meets the law. That judgement stays with you and your advisers. What it does is set out what the two texts say, in plain terms, with a link to each article so you can read the original.
The rule in one sentence
Before your product stores anything on a user’s device, or reads anything already stored there, the user has to agree, and they have to be told clearly what it is for.
The source is Directive 2002/58/EC of 12 July 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector. Its own short name is the Directive on privacy and electronic communications. The wording of Article 5(3) that applies today was put in place by Directive 2009/136/EC of 25 November 2009, which amended it.
In that wording, storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user is allowed only on condition that the person concerned has given consent, having been provided with clear and comprehensive information, among other things about the purposes of the processing.
It reaches you through national law
A directive is addressed to the member states, not to companies. Article 5(3) opens with the words “Member States shall ensure”, and each country writes the rule into its own law. So the text you answer to in a given market is that country’s national law, read alongside the Directive. Where you need the exact national wording, ask your advisers for the act itself, not a summary of it.
What the article covers
The article never uses the word “cookie”. It speaks of information stored on, or read from, the user’s device. It describes storing and reading, not a particular technology.
It also speaks of information, not of personal data.
What “strictly necessary” covers
The same paragraph names two cases that need no consent. In the article’s own words, it does not prevent technical storage or access:
- for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or
- as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
Two phrases carry the weight in the second case. “Strictly necessary” is narrower than useful, convenient or good for the business. “Explicitly requested” points at the service the user asked for, not at everything around it. Anything outside both cases waits for a yes.
What valid consent means
The ePrivacy text defines consent by reference to the old data protection directive, Directive 95/46/EC. Article 94(2) of the GDPR says references to that repealed directive are to be read as references to the GDPR. So the GDPR’s definition is the one that counts.
Article 4(11) of the GDPR defines consent as any freely given, specific, informed and unambiguous indication of the person’s wishes, by which they signify agreement by a statement or by a clear affirmative action.
Article 7 adds conditions. The controller must be able to show that the person consented. Where consent is asked for in a declaration that covers other matters too, the request must be clearly distinguishable from them, in clear and plain language. The person can withdraw consent at any time, is told so before giving it, and withdrawing must be as easy as giving.
Two recitals of the same Regulation say it more plainly still. Recital 32 says silence, pre-ticked boxes or inactivity should not constitute consent. Recital 42 says consent should not be regarded as freely given if the person has no genuine or free choice, or cannot refuse or withdraw it without detriment.
Put next to an interface, those conditions read as a short list: nothing ticked in advance, a refusal that is a real option, a clear purpose for each request, and a way back out that is no harder than the way in.
Questions to ask your team
You don’t need to read every line of your product’s code to steer this. A few questions, asked once, show where the product stands:
- What is stored on, or read from, a user’s device when a page first loads, before anyone has touched the banner?
- Which of those items would the product fail without, for the service the user actually asked for? Who decided that, and is it written down?
- Is saying no one step, like saying yes, on the same screen and with the same weight?
- Does each request say what it is for, in words a user would understand?
- Where does a user go to change their mind later, and does that change take effect?
- Can we show what a given user agreed to, if we are asked?
The answers belong to your team and your advisers. The questions are yours to ask, and they let you lift your eyes from the banner’s wording to what the product actually does.
For the wider design question, how much personal data a feature collects, keeps and shows in the first place, see Data protection by design, for product leaders.
Where we come in
We don’t give legal advice, and nothing on this page is a promise that any product meets the law. That remains a judgement for you and your advisers.
If your team’s answers turn up gaps, closing them before a customer or an auditor asks is the kind of work described in Harden security before the questionnaire arrives. The work lands in your own code repository. The code we build for you is yours. You decide what ships. Nothing reaches your users without your approval.
It starts with a conversation, with no obligation.
