What is ePrivacy Directive?
The ePrivacy Directive, often called the cookie law, is the EU rule that requires consent before storing information on, or reading information from, a visitor's device. It applies to the act of device storage itself, so it catches cookies, local storage and device fingerprinting regardless of whether the data collected is personal.
Explanatory, not legal advice. Implementations differ by member state and your obligations depend on your circumstances.
Why it, and not the GDPR, produced cookie banners
This is the most common confusion in the whole area. The banner requirement comes from ePrivacy, not the GDPR.
The distinction is precise and it matters:
| Triggered by | Consent needed for | |
|---|---|---|
| ePrivacy | Storing or reading data on a device | Any non-essential storage, personal or not |
| GDPR | Processing personal data | Depends on the lawful basis chosen |
So a cookie holding a random number that identifies nobody still needs consent under ePrivacy, because the storage is what is regulated. And conversely, analytics that stores nothing on the device never triggers this rule at all — which is the whole legal argument behind cookieless analytics.
The strictly necessary exemption
Consent is not required for storage that is strictly necessary to deliver a service the user explicitly requested — a session token for a logged-in area, a shopping-cart identifier, a load-balancer cookie.
Analytics has consistently not qualified. Regulators have been clear that measuring your audience is necessary for you, not for the visitor, however useful it is.
Directive, not regulation
Because it is a directive, each member state implements it in its own law, and the details differ. The UK’s version is PECR. A long-promised ePrivacy Regulation, which would apply uniformly, has been in negotiation for years without being adopted — so national variation remains the reality to plan around.