ePrivacy Directive
The EU rules behind cookie consent: non-essential storage or access on a device waits for permission, alongside GDPR.
What it is
The ePrivacy Directive, formally Directive 2002/58/EC, is the EU rulebook for privacy in electronic communications, implemented through each member state's national law. The consent wording everyone argues about arrived with the 2009 amendment, which is why cookie banners spread across European sites from 2011 onward. Its famous Article 5(3) says that storing information on, or accessing information from, a person's device needs clear information and consent unless it is strictly necessary to transmit a communication or provide a service the person explicitly requested. That reaches beyond cookies to local storage, tracking pixels, and similar device access. It also covers communications confidentiality and direct marketing.
Reach for it whenever a site or app loads analytics, advertising, session replay, embedded media, or another non-essential tracker in the EU. GDPR supplies the standard for valid consent and governs the personal data that results; ePrivacy decides whether the device access may happen in the first place. They are two gates, not competing laws.
Gotcha: a banner cannot repair a script that already fired. Consent must block the tag, pixel, cookie, local-storage write, or SDK initialization until the user chooses. Calling analytics 'legitimate interests' under GDPR does not bypass the separate ePrivacy consent gate for non-essential device access.
Ask AI for it
Audit this site against ePrivacy Directive Article 5(3). Trace Google Tag Manager dataLayer pushes, document.cookie writes, localStorage, IndexedDB, tracking pixels, embedded media, and every analytics or ad SDK initialization. Classify each access as strictly necessary or optional with a precise reason. Then implement prior blocking with Google Consent Mode v2 defaults set to denied for analytics_storage, ad_storage, ad_user_data, and ad_personalization; release only the tags covered by the user's granular choice; and prove with a clean browser profile and network trace that optional requests do not fire before consent or after withdrawal.