The ePrivacy Directive and Cookies
Understand how the ePrivacy Directive (also known as the "Cookie Law") complements GDPR and what obligations you have as a website owner.
What is the ePrivacy Directive and how does it relate to cookies?
The ePrivacy Directive (2002/58/EC) — known as the "Cookie Law" — requires informed consent before storing or accessing information on a user's device. It complements GDPR: ePrivacy sets the rules for cookies specifically, while GDPR defines what constitutes valid consent.
- Requires informed consent before setting any non-essential cookie
- Exemption only for cookies strictly necessary for the website to function
- Each EU member state transposes the directive into national law
What is the ePrivacy Directive?
The ePrivacy Directive (2002/58/EC, amended by 2009/136/EC) governs the privacy of electronic communications in the European Union. Often called the "Cookie Law," it requires informed consent before storing or accessing information on a user's device.
While the directive was originally focused on telecommunications, its scope has expanded to cover cookies, tracking technologies, and other forms of online data collection. Every EU member state has transposed the directive into its own national legislation.
ePrivacy and GDPR — How they work together
GDPR governs the processing of personal data in general, while ePrivacy specifically focuses on privacy in electronic communications, including cookies. The two regulations complement each other.
In practice, this means you need to comply with both: ePrivacy requires consent for setting cookies, and GDPR defines what constitutes valid consent. Key differences include:
- ePrivacy is a directive (transposed into national law), while GDPR is a regulation (directly applicable)
- ePrivacy covers all cookies and storage technologies, while GDPR focuses on personal data
- ePrivacy allows exceptions for strictly necessary cookies; GDPR applies whenever personal data is processed
- Both require prior, informed, and freely given consent for non-essential cookies
Technical requirements for compliance
To comply with the ePrivacy Directive, your website must meet the following technical requirements:
- Block all non-essential cookies and scripts before obtaining user consent
- Display a clear, informative consent banner that explains what cookies are used and why
- Provide granular controls allowing users to accept or reject individual cookie categories
- Store consent records as proof for regulatory audits and inspections
- Allow users to easily withdraw or change their consent preferences at any time
How CookieFix ensures ePrivacy compliance
CookieFix handles every technical requirement of the ePrivacy Directive automatically. Here is what we do for your website:
- Automatic cookie scanning and classification into the correct categories
- Prior blocking of all non-essential cookies until consent is obtained
- Clear, customizable consent banner with per-category granular controls
- Consent proof logging for regulatory audits and compliance verification
- Easy consent withdrawal — visitors can update their preferences anytime
Frequently asked questions about the ePrivacy Directive
Directive 2002/58/EC, amended in 2009, is transposed into national law in every EU member state. Article 5(3) requires the user's consent before information is stored on or accessed from their device, i.e. before any non-essential cookie is set.
ePrivacy specifically regulates cookies and electronic communications, i.e. when consent is required. GDPR defines what valid consent looks like and how the resulting personal data is processed. They apply together: ePrivacy says "ask for consent", GDPR says "this is what valid consent looks like".
Yes. The directive refers to "storing or accessing information" on terminal equipment, so it covers localStorage, sessionStorage, tracking pixels, SDKs and fingerprinting techniques, not only HTTP cookies.
The proposed ePrivacy Regulation, meant to replace the directive, was officially withdrawn by the European Commission in 2025. The 2002 directive and national laws remain in force and authorities enforce them through guidance and fines.
Clear information about cookie purposes, category-level choices (necessary, preferences, statistics, marketing), equally prominent "Accept all" and "Reject all" buttons, the ability to change the choice at any time and effective script blocking until consent is given.
Ensure ePrivacy and GDPR compliance
Set up CookieFix in 5 minutes and ensure your website meets both ePrivacy and GDPR requirements.
Create free account