Most teams assume cookie banners exist because of the GDPR. They exist because of the ePrivacy Directive. The GDPR defines what valid consent looks like; ePrivacy is what makes consent necessary before anything is stored on or read from a visitor's device. Understanding the difference matters, because ePrivacy reaches further than the GDPR does — and it is enforced differently.
The ePrivacy Directive (2002/58/EC), amended in 2009, governs privacy in electronic communications across the European Union. It sits alongside the GDPR as lex specialis: where both could apply, the more specific ePrivacy rule takes precedence.
Because it is a directive rather than a regulation, it is not directly applicable. Each member state transposes it into national law, which is why cookie requirements differ in detail between, say, Germany, France and Spain even though the underlying rule is the same. Outside the EU, the United Kingdom applies its own transposition, the Privacy and Electronic Communications Regulations (PECR).
A proposed ePrivacy Regulation, intended to replace the directive and align it fully with the GDPR, was under negotiation for years before being withdrawn. The directive therefore remains the operative law, together with each country's implementation and its regulator's guidance.
The core requirement is short. Storing information on, or gaining access to information already stored on, a user's terminal equipment is only allowed if the user has given prior informed consent. There are two narrow exceptions:
Three consequences follow, and each is regularly missed:
It is not limited to cookies. The wording covers any storage or access on the device — which means local storage, session storage, IndexedDB, SDK identifiers, device fingerprinting and pixels are all in scope. A consent tool that blocks cookies but lets a script write to local storage has not solved the problem.
It is not limited to personal data. Unlike the GDPR, ePrivacy applies regardless of whether what is stored identifies anyone. Purely technical identifiers still require consent unless an exception applies.
"Strictly necessary" means necessary for the user, not for you. Analytics that help you improve the site, and advertising measurement that helps you sell, are not strictly necessary — however useful they are to the business. Session management, load balancing, security and remembering the visitor's own cookie choices are.
The standard comes from the GDPR: consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. In the cookie context, European regulators have been consistent about what fails:
Consent must also be prior: non-essential technologies may not load while the banner is still on screen waiting for an answer. This is the single most common technical failure, because tag managers frequently fire before the consent decision reaches them.
| Aspect | ePrivacy Directive | GDPR |
|---|---|---|
| Question it answers | May you store or read anything on the device? | How may you process personal data? |
| Scope | Any information on terminal equipment, personal or not | Personal data |
| Legal form | Directive, transposed nationally | Regulation, directly applicable |
| Basis for cookies | Consent, unless strictly necessary | Defines what valid consent is |
| Enforcement | National authorities, without the one-stop-shop | One-stop-shop lead authority |
That last row has real consequences. Because ePrivacy enforcement does not run through the GDPR's one-stop-shop mechanism, a national regulator can act directly against a company for cookie violations without deferring to the lead authority in another country. France's CNIL has used this repeatedly, issuing some of Europe's largest cookie-related fines against global technology companies for making refusal harder than acceptance.
The directive is broader than most cookie discussions suggest. It also governs the confidentiality of communications, traffic and location data, and unsolicited electronic marketing — including the conditions under which you may email or message someone, and the "soft opt-in" for existing customers. If your marketing stack sends email or SMS to EU recipients, ePrivacy applies to that too.
Corpowid scans every cookie, tag and browser-storage write on your site, categorises what it finds, and holds all non-essential technologies until the visitor has actually decided — including local storage and IndexedDB, which most consent tools leave untouched. The consent experience adapts to the visitor's country, so an EU visitor gets an ePrivacy-compliant opt-in while others get the framework that governs them. Every choice is recorded with full context and can be exported when a regulator asks. And because the same interface carries your accessibility features, the banner itself is usable by keyboard and screen-reader users — a point that matters more each year, now that European accessibility rules are enforced alongside privacy ones.
No. The GDPR governs the processing of personal data and defines what valid consent means. The ePrivacy Directive governs storing and reading information on a user's device, whether or not it is personal data, and is what requires consent before cookies load. Where both could apply, ePrivacy takes precedence as the more specific rule.
Only those strictly necessary to deliver a service the user explicitly requested — session management, security, load balancing, and remembering the visitor's own cookie preferences. Analytics and advertising cookies do not qualify, even when they are first-party.
Yes. Article 5(3) refers to storing or accessing information on terminal equipment, not to cookies specifically. Local storage, session storage, IndexedDB, SDK identifiers and fingerprinting techniques all fall within scope.
A regulation was proposed to replace the directive and align it with the GDPR, but after years of negotiation the proposal did not proceed. The directive, as transposed into each member state's national law, remains in force.
In detail, yes. Because it is a directive, each member state implements it in national law and each regulator issues its own guidance, so requirements around banner design, consent lifetime and analytics exemptions vary. The underlying obligation — prior consent for anything non-essential — is the same everywhere. For the opposite model, see our CCPA/CPRA page.
Corpowid has been recognized by Gartner, a leading global research and advisory firm, for our innovation and performance in digital accessibility. These badges reflect our commitment to creating inclusive, AI-powered web experiences.
TR