Ask ten website owners which law makes them show a cookie banner and most will say “GDPR”. They’re half right — and the missing half is where compliance mistakes happen. The rule that actually governs cookies and similar technologies in the EU is the ePrivacy Directive, often called the “cookie law”. GDPR sets the broad framework for personal data; ePrivacy sets the specific rules for what you can store on, or read from, someone’s device.
The distinction matters in practice. It determines when you genuinely need consent, when you don’t, and why a privacy-first site can often skip the banner entirely.
Short answer: The ePrivacy Directive (the “cookie law”) governs whether you need consent to store anything on a visitor’s device — including cookies — regardless of whether the data is personal. GDPR then sets the quality standard that any consent you collect must meet. The two laws layer: ePrivacy determines the trigger, GDPR determines the bar. If your site doesn’t set cookies or read device storage, ePrivacy’s consent trigger often doesn’t fire at all.
Two Laws, Two Jobs
The cleanest mental model: GDPR is the general law, ePrivacy is the specialist. They cover different ground and they trigger on different events.
- The GDPR (General Data Protection Regulation) governs how you collect, process, and protect personal data — any information relating to an identifiable person. It applies broadly across nearly everything you do with data.
- The ePrivacy Directive governs electronic communications and, crucially, the act of storing or accessing information on a user’s device. That’s cookies, local storage, device fingerprinting, and similar technologies — regardless of whether the data in question is “personal” in the GDPR sense.
That last point is the one most people miss. ePrivacy can require consent even when no personal data is involved, because its trigger is touching the device, not identifying the person. The cookie question is therefore an ePrivacy question first, and a GDPR question second.
Directive vs Regulation: Why It Matters
There’s a structural difference here that trips people up. The GDPR is a regulation — it applies directly and identically across all EU member states without national implementation. The ePrivacy Directive is a directive, which means each country writes its own national law to transpose it into domestic legislation.
The consequence: cookie rules vary by country. The core requirement — consent before non-essential cookies — is consistent. But the fine print (what counts as strictly necessary, enforcement intensity, required wording) differs across member states. Operating across borders means following the strictest applicable interpretation of those national laws.
| Aspect | GDPR | ePrivacy Directive |
|---|---|---|
| Type of law | Regulation (applies directly) | Directive (national laws implement it) |
| What it covers | All personal data processing | Storing/accessing info on devices; electronic comms |
| Trigger | Processing personal data | Reading from or writing to a user’s device |
| Consistency across EU | Uniform | Varies by country |
| Main relevance to sites | Lawful basis, rights, security | Cookie and tracking consent |
When You Actually Need Cookie Consent
This is where understanding ePrivacy pays off directly. The directive draws a clear line between cookies that need consent and cookies that don’t.
Consent NOT required (strictly necessary)
Cookies that are strictly necessary to provide a service the user explicitly requested are exempt from the consent requirement. Standard examples:
- A cookie that keeps items in a shopping cart during checkout.
- A session cookie that keeps a logged-in user authenticated.
- A cookie that remembers the user’s own consent choices.
- A load-balancing cookie required to deliver the page.
Consent REQUIRED
Anything beyond strictly necessary needs prior, informed, freely given consent — set before the cookie is placed, not after. This includes:
- Advertising and retargeting cookies.
- Cross-site tracking and behavioral profiling.
- Traditional analytics that set identifiers on the device.
- Social media embeds that drop tracking cookies from third parties.
This is the gap that privacy-first sites turn into a structural advantage. If your analytics set no cookie and store nothing on the device, the ePrivacy consent trigger often isn’t pulled at all — which is why tools like Plausible and Fathom let you run a clean site without a banner. Our guide to cookie consent banner best practices covers how to design the banner correctly if you do need one.
How the Two Laws Interact
GDPR and ePrivacy layer rather than compete. When ePrivacy requires consent to place a cookie, and that cookie then processes personal data, GDPR’s consent standard applies on top. That consent must be:
- Freely given — no pre-ticked boxes, no “consent or leave” walls for non-essential tracking.
- Specific and granular — separate choices for separate purposes, not one blanket “Accept all”.
- Informed — the user understands what they’re agreeing to before they click.
- As easy to withdraw as to give — “Reject” must be as accessible as “Accept”.
A banner with only an “Accept” button, or with a reject option buried three taps deep, fails on both counts. It doesn’t meet ePrivacy’s prior-consent requirement and it doesn’t meet GDPR’s freely-given standard.
One area where the layering gets technical: analytics that don’t set cookies but do collect data you later associate with identifiable users still fall under GDPR even if ePrivacy is satisfied. The consent trigger and the data-processing lawfulness question are separate steps. Cookieless doesn’t automatically mean GDPR-exempt — it means you’ve handled the ePrivacy layer. For the GDPR layer, see what changes when you migrate from Google Analytics to a privacy-first tool — the data minimization argument is what closes both loops at once.
The Coming ePrivacy Regulation
The EU has been working on replacing the ePrivacy Directive with an ePrivacy Regulation — a single, directly-applicable law that would harmonize rules across member states the way GDPR did for data protection. Progress has been slow. The draft has shifted substantially over multiple Council presidencies, and no final text has been adopted as of this writing. Any specific timeline you find online is probably outdated.
The practical upshot: build for data minimization and consent-by-design now, and the final regulation will require less rework. A site that doesn’t depend on invasive cookies has the least to change when the rules tighten — and they will tighten.
A Practical Compliance Checklist
- Audit your cookies. List every cookie and storage item your site sets, then classify each one as strictly necessary or not. Most sites have far more than they realize once you count third-party embeds.
- Block non-essential cookies until consent. They must not fire before the user agrees — actually blocked, not just hidden.
- Offer a real reject option. Make “Reject” as prominent and one-click as “Accept”.
- Document consent. Keep a record of what each visitor agreed to and when — you need to demonstrate it on request.
- Consider going cookieless. The simplest compliance is having nothing to consent to. Switching to a cookie-free analytics tool removes the ePrivacy trigger entirely for your measurement layer.
- Keep your privacy policy current. Describe what you collect, why, and how visitors exercise their rights.
Frequently Asked Questions
Is the cookie law the same as GDPR?
No. The “cookie law” is the ePrivacy Directive, which governs storing or accessing information on a user’s device. GDPR governs personal data more broadly. They work together: ePrivacy determines when consent is required for a cookie, and GDPR sets the standard that consent must meet.
Do I need consent for analytics cookies?
If your analytics set cookies or store identifiers on the device, generally yes under ePrivacy. If you use privacy-first analytics that set no cookies and store nothing on the device, the ePrivacy consent trigger often doesn’t apply. That’s the practical case for cookieless tools — fewer legal obligations, not just a PR position. Check your specific implementation against the rules in your jurisdiction.
Why do cookie rules differ between EU countries?
Because ePrivacy is a directive, not a regulation. Each member state passes its own national implementation, so the details and enforcement intensity vary even though the core consent principle is shared.
Which cookies are exempt from consent?
Strictly necessary cookies — those required to deliver a service the user explicitly requested. A shopping cart cookie, a login session, a load-balancer cookie, a cookie storing the user’s own consent choices. Everything beyond that category needs prior consent.
Does cookieless analytics mean I’m automatically GDPR-compliant?
Not automatically. Cookieless satisfies the ePrivacy layer — you’re not storing anything on the device without consent. But if your cookieless analytics still collect data that can be linked to an identifiable person, GDPR applies to that processing. The good news: most purpose-built privacy analytics (Plausible, Fathom, Umami) are designed to avoid collecting personal data at all, which closes the GDPR loop too. Verify with your specific tool’s documentation.
Compliance Through Restraint
The clearest path through the ePrivacy-GDPR tangle isn’t a better banner — it’s needing fewer cookies in the first place. When you don’t store identifiers on visitors’ devices, the consent machinery mostly becomes unnecessary. Compliance becomes a side effect of architecture, not a bolt-on.
If you’re ready to reduce your cookie footprint, the most direct step is replacing tracking-heavy analytics. Our guide to migrating from Google Analytics to a privacy-first alternative walks through exactly what changes and what you gain.
