Cookie consent is usually described as a GDPR requirement. Mostly, it is not. The rule that requires consent before you store or read cookies on a user's device comes from the ePrivacy Directive. The GDPR supplies the standard that consent must meet, and governs what you then do with any personal data the cookies produce.
The distinction matters because the two laws have different scopes, different enforcers, and different exemptions. Teams that treat cookies as a GDPR lawful basis question tend to reach for legitimate interests, which is not available under the storage rule.
This article explains which rule does what, what valid consent looks like, how narrow the exemption for strictly necessary cookies is, and how to test what your site actually does.
The rule in Article 5(3) of the ePrivacy Directive
Article 5(3) of Directive 2002/58/EC, as amended in 2009, permits storing information, or gaining access to information already stored, in a user's terminal equipment only if the user has given consent, having been provided with clear and comprehensive information, in particular about the purposes of the processing.
Four features of the rule surprise people:
It is not limited to personal data. It applies to any information stored on or read from a device. The Court of Justice confirmed this in Planet49 (Case C-673/17) in 2019.
It is not limited to cookies. Local storage, device fingerprinting, and similar techniques that store or access information on a device are covered. The EDPB has published guidelines on the technical scope of Article 5(3) that discuss tracking pixels, tracking links, and other techniques.
It reaches third-party scripts. Tags and plug-ins you embed set cookies through your site. In Fashion ID (Case C-40/17), the Court of Justice held that a site embedding a third-party social plug-in can be a joint controller for the collection and transmission of its visitors' data.
It is a directive. Each member state has implemented it in national law, and national regulators issue their own guidance. Requirements vary in detail from country to country.
Article 5(3) offers consent or one of two exemptions. There is no legitimate interests route for storing or reading the information in the first place.
What the GDPR adds
"Consent" in the ePrivacy Directive now means consent as the GDPR defines it, because the GDPR replaced the earlier directive the ePrivacy text refers to. Article 4(11) requires consent to be freely given, specific, informed, and unambiguous, by a statement or a clear affirmative action. Article 7 requires you to be able to demonstrate it and to make withdrawal as easy as giving it.
In Planet49, the Court held that a pre-ticked checkbox does not give valid consent. The EDPB's consent guidelines add that scrolling or continuing to browse is not consent. They also say that a cookie wall, which blocks access to content unless the user accepts, generally does not produce freely given consent.
The GDPR also applies in its own right to any personal data the cookies collect. Once a cookie identifies a browser and links activity to it, the resulting data is usually personal data. Its further processing needs a lawful basis under Article 6, an entry in your record of processing, and a description in your privacy notice. The choice of basis is covered in the six GDPR lawful bases.
The strictly necessary exemption
Article 5(3) exempts storage or access in two cases:
for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or
where strictly necessary for the provider of an information society service explicitly requested by the user to provide that service.
Websites rely on the second, and it is narrower than it looks. "Strictly necessary" is measured against the service the user asked for, not against your business needs.
The Article 29 Working Party's opinion on the cookie consent exemption gives examples that can qualify when properly configured:
session cookies that keep a user logged in or hold items in a shopping cart,
cookies that record the user's consent choice,
security cookies tied to a service the user requested, such as detecting repeated failed logins,
load-balancing cookies for the duration of a session, and
interface customization cookies, such as a language preference the user set.
Advertising and cross-site tracking cookies do not qualify. Analytics is the contested case. The opinion did not exempt it, though some national regulators now allow limited first-party audience measurement without consent under strict conditions, and others do not. If you want to run analytics without consent, check the guidance in each country you target and configure the tool to meet it.
What a compliant banner does
A banner is an interface for a legal test. The test is whether the user's choice was free, specific, informed, and unambiguous, and whether you then honored it.
The EDPB's cookie banner taskforce coordinated regulators' responses to complaints about banner design and reported their common positions. In broad terms, regulators look for:
Nothing non-essential before consent. No analytics or advertising cookies, and no tags that set them, fire on first page load.
A reject option as easy to use as accept. The taskforce report treated a first layer with an accept button and no way to reject as a problem.
No deceptive design, such as pre-ticked boxes, colors that steer the user toward accepting, or a reject link buried in body text.
Separate purposes, so a user can accept analytics without accepting advertising.
Clear information: what each category does, which third parties receive data, and how long the cookies last. Planet49 requires information on duration and on whether third parties can access the cookies.
Easy withdrawal: a persistent link or icon that reopens the choices, and a withdrawal that actually stops the cookies being set.
Because the directive is implemented nationally, details vary. Some regulators specify how long a choice may be remembered before you ask again, or how the reject option must be presented. Check the guidance where your users are.
Testing that it works
Banner configuration and site behavior drift apart. A new marketing tag, a vendor script update, or a tag manager rule can set cookies before consent without anyone touching the banner. Test what the site does, not what the banner says.
Inventory. Load each key page in a clean browser profile. Record every cookie and local storage entry, with its domain, duration, and purpose.
First load. Before interacting with the banner, confirm that only strictly necessary items are present and that no third-party tracking requests have been sent.
Reject. Reject all, reload, and browse several pages. Nothing non-essential should appear.
Accept selectively. Accept one category and confirm that only that category's cookies appear.
Withdraw. Reopen the choices, withdraw consent, and confirm the cookies stop being set or are removed.
Record. Keep the dated results. Article 7(1) requires you to be able to demonstrate consent, so also confirm your consent records capture the choice, the time, and the version of the banner shown.
Run the test after any change to marketing tags, and on a regular schedule regardless. It is the evidence that your site does what your privacy-by-design process says it should.
If you are outside the EU, GDPR for US SaaS companies covers when the GDPR applies to you at all. National implementations of the ePrivacy rules vary in ways that affect the details above, so confirm your banner design and any analytics exemption with counsel.
How TrustLynce helps
TrustLynce's policy management versions your cookie notice alongside your privacy notice and records when each version took effect. The data privacy workflows keep the record of processing entries for analytics and advertising, with the lawful basis and recipients for each.