What the law actually regulates
"Cookie law" in the EU is really two laws working together. The ePrivacy Directive (Article 5(3)) requires consent before storing or accessing any information on a user's device, except where strictly necessary to provide a service the user requested. The GDPR defines what valid consent looks like and governs the personal data processing that follows. The rules are technology-neutral: they cover cookies, localStorage, pixels, SDKs, and device fingerprinting alike.
The consequence: it is not the cookie itself that matters but its purpose. A session cookie keeping a shopping cart alive needs no consent. A Meta pixel or Google Analytics tag loaded on page view, before the visitor has chosen anything, is the single most common violation regulators find.
Cookie categories and consent requirements
| Category | Examples | Consent required (EU) |
|---|---|---|
| Strictly necessary | Session management, security tokens, load balancing, consent-choice storage | No |
| Functional / preferences | Language selection, embedded video players, live chat widgets | Yes, unless genuinely requested by the user |
| Analytics | Google Analytics, heatmaps, session recording | Yes in most member states; a few regulators tolerate narrowly configured first-party audience measurement |
| Advertising / marketing | Ad network cookies, retargeting pixels, cross-site identifiers | Yes, always |
The "strictly necessary" exemption is judged from the user's perspective, not the business's. Necessary for your ad revenue does not count.
What makes consent valid
Under GDPR Article 4(11) and 7, and as confirmed by the CJEU in Planet49 (2019), consent must be:
- Freely given: no cookie walls that condition access on accepting tracking (with narrow "pay or consent" debates ongoing), and no detriment for refusing
- Specific and informed: per-purpose choices, naming who sets cookies and why, before any non-essential cookie fires
- Unambiguous and active: pre-ticked boxes and continued browsing do not count
- As easy to withdraw as to give: a persistent way to change choices, not a one-time banner
Regulators, led by France's CNIL, have added a practical rule with real fines behind it: rejecting must be as easy as accepting. A banner with a one-click "Accept" and a "Manage settings" maze is non-compliant. Google and Facebook were fined EUR 150 million and EUR 60 million respectively by the CNIL in 2022 for exactly this pattern.
Dark patterns (nudging color schemes, hidden reject links, repeated re-prompting after refusal) are treated as invalidating consent, not as clever design.
The US approach: opt-out, not opt-in
US state privacy laws (California's CCPA/CPRA, plus Virginia, Colorado, Connecticut, Texas, and a growing list of others) do not require consent before setting cookies. Instead they give consumers the right to opt out of the sale or sharing of personal information, which regulators interpret to cover most third-party advertising cookies. Practical obligations:
- A clear "Do Not Sell or Share My Personal Information" mechanism where ad trackers are used
- Honoring the Global Privacy Control (GPC) browser signal as a valid opt-out; California's Sephora settlement (2022, USD 1.2 million) made ignoring GPC an enforcement priority
- Accurate privacy policy disclosures of the categories of data shared with advertising partners
- Opt-in consent for known minors' data
Sites serving both markets typically run region-aware consent: opt-in banners for EU/UK visitors, opt-out links and GPC handling for US visitors.
Implementing compliant cookie management
- Inventory every tracker. Crawl your site and catalogue all cookies, pixels, scripts, and localStorage usage, including what your tag manager and embedded widgets load transitively. Most sites are surprised by what they find.
- Categorize by purpose and cut what you cannot justify. Fewer vendors means less consent complexity and less risk.
- Deploy a consent management platform (CMP) that blocks non-essential tags until consent, offers equal-prominence accept/reject, records consent for proof, and supports IAB TCF v2.2 if you use programmatic advertising.
- Verify blocking actually works. The most common CMP failure is cosmetic compliance: the banner shows, but analytics and ad tags fire anyway. Test with the network panel or an automated scanner before and after consent choices.
- Align the privacy policy with reality: name the vendors, purposes, and retention periods that the scan actually shows.
- Re-scan on every release. Marketing tags change constantly; a compliant site in January is often non-compliant by June.
Related guides
See what your site is actually loading
BD Emerson's scanner detects the trackers on your site, checks whether they fire before consent, and flags gaps between your cookie banner and reality.