Cookie Law (European Union) - Directive 2002/58/EC
The ePrivacy Directive (officially Directive 2002/58/EC, as amended by Directive 2009/136/EC) is commonly known as the "Cookie Law." It's a European Union regulation that specifically governs the privacy of electronic communications, with particular focus on the use of cookies and similar tracking technologies on websites.
While the GDPR provides broad data protection rules, the ePrivacy Directive focuses specifically on the confidentiality of electronic communications and the use of tracking technologies. Think of it as GDPR's companion legislation for cookies and online tracking.
Before storing or accessing information on a user's device (through cookies or similar technologies), you must obtain their informed consent. This means:
The only exception to the consent requirement is for cookies that are "strictly necessary" for the service explicitly requested by the user. Examples include:
Important: Analytics cookies, advertising cookies, and social media cookies are NOT considered strictly necessary and require consent.
Users must receive clear and comprehensive information about:
Users must be able to withdraw their consent as easily as they gave it. This means providing a clear mechanism for users to:
Both regulations apply simultaneously in the EU, and compliance with both is required:
In practice, you must comply with BOTH regulations when using cookies:
The ePrivacy Directive is expected to be replaced by the ePrivacy Regulation (ePR), which will have stricter requirements and direct applicability across all EU member states (like GDPR). Expected changes include:
CookieConfig is designed to help you comply with ePrivacy Directive requirements:
Place the script tag in your website's <head> section BEFORE any tracking scripts.
Review and customize the cookie categories in your dashboard to match your actual cookie usage.
Ensure your privacy policy includes detailed information about:
Verify that:
Periodically review your cookie usage to ensure your banner and privacy policy remain accurate.
Issue: Forcing users to accept cookies to access your website (cookie walls) may not be compliant.
Solution: Provide genuine choice. Users should be able to reject non-essential cookies and still access your basic content.
Issue: Assuming that continued browsing or scrolling constitutes consent.
Solution: Require an explicit action (clicking "Accept" or selecting preferences) for consent.
Issue: Having cookie categories pre-selected or pre-ticked.
Solution: All non-essential cookies must be opt-in (unchecked by default).
Issue: Vague or overly technical language in cookie notices.
Solution: Use clear, plain language to explain what cookies do and why you need them.
Issue: Making it harder to reject cookies than to accept them (dark patterns).
Solution: Provide equally prominent "Accept" and "Reject" buttons.
The ePrivacy Directive is enforced by national data protection authorities in each EU member state. Penalties vary by country but can be substantial:
Recent Enforcement Actions:
Since the ePrivacy Directive is a directive (not a regulation), each EU member state has implemented it into national law with some variations:
While the core requirements are similar, it's advisable to review specific guidance from the data protection authority in countries where you have significant user bases.
CookieConfig is a tool to help implement cookie consent requirements. However, it is not legal advice. Your specific compliance obligations depend on your business activities, location, and target markets. We recommend consulting with legal counsel familiar with ePrivacy and GDPR requirements for your specific situation.