Do I need cookie consent?

Two instruments, one screen

People collapse “cookie consent” into a single GDPR question. The screen is actually two instruments stacked, and keeping them separate is what keeps the answer accurate.

1. The trigger is ePrivacy Article 5(3): storing or accessing information on terminal equipment, whatever the technology. GDPR does not itself create the cookie rule.
2. The standard, once consent is the basis, is GDPR Articles 4(11) and 7: freely given, specific, informed, unambiguous, a clear affirmative action, and as easy to withdraw as to give.
3. The overlayis national. Article 5(3) applies through each Member State's law, so analytics exemptions and cookie-wall stances differ. Check the authority competent for your processing.

This guide uses provision identifiers, short statutory terms, and original plain-English summaries; it does not reproduce full provisions. It is educational content, not legal advice and not a binding determination. Whether a specific cookie or tracker is strictly necessary is a fact-based judgement against the service the user actually requested.

How to decide, step by step

1. 1

   Check whether Article 5(3) engages at all

   “Do I need cookie consent?” is not the same question as “do I have a website.” The rule that decides it is Article 5(3) of the ePrivacy Directive 2002/58/EC, as amended by Directive 2009/136/EC. It engages when you store information on, or gain access to information already stored on, a user's terminal equipment. Cookies, local storage, SDKs, pixels, and fingerprinting can fall within that trigger when they actually store information on the device or gain access to information from it; the technology's label is not decisive. If you place or read nothing on the device at all, the cookie rule does not engage and no cookie consent is required on that basis. That outcome is unusual for a modern site or app, so confirm it covers third-party embeds (maps, video, fonts, social widgets) and analytics tags, which often set or read device data without being obvious. Re-check the moment you add any.

2. 2

   Classify what you store against the strictly-necessary exemption

   Once the rule engages, the path splits on what you store or read. Article 5(3) exempts from prior consent only what is strictly necessary to deliver a service the user has explicitly requested, or what is solely needed to carry out a transmission. Typical examples are a session or authentication cookie, a security or load-balancing cookie, a shopping-cart cookie, and the cookie that records the user's own consent choice. Two cautions sit on that exemption. First, it is narrow and is judged against the specific service the user asked for, not against what is convenient for measurement, marketing, or product analytics. Second, exemption from consent does not automatically remove every notice duty. Where personal data are processed, GDPR Articles 13 and 14 still apply; national implementing law may add more. A cookie notice is prudent, but it is not a separate universal Article 5(3) requirement. If the categories in use are not yet known, that is itself the finding: audit every cookie, local-storage item, SDK, pixel, and tag, including third-party ones, classify each against the requested service, and only then continue.

3. 3

   If anything is non-essential, hold it until prior consent

   Analytics, measurement, A/B-testing, advertising, retargeting, social-media tags, and other third-party tracking are generally not strictly necessary, so Article 5(3) requires the user's prior consentbefore they fire. Prior means what it says: non-essential scripts and tags may be set or read only once the user has agreed. Loading them on the first page view, before any choice is made, means they ran without consent. Strictly necessary items may still load in the meantime. One hedge belongs here and nowhere else: a few national authorities allow a narrow exemption for certain privacy-preserving, first-party audience measurement under strict conditions. The CNIL's Sheet no. 16 is a current worked example under French law (inform users, offer an objection, limit the tracer to a single site or application publisher with no cross-checking, truncated IP, limited lifetime; a third-party processor may serve several publishers only if each publisher's data and trackers stay independent). Most large analytics offerings still fall outside it. That is a national overlay, not a general EU rule, so check your competent authority's current guidance before you treat analytics as exempt rather than assuming the exemption travels.

4. 4

   Apply the GDPR consent standard, not a lighter cookie standard

   Where Article 5(3) requires consent, the standard of that consent is the GDPR standard, not a lighter cookie-specific one. Articles 4(11) and 7 require consent to be freely given, specific, informed, and unambiguous, given by a clear affirmative action. The Court of Justice confirmed the pre-ticked-checkbox point for cookies in Planet49 (Case C-673/17, judgment of 1 October 2019): a pre-ticked box the user must deselect is not valid consent. EDPB Guidelines 05/2020 add that inactivity, silence, and continued browsing are not valid consent either. An accept-only banner is a different problem (whether refusing is as easy as accepting), not the Planet49 holding. Information has to come first. Tell the user what you store or read, why, how long cookies last, and whether third parties may access them, in plain language, before any non-essential cookie is set. Where GDPR Article 13 applies, identify the recipients or categories of recipients (Article 5(3) read with Articles 4(11) and 13).

5. 5

   Check the mechanism: refuse, granularity, withdrawal, records

   Four mechanism tests sit on top of the standard. First, refusing must be as easy as accepting. A vast majority of Cookie Banner Taskforce authorities (report adopted 18 January 2023) consider that a reject option should appear on every layer that contains an accept button. Design is assessed case by case; the report does not impose a single colour standard, and a few authorities on the taskforce disagreed. Second, consent must stay specific and granular, so users can agree to some purposes (for example analytics) and not others (for example advertising) rather than a single all-or-nothing choice (Article 4(11)). Third, users can withdraw consent at any time, as easily as they gave it (Article 7(3)), which in practice means a persistent way to reopen the cookie settings and change or revoke the choice. Fourth, you must be able to demonstrate consent (Article 7(1)): who consented, when, to what information, and to which purposes. A fifth, separate question is the cookie wall, which the next section isolates because the EU position is not uniform.

6. 6

   Check the national overlay, record the reasoning, and re-check

   Article 5(3) applies through national law. Each Member State's competent authority (the data-protection supervisory authority or, in some States, another national regulator) publishes detailed guidance, and two overlays move the most: whether a narrow first-party analytics exemption exists, and whether a cookie wall or “consent or pay” model is permitted under conditions. Check the authority competent for your processing, not a pan-EU blog summary. Keep the assessment and its reasoning with your records, even where the result is that only strictly necessary items are in use, because that conclusion is fragile. The answer is not permanent: adding an analytics tag, a marketing pixel, a third-party embed, or a new SDK can move you from exempt to consent-required on the next deploy. When the position is unclear, document your reasoning and take advice.

Six mistakes that produce the wrong answer

• Treating a banner as the rule

  The rule is storage or access on the device, not the existence of a banner. A site that uses only strictly necessary cookies does not need a consent banner for those items. A site that fires analytics on page load has already failed the prior-consent test, banner or not.

• Calling analytics strictly necessary

  Audience measurement is useful to you. That does not make it essential to the service the user asked for. Treat analytics as consent-required unless your competent authority has published a narrow, conditional first-party exemption that your implementation actually meets.

• Counting only HTTP cookies

  Article 5(3) is technology-neutral, but the trigger is still actual storage or access on the device. Local storage, SDKs, pixels, and fingerprinting can fall within it when they store or read information there. A cookieless fingerprinting script does not escape the rule merely by avoiding a Set-Cookie header, if it still accesses information on the terminal equipment.

• An accept-only banner, or consent from scrolling

  GDPR consent needs a clear affirmative action (Article 4(11)). Planet49 rejected pre-ticked boxes for cookies. Inactivity, silence, and continued browsing are invalid under EDPB Guidelines 05/2020. An accept-only banner is a refuse-as-easy problem (Cookie Banner Taskforce, majority view), not the Planet49 holding.

• Hiding reject behind extra clicks

  A vast majority of Cookie Banner Taskforce authorities consider that a reject option should appear on every layer that contains an accept button. Design is assessed case by case and the report does not impose a single colour standard, but it must not clearly push users toward acceptance. A bright Accept next to a buried 'manage preferences' path is the design most of those authorities were targeting.

• Copying another Member State's analytics exemption or cookie-wall stance

  Article 5(3) bites through national law. A publisher-scoped measurement exemption, or assessment criteria for a consent-or-pay model, that one authority has issued is not a general EU rule. Check the authority competent for your processing.

Frequently asked questions