EU cookie consent: an ePrivacy and GDPR implementation checklist

Article 5(3) of the ePrivacy Directive governs storing information on, or accessing information from, a user’s device. Where that activity involves personal data, GDPR obligations also apply.

National laws implement the Directive, so teams need an EU baseline plus a country-level review for their target markets.

The ePrivacy rule concerns device storage and access, including similar technologies, even when the information is not personal data. Its exceptions cover transmission and operations strictly necessary for a service the visitor explicitly requests. A useful business purpose alone is not the same as strict necessity.

For example, a basket that remembers items during checkout may support the requested purchase. Advertising identifiers and optional audience measurement need their own assessment. Document the purpose and country rule for each technology; do not exempt all first-party cookies merely because they use your domain.

Before consent, keep optional analytics, advertising and functional technologies inactive. Present accept, reject and settings actions with comparable clarity, and avoid preselected optional purposes.

The banner explains the immediate decision and records the visitor’s choice. The cookie notice supplies the detail about purposes, providers and storage. Script controls enforce the choice before optional technology executes. A policy link alone cannot replace consent or prevent a request.

For a release review, open a fresh browser, reject optional purposes and inspect both Network and Storage. Then allow Analytics only. Confirm that unrelated advertising tags stay off and that a permanent preferences link lets the visitor withdraw. Keep the trace and the published configuration together.

Record a pseudonymous visitor reference, time, selected purposes, notice version and configuration version. Re-ask when purposes or vendors materially change rather than silently extending an old choice.

Retention should be documented and proportionate. Keep the evidence needed to demonstrate the decision without turning the consent log into an unnecessary identity store.

Test the site in a clean browser before and after each choice. Verify network requests, cookies, local storage, iframes and consent signals, including on translated pages and tag-manager variants.