EU cookie consent: an ePrivacy and GDPR implementation checklist

Article 5(3) of the ePrivacy Directive governs storing information on, or accessing information from, a user’s device. Where that activity involves personal data, GDPR obligations also apply.

National laws implement the Directive, so teams need an EU baseline plus a country-level review for their target markets.

Before consent, keep optional analytics, advertising and functional technologies inactive. Present accept, reject and settings actions with comparable clarity, and avoid preselected optional purposes.

Record a pseudonymous visitor reference, time, selected purposes, notice version and configuration version. Re-ask when purposes or vendors materially change rather than silently extending an old choice.

Retention should be documented and proportionate. Keep the evidence needed to demonstrate the decision without turning the consent log into an unnecessary identity store.

Test the site in a clean browser before and after each choice. Verify network requests, cookies, local storage, iframes and consent signals, including on translated pages and tag-manager variants.