August 10, 2025
2 min read
Analysis of regulatory frameworks reveals that not all cookies are subject to the same consent requirements. The ePrivacy Directive (Directive 2002/58/EC), often referred to as the "EU cookie law," clearly distinguishes between strictly necessary cookies and other types of cookies. According to Article 5(3), “consent shall not be required for the technical storage or access that is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user.”
Empirical investigation into website practices corroborates that strictly necessary cookies—those required for core functionalities such as session management, shopping carts, and security features—are routinely deployed without explicit user consent. For example, login authentication tokens and shopping cart retention cookies fall under this exemption. These findings align with guidelines issued by regulatory authorities, including the European Data Protection Board (EDPB, 2020), which states:
Conversely, cookies utilized for analytics, advertising, or personalization do not qualify for the exemption and thus require prior informed consent from users. This bifurcation is explicitly supported by Article 6 of the GDPR, which mandates a lawful basis for processing personal data, further enforced by Recital 30 which identifies online identifiers as personal data.
A review of national implementations (e.g., UK’s Privacy and Electronic Communications Regulations—PECR, French CNIL guidelines) confirms a consistent approach:
Practical impact assessments indicate that most websites now deploy cookie banners that distinguish between essential and non-essential cookies, offering granular controls to users. This approach minimizes compliance risks and aligns with regulatory expectations.
In summary, regulatory analysis and observed practice support the conclusion:
This distinction is now standard practice in compliance strategies across jurisdictions governed by the ePrivacy Directive and GDPR.
