“GDPR cookie compliance” is a common way of describing the EU rules that apply when a website uses cookies and similar technologies. The name is a little misleading. The main cookie rule comes from the ePrivacy Directive, while the General Data Protection Regulation (GDPR) defines what valid consent means and applies to any personal data the cookies are used to collect.
The Consent Rule
Article 5(3) of the ePrivacy Directive allows a website to store information on a user’s device, or to access information already stored there, only if the user has given consent after receiving clear and comprehensive information, including about the purposes. This applies whether or not the information is personal data, as the EU Court of Justice confirmed in its 2019 Planet49 judgment. Each EU country applies the rule through its own national law.
Two kinds of storage or access are exempt: those used only to carry out the transmission of a communication over a network, and those strictly necessary to provide a service the user has explicitly requested. Whether a cookie is exempt depends on its purpose, not on what it is called.
What Valid Consent Requires
- It is freely given, specific, informed and unambiguous, and given by a statement or a clear affirmative action.
- It is obtained before non-exempt cookies are stored or read.
- It is specific to each purpose, so users can choose which purposes they accept.
- It is informed: in Planet49, the Court said the information includes how long cookies will operate and whether third parties may have access to them.
- It is not a pre-ticked box, and, according to the European Data Protection Board (EDPB), it cannot be inferred from scrolling or simply continuing to use the website.
- It can be withdrawn at any time, as easily as it was given.
Other GDPR Obligations
Where cookies are used to collect personal data, the GDPR’s wider rules also apply. Organizations relying on consent must be able to demonstrate that it was given, must explain how the data is used, and must respect data subjects’ rights. In the EDPB’s view, a so-called “cookie wall”, which blocks access to a service unless the user accepts cookies and offers no genuine choice, does not produce freely given consent. “Consent or pay” models, which let users pay instead of consenting, need a case-by-case assessment; the EDPB addressed them for large online platforms in its Opinion 08/2024.
A consent management platform can help collect and record consent, but the obligations themselves depend on how the website actually uses cookies.
Enforcement
National authorities enforce cookie rules under their ePrivacy laws, and the GDPR where personal data is involved. In September 2025, France’s data protection authority, the CNIL, fined Google €325 million under French rules, in part for placing advertising cookies without valid consent when users created Google accounts.
Conclusion
In the EU, websites need valid consent before storing or reading cookies that are not exempt, whether or not personal data is involved. That consent must meet the GDPR’s standard: freely given, specific, informed, unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. Where cookies collect personal data, the GDPR’s wider rules apply as well.
This article is general information, not legal advice.