General Requirements of the Law

If you plan to implement cookie consent tools to become compliant with applicable law, you should have a basic understanding of the requirements of the law.

Note:

The guidance in this section is general and should not be relied on as an authoritative or definitive guide to the requirements of the legislation in any particular jurisdiction. If you have questions about your compliance with law, you should confer with legal counsel. 

Each website is different and may be subject to different jurisdictional and regulatory requirements. It is your responsibility, as the website owner or administrator, to ensure compliance with applicable law.

The EU ePrivacy Directive is an EU Directive which is implemented in law by each EU member state. The general requirements are:

  • A site should not save or retrieve data on a user's device unless the user has given consent for this to happen.

  • The user's consent is not required where such actions are deemed Strictly Necessary for the provision of a service requested by the user.

Strictly Necessary refers to any type of cookie (or similar) without which the website cannot perform its core functions. The standard example for cookies like this is those which enable shopping cart functions, without which a purchase could not be completed.

Cookies necessary for security, load balancing, and session login cookies are also covered by this exception.

Cookies used for web analytics, while important to the businesses which own and operate websites, are not considered Strictly Necessary for the functionality of most websites and are not covered by this exception. Most regulators take a softer line on these types of cookies.

Third-party cookies, particularly those which are used for behavioral profiling or targeted advertising are considered the most intrusive and receive a great deal of scrutiny in relation to the rules.

What this means

You need to set up your website(s) to obtain consent to make the most of the potential offered by cookies. There are two core elements to this:

  • Display information about the cookies the site uses and what purposes they have.

  • Give users the ability to give their consent, or not, over whether such cookies can be placed on their device.

The complexities of complying with the law are largely focused on the issues of the definition of consent, when and how it is obtained, and what choices users have to withhold or withdraw it.