EU cookie consent rules: ePrivacy and the EDPB
Consent before storing or reading anything on a device, unless it is strictly necessary - and a banner where refusing is as visible as accepting.
Short answerIn the EU, Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a visitor's device, unless it is strictly necessary for a service they asked for. The EDPB says this also covers tracking pixels, links and similar techniques, not just cookies. Consent must be a clear, freely given choice - which in practice means a reject option as easy to find as accept, and nothing pre-ticked.
What does the law require?
Article 5(3) of the ePrivacy Directive, implemented in each member state's law, requires consent for storing or accessing information on a user's device unless it is strictly necessary for a service the user explicitly requested. Where the information is personal data, the GDPR's standard of consent applies: freely given, specific, informed and unambiguous.
Is it only about cookies?
No. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) cover tracking pixels, tracking links, some uses of IP addresses, and other ways of reading information from a device (EDPB Guidelines 2/2023).
What do regulators expect from a banner?
The EDPB's cookie banner taskforce compared how national regulators assess banners (EDPB taskforce report, January 2023). Points it covers include a reject option at the same level as accept, pre-ticked boxes not counting as consent, and button designs that steer people away from refusing. National regulators apply these in their own guidance, so check the regulator for each country you target.
What about consent for advertising on Google?
Publishers showing Google ads to visitors in the EEA, the UK and Switzerland need a Google-certified consent platform integrated with the IAB Transparency and Consent Framework (Google Ad Manager Help). That is a separate requirement from the law itself. See Google-certified CMPs explained.
Where Sadang fits
With region detection switched on, a Sadang site can set default consent levels by region. Its banner shows Reject all next to Accept all, and it records each choice. It supports Google Consent Mode v2. It is not yet a registered IAB TCF CMP - see our TCF status.
This guide is general information, not legal advice. Laws and regulator guidance change; check the sources linked above and take advice on your own site.