ePrivacy Directive requirements
The ePrivacy Directive is the European rule that governs cookies and every other technology that stores or reads information on a user's device. Article 5(3) requires prior, informed consent before any such storage or access, with an exception only for what is strictly necessary to deliver a service the user requested. Each member state implements it through national law and its own regulator, which is why cookie enforcement comes from the CNIL in France, the Garante in Italy, or the Datatilsynet in Denmark rather than from a single EU body. The CNIL alone has fined Google, Meta, Microsoft, and others more than €400 million for consent-banner defects. A proposed ePrivacy Regulation to replace the directive was withdrawn in 2025, so the directive stays in force. The test it imposes is technical: did anything write to or read from the device before the user said yes?
ePrivacy Directive articles and analysis
Cookie Compliance in 2026: Why Consent Banners Don’t Prevent Enforcement Actions
Consent banners alone do not guarantee cookie compliance. Regulators now focus on actual third-party data flows, tracking pixels, cookie syncing, fingerprinting, and unauthorized data sharing....
Read More
The Privacy Laws That Can Send Executives to Prison
Executives face criminal liability under global privacy laws, including prison sentences in the U.S., EU, and beyond. This guide breaks down where the risk exists...
Read More
Server-Side Fingerprinting Explained: How Tracking Works Without Cookies
Server-side fingerprinting links user sessions even when browser signals change. This post explains how it works, why traditional defenses fail, and the risks it creates...
Read More
What Changed in GDPR Enforcement in 2025? How Regulators Shifted from Policy Audits to Operational Accountability
By 2025, European regulators made a clear shift in approach: compliance is no longer judged by the wording of a privacy policy, but by the...
Read More
What Is Device Fingerprinting and Why Can’t Your Consent Tool Stop It?
A report out of Carnegie Mellon’s School of Public Policy found that “87% (216 million of 248 million) of the population in the United States...
Read More
What Is Tag Piggybacking and How Does It Create Privacy Compliance Risk?
Your enterprise website is connected to a massive, constantly changing, interconnected, and partially hidden ecosystem of JavaScript tags. Often piggybacked to each other, these tags...
Read More
Does Your Consent Management Platform Work the Same in Every Country?
As various countries and states develop their own privacy laws, one-size-fits-all consent management solutions aren’t always enough. As a result, enterprise websites have begun tailoring...
Read More
Can iFrames Place Cookies on Your Site Without User Consent?
If your site streams video or audio content, displays social feeds, serves up dynamic maps, news, ads or data, then it likely uses iframes. Most...
Read More
What Are ETags and How Can Third-Party Vendors Use Them to Track Your Users?
Third-party cookies are on their way out, but does that mean tracking users will also crumble (see what I did there?). Probably not. There are...
Read More
Other International Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.