In this guide
- The ePrivacy Directive (Article 5(3)) requires consent to store or read information on a device, unless it is strictly necessary.
- GDPR sets what valid consent means and governs the personal data you collect with the cookie.
- Consent must be informed, specific, freely given and active. Pre-ticked boxes and continued scrolling do not count.
Cookie rules confuse people because two laws apply at the same time. This page explains how they fit together in plain language, which cookies are exempt and what a compliant set-up looks like. It is general information and not legal advice. National regulators apply the rules in slightly different ways, so check the guidance of the authority in each country where you sell. For the technical side see tracking cookies, Consent Mode v2 and server-side tracking and GDPR.
Two laws, two questions
| Law | Question it answers | Typical answer for marketing cookies |
|---|---|---|
| ePrivacy Directive, Article 5(3) | May you store or read information on the visitor's device? | Only with consent, unless strictly necessary |
| GDPR | May you process the personal data you collect with it, and on what basis? | You need a lawful basis, usually consent for advertising |
3 things to remember
Scroll and the points stack up.
The ePrivacy Directive (Article 5(3)) requires consent to store or read information on a device, unless it is strictly necessary.
GDPR sets what valid consent means and governs the personal data you collect with the cookie.
Consent must be informed, specific, freely given and active. Pre-ticked boxes and continued scrolling do not count.
What valid consent looks like
- Informed. People are told who, what and why before choosing.
- Specific. Separate choices for separate purposes (analytics, advertising).
- Freely given. No cookie wall that forces consent for basic access, in most regulators' view.
- Unambiguous and active. A clear action. Pre-ticked boxes are not valid, as the EU Court of Justice held in the Planet49 case in 2019.
- As easy to withdraw as to give. Many regulators also expect rejecting to be as easy as accepting.
Which cookies are exempt
Strictly necessary cookies need no consent: a shopping cart, a login session, load balancing, a cookie that remembers the consent choice itself. Analytics cookies are not exempt in most countries, though a few regulators allow limited, privacy-friendly analytics without consent under conditions. Advertising cookies always need consent. When in doubt, ask whether the visitor would be surprised or whether the service works without it.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
Lifetimes and retention
Some regulators give numbers. For example, France's regulator suggests cookies should last no longer than 13 months and the data they produce no longer than 25 months. Check your own regulator's current guidance. Browsers cap lifetimes too: Chrome limits any cookie to 400 days. See extending cookie lifetime.
Records and notices
Common mistakes
A realistic example
A shop audits its cookies and finds 23 of them. Six are strictly necessary: cart, session, consent, security and load balancing. Eight are analytics, six are advertising and three belong to a chat widget nobody uses any more. The shop deletes the chat widget, groups the rest into two purposes in its banner, adds a reject option equal in prominence to accept, makes every analytics and advertising tag wait for consent, and publishes a cookie notice with each cookie, its owner and its lifetime. The work takes a few days. The result is a banner that does what it says, a notice that matches the site, and a record the shop can show if anyone asks.
Do this review at least once a year. Cookie lists grow quietly, and a notice that was right last year is often wrong today.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Frequently asked questions
What is the ePrivacy Directive?
An EU directive whose Article 5(3) requires consent to store or read information on a device unless it is strictly necessary.
Is GDPR the same as the cookie law?
No. The cookie rule comes from the ePrivacy Directive. GDPR sets the consent standard and governs the personal data.
Do analytics cookies need consent?
In most countries, yes. A few regulators allow narrow exceptions for privacy-friendly analytics.
Are pre-ticked boxes valid consent?
No. The EU Court of Justice held in 2019 that they are not.
Do server-set cookies need consent?
Yes, if they are not strictly necessary. The law follows the purpose, not who writes the cookie.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 5 min read
