Under ePrivacy Art. 5(3) and GDPR consent rules, what must a news publisher's cookie banner do before setting non-essential cookies?

## Two instruments, one consent standard A cookie banner sits where two EU instruments meet: - The **ePrivacy Directive**, Directive 2002/58/EC as amended by Directive 2009/136/EC, whose `Art. 5(3)` governs **storing and reading information on a user's device**. As a directive, it applies through each Member State's national implementing law. - The **GDPR**, Regulation (EU) 2016/679, which supplies the **standard of consent** and governs the **later processing** of any personal data collected. The link is textual. The ePrivacy Directive defines consent by reference to the data subject's consent in Directive 95/46/EC (`Art. 2(f)`), and `Art. 94(2)` GDPR says references to the repealed Directive are to be construed as references to the Regulation. EDPB Guidelines 05/2020 confirm that the GDPR conditions for valid consent apply in situations within the scope of the ePrivacy Directive. ## What Art. 5(3) requires `Art. 5(3)` requires Member States to ensure that *the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that* the user *has given his or her consent, having been provided with clear and comprehensive information*, in particular about the purposes. Three features matter: - **Any information.** The rule speaks of *information*, not personal data. A cookie, a local-storage key or a device-fingerprinting read is caught whether or not the data identify anyone. - **Prior consent.** Consent must come before the storage or access, so non-essential cookies cannot be set on page load and "consented" afterwards. - **Two exemptions.** No consent is needed for technical storage or access *for the sole purpose of carrying out the transmission of a communication*, or *as strictly necessary* for an information society service *explicitly requested* by the user. ## Sorting a publisher's cookies | Cookie purpose | Consent under Art. 5(3)? | |---|---| | Load balancing to deliver the requested page | No: strictly necessary for transmission or the requested service | | Remembering the reader's cookie choice itself | Generally treated as strictly necessary to honour that choice | | Session cookie for a logged-in subscriber | No, for the subscription service the reader requested | | Audience analytics | Yes | | Advertising and cross-site tracking | Yes | | Social media embeds that read or write identifiers | Yes | ## What a valid banner looks like Because the consent is GDPR consent, the banner must meet `Art. 4(11)` and `Art. 7`: 1. **Nothing non-essential before the choice.** Analytics and advertising cookies wait for consent. 2. **An active choice.** No pre-ticked boxes: Recital 32 excludes them, and in **Planet49 (case C-673/17)** the CJEU held that a pre-ticked checkbox does not give valid consent to cookies. EDPB Example 16 says **scrolling or swiping** never counts as a clear affirmative action. 3. **Informed.** Who sets the cookies, for what purposes, and that consent can be withdrawn. 4. **Specific and granular.** Separate choices for distinct purposes such as analytics and advertising (Recital 43; EDPB paras. 42-44). 5. **Refusable without detriment.** Recital 42 and EDPB para. 46 require that the person can refuse without detriment. A design where accepting takes one click and refusing takes several screens is hard to reconcile with freely given and unambiguous consent. 6. **Withdrawable as easily.** `Art. 7(3)`: a persistent control lets the reader change the choice as easily as they made it. 7. **Recorded.** `Art. 7(1)` requires the publisher to demonstrate consent. ## Cookie walls A **cookie wall** blocks content until the reader accepts cookies. EDPB Guidelines 05/2020 say that, for consent to be freely given, access to services and functionalities *must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored* in the terminal equipment (para. 39). Example 6a describes a script blocking all content except an "Accept cookies" button and concludes the consent is not freely given (paras. 40-41). `Art. 7(4)` and Recital 43 support the same outcome. ## After the cookie is set `Art. 5(3)` governs the storage and access. What the publisher then does with personal data read from the device, such as building advertising profiles, is **processing under the GDPR**, with the GDPR's requirements for that processing. ## Common mistakes - Setting analytics cookies on first load and asking afterwards. - Treating "by continuing to browse you accept" as consent. - Assuming cookies holding no personal data are outside `Art. 5(3)`. - Burying "reject" behind a settings page while "accept" is one click. - Treating all first-party cookies as strictly necessary.