Which cookies need consent under EU law: a developer guide for 2026

Under EU law you need consent before you store or read anything on a visitor's device, unless it's strictly necessary for something the visitor asked for or it's needed only to carry the communication itself. In practice that means login sessions, shopping carts, load balancer pins and security cookies can run without a banner, while analytics, advertising, social tracking and "remember me" logins need a clear opt-in first. The rule is Article 5(3) of the ePrivacy Directive, and it covers far more than cookies.

The test is the purpose of each piece of stored data, not its name, its lifetime or which library sets it. Two cookies with the same format can land on opposite sides of the line.

Common cookies and consent at a glance

The cookie rows follow the Article 29 Working Party's Opinion 04/2012 on the cookie consent exemption. The EDPB's 2024 guidelines leave the exemptions to a case-by-case assessment under each country's law and its data protection authority's guidance, so check the rules of the countries you serve.

What Article 5(3) says

Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, allows storing information on a user's device, or reading information already there, only with informed consent. It gives two exemptions:

• Transmission only. The storage or access serves the sole purpose of carrying out the transmission of a communication over a network. Speeding up or regulating a transmission isn't enough; the communication must be impossible without it.
• Strictly necessary. It's strictly necessary to provide a service the user explicitly requested. Opinion 04/2012 splits this into two tests, judged from the visitor's side: the user asked for a specific feature, and the feature won't work if cookies are off.

It isn't only about cookies

The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), final version adopted 7 October 2024, spell out how wide the rule reaches. A few points matter for everyday web code:

• Information, not personal data. The article speaks of "information", so it applies even when nothing stored identifies a person.
• localStorage and sessionStorage. Data your scripts keep inside the browser and never send anywhere isn't "access" in the meaning of the article. Once that data, or anything derived from it, leaves the device, Article 5(3) applies.
• Your own JavaScript. Code that tells the browser to send information from the device to a server, for example with an asynchronous request, counts as gaining access.
• Pixels and tracking links. Tracking pixels in pages and emails, and identifiers appended to URLs, fall under the article. Delivering them counts as storage, at least through the browser cache.
• IP-only and fingerprint tracking. Tracking that relies on the IP address can fall under the article when the address comes from the visitor's device, and the EDPB includes HTTP headers, ETags and HSTS when they are used to collect information.

Falling under Article 5(3) doesn't mean you always need consent. It means you need consent or a valid exemption, assessed purpose by purpose.

What a valid consent looks like

Consent for cookies follows the GDPR standard, and the EDPB's Guidelines 05/2020 on consent rule out several common banner patterns:

• No cookie walls. Blocking content until the visitor clicks "Accept cookies" means the consent isn't freely given.
• No scrolling as consent. Scrolling or swiping through a page never counts as a clear affirmative action.
• No pre-ticked boxes. Opt-out designs where the visitor must act to refuse aren't valid consent.
• Withdrawal as easy as agreement. If one click gives consent, one click must take it back. Keep a link to the settings in your footer.
• Nothing before the choice. Don't load tags or set non-exempt cookies until the visitor has agreed.

A single banner that covers several purposes is fine. Opinion 04/2012 says you don't need one consent request per cookie when one clear point of information covers them all.

What to check in your own app

• List what your app stores. Open the browser's storage panel on a fresh profile, load every page type, and write down each cookie, storage key and outgoing request, with who sets it and why.
• Split cookies by purpose. A cookie that serves several purposes is exempt only if every purpose is. One ID used both for preferences and for tracking needs consent, so give each purpose its own cookie.
• Match lifetimes to purpose. An exempt cookie should expire once it isn't needed. A session cookie that quietly lives for a year is hard to defend.
• Audit third-party scripts. Chat widgets, video embeds, fonts, maps and payment scripts can all set cookies or send identifiers. Load them only after consent unless they're strictly needed for the feature the visitor is using.
• Store the visitor's choice. Keep a record of what was agreed and when, so you can show it later and stop loading tags at once if the visitor withdraws.

How to reduce the need for a banner

Many apps can do without a banner by keeping only exempt storage: server-set session cookies, cart and form state, and security cookies. The usual blockers are analytics and marketing tags. A cookie-free analytics tool, compared in Google Analytics alternatives in Europe, removes the most common one, though you still need to check what it sends and how your national authority treats it.

Cookies on Eurobase

Whether your app needs a banner is your call, not your host's. What the host can change is which cookies reach your server. Eurobase, a business registered in Warsaw, Poland, hosts apps on European infrastructure run by Scaleway, a French provider. On a shared <project>.eurobase.dev address, it handles cookies like this:

• Cookies your server sets come back to it, as long as browser code doesn't change them. Eurobase strips their Domain attribute, so they stay on your address, and adds one HttpOnly __Host-eurobase-c. cookie beside each as proof that your app set it. Your code never sees that proof cookie.
• Cookies your browser code writes reach your server only when their names start with __Host-js- and they're written with Secure and Path=/. If your consent banner stores the visitor's choice in the browser and your server needs to read it before loading tags, name it accordingly, for example __Host-js-consent.
• Eurobase doesn't log cookie names or values.

The cookies in your app page lists the libraries that need a change and why. Eurobase's own website and dashboard use only essential first-party cookies and set no analytics or advertising cookies, as its cookie notice states.

For the wider picture, see the GDPR hosting checklist and data residency versus data sovereignty.

Frequently asked questions

Do strictly necessary cookies need a banner?

No. The two exemptions in Article 5(3) cover both consent and the duty to inform under the ePrivacy Directive. If those cookies hold personal data, the GDPR's transparency duties still apply, so list them in your privacy policy or a cookie notice linked from the footer.

Is first-party analytics exempt from consent?

Not under the EU directive as the Article 29 Working Party read it in 2012. It found first-party analytics low risk when limited to aggregated statistics with an opt-out and anonymised IPs, but not strictly necessary for the visitor. National laws and authority guidance can differ on this point, so check the rules of each country you serve.

Does localStorage need consent?

Only when its contents, or something derived from them, leave the device. A theme setting read by your own script stays outside Article 5(3); a visitor ID saved in localStorage and sent with every request falls under it, and then needs consent or an exemption.

Can I block my site until visitors accept cookies?

No. The EDPB treats a cookie wall that blocks content until the visitor accepts as consent that isn't freely given, so it isn't valid consent.

Does a "remember me" login need consent?

Yes, unless it ends with the browser session. Opinion 04/2012 says persistent login cookies aren't exempt, and that a "remember me (uses cookies)" checkbox next to the login form is a fitting way to ask.

Sources

• Directive 2002/58/EC (ePrivacy Directive), consolidated text
• EDPB Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0
• EDPB Guidelines 05/2020 on consent under Regulation 2016/679
• Article 29 Working Party Opinion 04/2012 on Cookie Consent Exemption (WP 194)
• Eurobase: Cookies in your app, Cookie notice