Paper Self Assessment Return Deadline
ADA Website Accessibility Compliance Check
Why this matters.
Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended by Directive 2009/136/EC) says you may only store information on, or read information from, a user’s device with their prior consent, after giving clear and comprehensive information. The only exceptions are storage needed purely to carry a communication or that is strictly necessary to provide a service the user has explicitly asked for, such as a shopping basket or login session. Consent must meet the GDPR standard in Articles 4(11) and 7: freely given, specific, informed and an unambiguous positive action. In Planet49 (Case C-673/17, 2019) the Court of Justice held that pre-ticked boxes are not valid consent and that users must be told how long cookies last and whether third parties can access them. The EDPB’s Guidelines 2/2023 confirm the rule covers more than cookies, including tracking pixels, device fingerprinting and SDKs in apps.
Cookie banners are one of the most actively enforced areas of EU privacy law. National data protection and telecoms authorities have fined businesses for having no “reject” option on the first layer, for nudging design, for setting analytics or advertising cookies before consent, and for making withdrawal harder than giving consent, which breaches GDPR Article 7(3). Penalties are set under national ePrivacy laws and, for any related personal data processing, the GDPR (up to €20 million or 4% of global turnover under Article 83). Small online shops, agencies and freelancers building client sites are in scope just like large platforms, and a non-compliant banner is easy for a regulator or complainant to spot.
