ePrivacy cookie consent: Article 5(3) explained

What Article 5(3) requires

All points below come from the consolidated text of Directive 2002/58/EC dated 19 December 2009, which is the version containing the consent requirement.

• Storing information, or gaining access to information already stored, on a subscriber's or user's terminal equipment is allowed only if that person has given consent. Article 5(3)
• The consent must come after the person has been given clear and comprehensive information. Article 5(3)
• Exception one: technical storage or access whose sole purpose is carrying out the transmission of a communication over an electronic communications network. Article 5(3)
• Exception two: storage or access that is strictly necessary for the provider to deliver a service the subscriber or user explicitly requested. Article 5(3)

One directive, many national laws

A directive is not applied directly. Each EU member state puts it into effect through its own national law, so the wording and the way it is enforced differ from country to country. Check the law of each country where you operate. This page does not describe any national rules.

Questions to ask about each cookie

Article 5(3) gives you a simple test to run on every cookie or similar technology your site uses. Work through these questions for each item your scan finds, and record your answer so you can revisit it when your site changes.

• Does it store information on the visitor's device, or read information already stored there? If so, Article 5(3) applies.
• Is its sole purpose carrying out the transmission of a communication over an electronic communications network? If yes, the first exception may apply.
• Is it strictly necessary for you to deliver a service the visitor explicitly asked for? If yes, the second exception may apply. "Useful" or "helpful" is not the same as strictly necessary.
• If neither exception applies, have you given the visitor clear and comprehensive information about it, and asked for consent before it runs?
• Have you checked how the country you operate in applies this rule in its own national law?

How CookieJar handles it

CookieJar gives you tools to hold back non-essential cookies until a visitor agrees and to keep a record of that choice. CookieJar is software, not legal advice.

• Blocks non-essential scripts before consent. Known trackers found by your site scan do not run until the visitor allows their category, so they cannot set cookies before the visitor chooses.
• Per-category choices. Visitors decide separately on preferences, analytics and marketing, and only the categories they allow are loaded.
• Consent receipts with a timestamp. Every choice is recorded with the categories selected and the time it was made.

Step-by-step setup

Follow these steps to put a consent banner in front of non-essential cookies.

1. Create a CookieJar account and add your domain.
2. Run a scan to list the cookies and scripts your site loads.
3. For each item, decide whether it falls within one of the two exceptions. If it does not, place it in a consent category.
4. Write banner text that clearly explains what each category is used for, so consent follows clear and comprehensive information.
5. Paste the CookieJar script tag into your site's <head> and publish.
6. Open your site in a private window and confirm that no non-essential scripts load before you make a choice.
7. Check the national law of each country where you operate, and adjust your banner settings if needed.

Common mistakes

These follow from the wording of Article 5(3).

• Setting analytics or marketing cookies on page load, before the visitor has chosen. Article 5(3) requires consent first.
• Asking for consent without explaining what the cookies do. Consent must follow clear and comprehensive information.
• Labelling everything as necessary. The exceptions cover only transmission of a communication and what is strictly necessary for a service the user explicitly requested.
• Citing the original 2002 wording. The consent requirement is in the text as amended, consolidated on 19 December 2009.
• Assuming one rule fits every EU country. Each member state applies the directive through its own law.