In short. The ePrivacy consent exemption covers storage or access used solely for transmission or strictly necessary to provide a service explicitly requested by the user.
Definition: Under ePrivacy Directive Article 5(3), technical storage or access is exempt from consent when its sole purpose is transmitting a communication over an electronic communications network, or when it is strictly necessary to provide a service the subscriber or user explicitly requests.
Key facts
- The ePrivacy Directive, Article 5(3), covers both storing information on a user's device and accessing information already stored there.
- The Article 29 Working Party's Opinion 04/2012 on Cookie Consent Exemption, adopted on 7 June 2012, assesses necessity from the user's perspective and requires every purpose of a multipurpose cookie to qualify separately.
- As of 17 October 2026, France's data protection authority, CNIL, lists trackers that remember users' cookie choices among exempt trackers in its cookie guidance.
Which cookies qualify for the transmission exception?
Article 5(3) of the Directive, consolidated to 19 December 2009, requires transmission to be the sole purpose of the technical storage or access. The Working Party opinion explains that merely speeding up or assisting a communication is insufficient: transmission must depend on the cookie.
Its example is a load balancing session cookie. Load balancing distributes requests among servers; the cookie identifies the server that must receive the same user's requests to maintain consistent processing. The opinion places this use within the transmission exception because it identifies a communication endpoint.
Which cookies are strictly necessary for a requested service?
The Working Party opinion applies two conditions: the user positively requests a defined service or functionality, and that functionality fails without the cookie. Its examples include:
- Shopping cart cookies that retain the items a user selects, and cookies that retain input across a form's pages.
- Authentication cookies that maintain access to authorised content during a session after login.
- Security cookies that detect repeated failed login attempts and protect the requested authentication service.
- Short term interface cookies that remember a language or search display preference explicitly selected by the user.
A session cookie expires when the browser closes. The opinion generally limits exempt authentication cookies to that session, while allowing security cookies a longer life where their protective purpose requires it. For language preferences, it treats retention beyond a session or a few additional hours as requiring additional information and consent.
How do purpose and lifetime affect the exemption?
The Working Party opinion makes the cookie's purpose and implementation the basis of the assessment. A cookie operated by the website itself, commonly called a first party cookie, still needs to satisfy an exemption criterion.
A cookie used both to remember preferences and to track behaviour qualifies only if each purpose independently qualifies. The opinion recommends separate cookies for separate purposes. It also requires an exempt cookie's lifetime to relate directly to its purpose and to end when it is no longer needed. For a shopping basket, it allows short persistence beyond the browser session to accommodate an accidental browser closure.
Related terms
- Does an AI referral change analytics cookie consent requirements?
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Can I treat every session cookie as exempt?
No. The Working Party opinion assesses the purpose and implementation of the cookie; session duration alone is insufficient. It excludes third party advertising cookies, including those used to limit how often an advertisement appears.
Does a persistent login cookie qualify automatically?
No. The same opinion distinguishes session authentication from login tokens retained across browser sessions. It describes an informed “remember me” checkbox as a way to obtain consent for persistent login.
Are audience measurement cookies always exempt?
No. The Working Party's assessment excludes first party analytics from its exemption criteria. In France, CNIL's guidance recognises an exemption for certain audience measurement trackers subject to conditions.
Sources
- EUR-Lex, "Directive 2002/58/EC", consolidated 19 December 2009
- Article 29 Data Protection Working Party, "Opinion 04/2012 on Cookie Consent Exemption", 7 June 2012
- CNIL, "Cookies et traceurs : que dit la loi ?", 29 September 2020
Check how a page reads to answer engines. Open the GEO score analyzer