In short. Poland's Article 399 generally requires advance information and consent for device storage or access, with exceptions for transmission and requested services.
Definition: Article 399 of Poland's Electronic Communications Law generally requires advance information and consent before storing information on, or accessing information already stored on, a subscriber's or end user's device. It provides exceptions for storage or access necessary for transmission or a requested service.
Key facts
- As of 17 October 2026, Article 399(1) of the Electronic Communications Law requires information about the purpose and available storage or access settings, followed by consent.
- The European Data Protection Board's consent guidelines explain that consent requires a freely given, specific, informed and unambiguous indication of agreement through a statement or clear affirmative action.
- The Board's Cookie Banner Taskforce report calls for easily accessible withdrawal controls, such as a visible link or an icon, and assesses the solution case by case.
What information must come before consent?
Under Article 399(1)(1) of the Polish law, the subscriber or end user receives information beforehand in an unambiguous, easy and understandable form. It covers the purpose of storing and accessing the information. It also explains the possibility of determining storage or access conditions through settings in software installed on the device or through service configuration.
Article 399(1)(2) places consent after receipt of that information. For cookies covered by these conditions, a notice shown only after storage or access reverses the statutory sequence. Article 399(1)(3) adds that the stored information or access to it must cause no configuration changes in the end user's device and installed software.
Can browser settings or continued browsing express consent?
Article 399(2) of the Electronic Communications Law allows consent through installed software settings or service configuration. Article 400 applies personal data protection provisions, as appropriate, to obtaining the subscriber's or end user's consent.
The General Data Protection Regulation, abbreviated GDPR, supplies the consent standard explained in the EDPB's Guidelines 05/2020. The guidelines say browser settings used for consent should provide choices for each envisaged purpose and information naming the controllers, meaning the organisations responsible for the processing.
The same guidelines reject pre-ticked boxes and explain that continuing ordinary website use fails to express agreement to a proposed processing operation. Scrolling or swiping through a webpage also fails the clear affirmative action requirement.
When does Article 399 provide an exception?
Article 399(3) of the Polish law disapplies paragraph 1's conditions where storage or access is necessary to transmit an electronic communication through a public telecommunications network. It also covers storage or access necessary to deliver a telecommunications service or an electronically supplied service requested by the subscriber or end user.
The EDPB's Cookie Banner Taskforce report describes tools that list cookies placed during a visit, while requiring documentation from the website owner to establish their purposes. A scan alone therefore leaves the necessity assessment incomplete: the statutory test concerns what the storage or access is necessary to do.
Related terms
- Which website cookies fall within the ePrivacy consent exemption?
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Can you place every cookie before showing a notice?
Article 399(1) of the Electronic Communications Law requires advance information followed by consent. Storage or access meeting a necessity exception under Article 399(3) falls outside those paragraph 1 conditions.
What evidence can you retain for consent?
The EDPB's consent guidelines give an online example combining information about the session in which consent occurs, documentation of the consent workflow and a copy of the information presented at that time.
Must you use a floating withdrawal icon?
The EDPB's Cookie Banner Taskforce report allows different accessible solutions, including a visible link. It says authorities cannot impose one particular withdrawal solution; withdrawal must remain available at any time and be as easy as giving consent.
Sources
- Sejm of the Republic of Poland, "Prawo komunikacji elektronicznej", 12 July 2024
- European Data Protection Board, "Guidelines 05/2020 on consent under Regulation 2016/679", 4 May 2020
- European Data Protection Board, "Report of the work undertaken by the Cookie Banner Taskforce", 17 January 2023
Check how a page reads to answer engines. Open the GEO score analyzer