ePrivacy Directive and Analytics: EU Cookie Rules That Still Apply

The ePrivacy Directive (officially Directive 2002/58/EC, amended by 2009/136/EC) is the EU law responsible for the cookie consent banners you see on virtually every European website. It requires informed consent before any non-essential information is stored on or accessed from a user's device.

While GDPR gets more attention, the ePrivacy Directive is actually the older law — and the more specific one when it comes to cookies. GDPR provides the general framework for data protection. The ePrivacy Directive adds specific rules about electronic communications, including cookies, tracking pixels, local storage, and device fingerprinting.

The key provision is Article 5(3): you must obtain consent before storing or accessing information on a user's terminal equipment, unless the storage is strictly necessary for providing the service the user requested.

Website owners often conflate these two regulations. Understanding the distinction is important for compliance.

The ePrivacy Directive has three major impacts on website analytics.

First, any analytics tool that sets cookies requires consent before loading. GA4, Adobe Analytics, Hotjar, and any cookie-based tool must wait for "Accept" before the tracking script fires. Visitors who reject or ignore the banner are invisible.

Second, the consent must be informed, specific, and freely given. Pre-checked boxes, implied consent, and "cookie walls" (blocking content until consent is given) have all been ruled non-compliant by EU courts.

Third, you must provide an easy way for users to withdraw consent at any time. Withdrawing must be as easy as giving consent.

Because the ePrivacy Directive is a directive (not a regulation), each EU member state transposes it into national law differently. This creates a patchwork of cookie rules across Europe.

France's CNIL has been the strictest enforcer, issuing tens of millions in fines to Google, Amazon, and Facebook for cookie violations. Germany, Italy, Spain, the Netherlands, and Belgium have all taken varying enforcement actions.

For website owners operating across the EU, the safest approach is to comply with the strictest interpretation (France/CNIL) or avoid cookies entirely.

The ePrivacy Directive governs "storing or accessing information on a user's terminal equipment." If your analytics tool stores nothing on the device — no cookies, no local storage, no fingerprinting — Article 5(3) does not apply.

This is not a loophole. It is the intended design. The ePrivacy Directive protects users from unwanted device access. If no device access occurs, no protection is needed.

Copper Analytics is cookieless by design. It uses non-identifying signals to count visitors. Nothing is stored on the visitor's device, so no ePrivacy consent is required in any EU member state.

What is the ePrivacy Directive?

EU Directive 2002/58/EC — the law that requires consent before setting cookies or accessing information on a visitor's device. It is the reason cookie consent banners exist on virtually every European website.

Is the ePrivacy Directive the same as GDPR?

No. GDPR governs personal data processing. The ePrivacy Directive governs device access (cookies, tracking pixels, local storage). Both apply simultaneously to websites with EU visitors — you must comply with both.

Do I need consent for Google Analytics under the ePrivacy Directive?

Yes. GA4 sets cookies (_ga, _gid) on visitor devices, which requires informed consent under Article 5(3) before the tracking script loads. You cannot use legitimate interest to bypass this requirement.

What is the ePrivacy Regulation (ePR)?

A proposed replacement for the ePrivacy Directive that would apply directly across all EU states (like GDPR) rather than requiring national transposition. It has been in negotiation since 2017 and remains stalled in EU trilogue as of 2026.

How do I comply with the ePrivacy Directive for analytics?

Two paths: implement a fully compliant consent banner and only load analytics after consent (which loses 20-40% of visitor data), or switch to a cookieless analytics tool like Copper Analytics that does not trigger Article 5(3) at all.