European UnionCookie Directive
Officially ePrivacy Directive, Storage of and Access to Information on Terminal Equipment
Also known as ePrivacy Directive, Cookie Law.
Directive 2002/58/EC, Art. 5(3)
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
What it requires
- Obtain the user's or subscriber's consent, after giving them clear and comprehensive information about the purposes of the processing, before storing information on their device or accessing information already stored there (cookies, local storage, or any comparable technique that stores information on the device or reads information already stored there), whether or not that information is personal data.
- You do not need consent for storage or access that is strictly technical for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or strictly necessary for an information-society service the user explicitly requested.
These lines are LexLint's reading of the law's text. Also read by: C-673/17 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Criminal exposure note
Article 15a(1) requires Member States to lay down penalties 'including criminal sanctions where appropriate' for an infringement of any provision adopted under this Directive, but the Directive itself does not make a breach a criminal offence; whether an Article 5(3) infringement is prosecuted as a crime is entirely a matter for each Member State's own transposing law.
Who enforces it
Enforcement body
Each Member State's own competent national authority and, where relevant, other national bodies designated under Article 15a(2) to (4). The Directive has no clause for Article 5 like Article 13(6)'s express right to bring proceedings, but Article 15(2) applies the judicial remedies, liability and sanctions chapter of Directive 95/46/EC to every national provision adopted under the Directive and to the individual rights derived from it.
Settledness
Planet49 settled whether a pre-ticked checkbox can be valid consent and whether the personal-data character of the stored information matters; it did not address which further techniques the Article reaches, and whether device fingerprinting, or server-side tracking that stores nothing on the device, falls within it turns on whether the technique stores information in, or gains access to information already stored in, the terminal equipment. The proceedings in which the Court ruled were between a federation of consumer organisations and Planet49 GmbH.
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Case citation
- C-673/17
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 80/2003
- Source link
- https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:22003D0080
- Decision date
What this law does
Article 5(3), as rewritten by Directive 2009/136/EC, requires that storing information, or gaining access to information already stored, in a subscriber's or user's terminal equipment is allowed only where the subscriber or user has given consent after being provided clear and comprehensive information about the purposes of the processing, with an exemption for storage or access that is strictly technical to carry a communication or strictly necessary for an information-society service the user explicitly requested.
The Court of Justice held in Planet49 (C-673/17) that a pre-ticked consent checkbox the user must deselect to refuse does not satisfy this Article, that the rule applies whether or not the stored or accessed information is personal data, and that the information a service provider must give before consent includes the duration cookies will operate and whether third parties can access them.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app tracks devices.
Back to the example · Lint your app
Page updated .