The rule.
“is only allowed on condition that the subscriber or user concerned has given his or her consent”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- Consent, after clear and comprehensive information including the purposes, before storing information on, or reading it from, the user's terminal equipment.
- Two exemptions only: storage or access solely to transmit a communication, and storage or access strictly necessary for a service the user explicitly requested. Analytics and advertising tags are neither.
Who it applies to.
Any website or app storing or accessing information on a user's device — cookies, pixels, SDKs, local storage — for users in the EU. Applies through national law.
Common violations in marketing copy.
Ad pixel and analytics tag fire before the banner is answered
Information is stored or read before consent.
'We use cookies. OK'
No real choice and no purpose information.
Non-compliant vs compliant.
“By continuing to browse you accept all cookies.”
“We'd like to use analytics and advertising cookies to measure campaigns. [Accept] [Reject] [Choose] — nothing loads until you choose.”
Related rules.
-
GDPR Article 4(11) · European Union
-
GDPR Article 7(3) · European Union
-
ePrivacy Directive Article 13(1) · European Union
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Directive 2002/58/EC (ePrivacy Directive), consolidated version of 19.12.2009 |
|---|---|
| Provision | ePrivacy Directive Article 5(3) |
| Primary source | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219 |
| Read from | EUR-Lex consolidated text |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.