A compliant-looking banner can still fail if analytics or advertising code runs before the choice. Start with the browser’s actual behaviour.
Article 5(3) of the ePrivacy Directive concerns storing information on, or accessing information from, terminal equipment. It is not limited to cookies. National law and supervisory guidance determine the local implementation. If personal data is also processed, the GDPR applies alongside it.
1. Inventory every terminal operation
Use a fresh browser profile and inspect:
- first-party and third-party cookies;
- local and session storage;
- IndexedDB and cache identifiers;
- pixels, SDKs, tag managers, embedded media, and chat;
- browser or advertising identifiers;
- fingerprinting inputs; and
- requests fired before, during, and after a preference change.
Repeat the scan on landing pages, checkout, authentication, embedded content, and authenticated screens. Note the name, provider, value, purpose, lifetime, domain, trigger, and data sent.
2. Classify necessity narrowly
The Article 5(3) exception covers operations solely used to transmit a communication or strictly necessary to provide a service explicitly requested by the user. A feature being useful, popular, or mentioned in the terms does not make it strictly necessary.
| Example | Review question |
|---|---|
| Session authentication | Is it needed to keep the requested signed-in session? |
| Basket state | Is it needed for the shopping function the visitor requested? |
| Audience analytics | Can the requested page work without this measurement? |
| Advertising profile | Is it separate from delivering the page? |
| Embedded video | Can it be held behind a user action or privacy mode? |
Record the reasoning. Do not classify a whole vendor as necessary when only one operation may qualify.
3. Design a valid choice
Where consent is required, the EDPB consent guidelines require a freely given, specific, informed, and unambiguous action.
The first layer should:
- identify the controller;
- explain purposes in plain language;
- offer accept and reject with comparable prominence;
- avoid preselected non-essential categories;
- link to granular settings and fuller information; and
- keep the requested service available where consent is not necessary for it.
In Spain, the AEPD’s Guide on the Use of Cookies is the relevant national starting point.
4. Block before choice
Make consent state the dependency for each non-essential tag:
type Consent = {
analytics: boolean;
advertising: boolean;
};
function applyConsent(consent: Consent) {
if (consent.analytics) loadAnalytics();
if (consent.advertising) loadAdvertising();
}This snippet only illustrates the gate. Production code also needs an initial unknown state, race-condition protection, vendor consent signals, revocation, and deletion or expiry handling. A tag manager must not bypass the gate.
5. Record and honour the choice
Keep evidence of the notice version, categories offered, affirmative action, timestamp, and preference state. Avoid adding identifiers to the consent record unless necessary.
Provide a persistent settings link. On withdrawal, stop future non-essential access and send any supported withdrawal signals to vendors. Explain what can and cannot be removed retrospectively.
6. Test releases
Automate at least these cases:
- fresh visitor before interacting;
- reject all;
- accept one category;
- accept all;
- withdraw one category;
- notice-version change;
- expired preference;
- JavaScript failure; and
- embedded third-party content.
Capture network requests and storage, not just pixels on screen. Re-run the inventory whenever a dependency or tag changes.
GDPR.Direct drafts privacy and cookie documents. It does not scan a site, block tags, store consent, or operate a consent-management platform. Connect its document output to a separately tested technical control.
This guide is educational information, not legal advice. Confirm national requirements with a qualified reviewer before release.