What Article 5(3) requires

Two things. Before a site places or reads anything on a visitor’s device, it needs the visitor’s consent, and that consent has to meet the GDPR’s standard: freely given, specific, informed, and unambiguous. The consent has to come first, before the cookie or tag acts.

There is one exception. Storage or access that is “strictly necessary” for a service the visitor explicitly requested does not need consent. A cookie that keeps a shopping cart or a login session is strictly necessary. An analytics or advertising cookie is not, so it needs consent.

ePrivacy or GDPR: which governs cookies?

Both, in sequence. The ePrivacy Directive decides whether you may place a cookie or fire a tag at all, and it says you need consent first. The GDPR then governs any personal data that tag goes on to process, including what counts as valid consent and what your basis is. When they overlap, the specific rule, ePrivacy, sets the consent-before-access requirement, and the GDPR fills in the standard for that consent.

What is changing: the Digital Omnibus

The rules are set to move, though not yet. The long-stalled ePrivacy Regulation, which was meant to replace the Directive, was formally withdrawn in 2025 (notice published 6 October 2025). The Directive still applies. Separately, the Commission proposed the EU Digital Omnibus on 19 November 2025. It would move the cookie-consent rule, where personal data is involved, into a new GDPR Article 88a, and add a GDPR Article 88b on machine-readable browser choices.

As of September 2026 it is still a proposal and has not been adopted, so none of it is in force. Today’s rule remains Article 5(3): consent before access.

How to comply and verify

Compliance under the current rule comes down to behavior: nothing non-essential stores or reads on the device before the visitor consents, and a refusal is honored. That is testable. DataTrue loads your site in a real browser, in each consent state, and records what is set and sent before consent, so you can confirm that only strictly necessary cookies and tags act ahead of a choice, and that everything else waits. If the Digital Omnibus becomes law, the prominence-of-reject and honor-the-signal requirements it proposes are the same kind of behavior a test can verify.

This law is part of our EU website tracking compliance hub.