The ePrivacy Directive and Cookie Consent
Article 5(3) of the ePrivacy Directive requires consent before setting tracking cookies and pixels. Which affiliate technologies are covered, and how it works with GDPR.
The ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC) is the EU law that governs cookies and similar tracking technologies. It works alongside the GDPR: the ePrivacy Directive sets the rule that consent is required to store or read information on a device, and the GDPR defines what valid consent means.
Article 5(3): the consent rule
Article 5(3) requires prior informed consent before storing information, or gaining access to information already stored, on a user’s terminal equipment — the technical description of setting or reading a cookie. The only exceptions are cookies that are strictly necessary to deliver a service the user explicitly requested, or that carry out the transmission of a communication.
Which affiliate technologies are covered
- Affiliate tracking cookies — covered; consent required.
- Analytics cookies — generally covered; the “strictly necessary” exemption is read narrowly.
- Advertising and retargeting pixels — covered; consent required.
- Session cookies for a shopping cart the user is actively using — typically exempt as strictly necessary.
“Similar technologies” are included
The rule is not limited to cookies. Tracking pixels, device fingerprinting, local storage, and SDK identifiers used for affiliate attribution or advertising are all captured by the same consent requirement.
The relationship to the GDPR
When affiliate tracking also processes personal data — which it usually does — GDPR obligations apply in parallel: you need a lawful basis, a transparent privacy notice, and you must honor data subject rights. In the cookie context, that lawful basis is consent, held to the GDPR standard described in GDPR and affiliate cookies.
A future ePrivacy Regulation
The EU has long discussed replacing the ePrivacy Directive with an ePrivacy Regulation that would harmonize the rules across member states. As of 2026 it has not been adopted, so the Directive — as implemented in each country’s national law — remains the operative framework. Monitor developments, but comply with the current consent rules now.
Authoritative sources
Last reviewed July 2026. This page is general educational information, not legal or tax advice.