# ePrivacy Essential Cookie Exemption Standards

## Primary Legal Framework

### ePrivacy Directive 2002/58/EC, Article 5(3)
- Consent required for storing/accessing information on user terminal equipment
- Exemption: storage "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to deliver the service"

### Directive 2009/136/EC (Citizens' Rights Directive)
- Amended Article 5(3) to require informed consent (not just opportunity to refuse)
- Recital 66: exemption limited to "strictly limited provision of an information society service explicitly requested"

## Authoritative Guidance

### Article 29 Working Party Opinion 04/2012 (WP 194)
- Title: "Opinion 04/2012 on Cookie Consent Exemption"
- Six exemption categories: user input (session), authentication, security, multimedia, load balancing, UI customisation (session)
- Two-part test: (1) strictly necessary AND (2) for service explicitly requested by user
- Remains authoritative despite Art. 29 WP being superseded by EDPB

### EDPB Guidelines 05/2020 on Consent
- Confirms analytics cookies require consent (not strictly necessary)
- Addresses cookie walls as generally non-compliant

## National DPA Positions

### UK ICO
- Consent cookie storing user's choice: strictly necessary
- Analytics: consent required under PECR Regulation 6
- A/B testing: consent required

### CNIL (France)
- Separate limited exemption for audience measurement (strict conditions)
- Consent cookie: strictly necessary
- Security cookies (CSRF): strictly necessary

### Belgian DPA
- Consent cookie: strictly necessary
- Essential session cookies: exempt