Before you read
This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.
EU cookie rules (ePrivacy)
Sources last checked:
Cookies are governed mainly by the ePrivacy Directive, not the GDPR. A directive has to be written into each country’s own law, so the details vary from country to country.
The rule
Storing information on a person’s device, or reading what is already there, is allowed only with that person’s consent, after clear and comprehensive information. It is not limited to cookies: the rule covers any information on the device.1
The exceptions
No consent is needed where the only purpose is to carry a communication over a network, or where it is strictly necessary for a service the user explicitly asked for.1
Germany
Germany’s version, section 25 of the TDDDG, sets out the same rule and the same two exceptions, and requires the information and consent to meet GDPR standards.2
What may change
The Digital Omnibus would change these rules.