Skip to content
Guide

Cookie Consent and ePrivacy for EU Online Shops

By Compliance Editorial Team Updated July 5, 2026 4 min read

Almost every online shop stores or reads something on the visitor’s device, from the contents of a cart to an analytics identifier. EU law treats those two examples very differently. This guide explains when you need consent for cookies, which cookies are exempt, and how to build a cookie banner that is both compliant and usable. It is written for shop owners rather than lawyers, but the underlying rules come from the ePrivacy Directive and the GDPR.

The two laws that govern cookies

Cookie rules in the EU come from two sources working together. The ePrivacy Directive 2002/58/EC, as amended, sets the rule that storing or reading information on a user’s device generally needs consent. The General Data Protection Regulation then defines what valid consent looks like: it must be freely given, specific, informed, and unambiguous. In short, ePrivacy says “you need consent”, and the GDPR says “here is the standard that consent must meet”.

Which cookies need consent

The key distinction is between non-essential and strictly necessary cookies. Storing or reading non-essential cookies requires the user’s prior, informed, freely-given consent. That category covers analytics, advertising, and some functional cookies that are not needed to deliver the service the user asked for.

By contrast, strictly necessary or essential cookies are exempt and do not need consent. These are the ones without which the service simply cannot work, such as the cookie that remembers the cart, cookies used for security, and load-balancing cookies. The test is not whether a cookie is useful to you, but whether it is necessary to provide the service the visitor explicitly requested.

  • Consent needed: analytics, advertising and retargeting, and non-essential functional cookies.
  • Exempt: the cart, authentication and security, and load balancing.

What “prior” and “informed” mean in practice

Prior means before the cookie is set. You should not drop analytics or advertising cookies the moment the page loads and ask for permission afterwards. Non-essential scripts should wait until the user has made a choice. Informed means the user understands what they are agreeing to: what the cookies do, who sets them, and roughly how long they last, in plain language rather than dense jargon.

Making refusal as easy as acceptance

A fair banner treats “no” as seriously as “yes”. Consent must be as easy to refuse as to accept, which rules out a bright “Accept all” button paired with a hard-to-find or multi-step “Reject”. If you offer accept, offer an equally prominent reject at the same level. And consent must be a positive action, so no pre-ticked boxes: silence, inactivity, or a pre-selected option does not count as agreement.

Building a compliant banner

A workable cookie banner for a shop tends to share a few features.

  • A short, clear explanation of what cookies you use and why.
  • Equally prominent options to accept or reject non-essential cookies.
  • Granular controls, so the user can accept analytics but decline advertising, for example.
  • No cookies in the non-essential categories firing before a choice is made.
  • A simple way to change the choice later, and a record of the consent given.

Don’t forget the essentials-only case

Even a shop that uses only essential cookies benefits from a short cookie notice. You may not need a consent banner if nothing non-essential is set, but a brief, honest statement of what you store and why builds trust and answers the question before a shopper has to ask it.

A quick self-audit

Before you rely on any banner, list every cookie and script your shop actually loads, including those added by modules, themes, and third-party embeds. Sort each into essential or non-essential, and confirm that nothing in the non-essential list fires before consent. Many shops discover an analytics tag or a social widget loading too early, which is exactly the kind of thing an audit catches.

Consent must be as easy to refuse as to accept, and it can never be assumed from a pre-ticked box.

For related reading, browse our compliance tools to help map what your shop stores. You can also explore the wider set of EU laws we cover for online shops.

This article is educational and does not constitute legal advice.