← Back to Blog DSGVO

Cookie Consent: When Art. 5(3) ePrivacy Actually Requires User Permission

· 3 min read
Cookie Consent ePrivacy EDPB Art. 5(3) Technische Notwendigkeit

The widespread assumption that Article 5(3) of the ePrivacy Directive (2002/58/EC) requires consent for all cookies leads to unnecessary consent banners and legal uncertainty. A precise analysis of the exceptions in Article 5(3), second sentence reveals: many technically necessary cookies require no consent – if implemented correctly.

Exceptions Under Article 5(3), Second Sentence ePrivacy

Article 5(3), second sentence ePrivacy defines two exceptions to the consent requirement:

  • Technical storage or access solely for carrying out the transmission of a communication over an electronic communications network
  • Technical storage or access strictly necessary for the provision of an information society service explicitly requested by the subscriber or user

EDPB Guidelines 05/2020 on consent clarify these exceptions. The determining factor is not the cookie category, but the specific technical function and its strict purpose limitation.

Session IDs and Authentication: Clear Exception Cases

Session cookies for authenticated areas regularly fall under the second exception. Example: A cookie named PHPSESSID used exclusively to maintain server session after login requires no consent under Art. 6(1)(f) GDPR in conjunction with Art. 5(3) ePrivacy.

Technical implementation: The cookie must have the following properties:

  • HttpOnly flag set (prevents JavaScript access)
  • SameSite=Strict or SameSite=Lax
  • Secure flag for HTTPS connections
  • Maximum validity period according to session timeout

The UK ICO confirmed in their 2019 guidance: Such technically necessary cookies are exempt from consent requirements, provided they are not used for other purposes.

Shopping Cart Cookies: Purpose Limitation as Boundary Criterion

Shopping cart cookies are only consent-free when they exclusively store selected items and quantities. Additional data collection becomes problematic:

Permissible without consent:

  • Product IDs and quantities
  • Selected product variants (size, color)
  • Session-related pricing information

Requiring consent:

  • Linking with user IDs for tracking
  • Device fingerprinting parameters
  • Referrer information for marketing purposes

The French CNIL clarified in 2020: As soon as a "technical" cookie contains additional identifiers for advertising purposes, it falls entirely under the consent requirement.

Load Balancer and CDN Cookies: Pure Infrastructure

Cookies for server load distribution or CDN control are unconditionally permissible under Art. 5(3), second sentence, first alternative. Examples:

  • AWSALBCORS for AWS Application Load Balancer
  • __cfduid for Cloudflare routing (used until 2021)
  • Server pool identifiers without personal reference

Legal classification: These cookies serve exclusively technical transmission and provision of the requested service. They contain no personal data and are not used for tracking.

Consent Management Itself: Implementation Paradox

A practical problem: The cookie storing the consent decision itself requires no consent. Art. 7(1) GDPR requires proof of consent – the consent cookie fulfills this legal requirement.

Technical implementation:

  • Cookie name: consent_status or similar
  • Content: Encrypted consent information with timestamp
  • Lifespan: 13 months (per EDPB recommendation)
  • Domain-specific without cross-site transfer

Incorrect Consent Banners: Legal Risks

Websites incorrectly requesting consent for technically necessary cookies create legal problems:

  1. Freely given under Art. 7(4) GDPR: If technically necessary cookies are presented as "optional," the voluntary nature of consent for other cookies becomes questionable
  2. Coupling prohibition: Website usage may not depend on consent to non-necessary cookies
  3. Transparency under Art. 12 GDPR: Misleading categorization violates information obligations

Practical Recommendations

For Data Protection Officers:

  • Conduct cookie audit: Examine each cookie individually for purpose and technical necessity
  • Document implementation details: HTTP headers, JavaScript code, server configuration
  • Configure consent management tool: Include only consent-requiring cookies in banner

For Developers:

  • Set cookie flags correctly (HttpOnly, Secure, SameSite)
  • Document purpose limitation in code
  • Use separate cookie domains for marketing and technical functions

For Legal Teams:

  • Review consent banner language for accuracy
  • Ensure cookie categories reflect legal reality, not marketing convenience
  • Document legal basis for each cookie type in privacy policy

Correct application of Art. 5(3) ePrivacy not only reduces legal risks but also improves user experience through fewer disruptive consent banners for actually necessary functions.

Related Articles