EU amends ePrivacy Directive's cookie-consent rule

On November 25, 2009, the European Union adopted Directive 2009/136/EC, commonly known as the 'Cookie Directive,' which amended the earlier ePrivacy Directive (2002/58/EC). The most consequential change was to Article 5(3), which shifted the legal basis for storing or accessing information on a user's device — including cookies — from an opt-out model to an opt-in consent model. Under the amended rule, website operators and third parties were required to obtain informed, prior consent from users before placing cookies on their devices, with a narrow exception for cookies that are strictly necessary for a service explicitly requested by the user. Member states were given until May 25, 2011 to transpose the directive into national law.

The Cookie Directive fundamentally disrupted the AdTech ecosystem by placing legal constraints on the ubiquitous use of third-party tracking cookies, which were at the time the primary mechanism for behavioral targeting, audience segmentation, frequency capping, attribution, and retargeting across the open web. Ad networks, demand-side platforms (DSPs), data management platforms (DMPs), and publishers all relied on cookies dropped without explicit user consent. The directive accelerated the development of consent management platforms (CMPs) as a new category of AdTech infrastructure, and laid the groundwork for the IAB Europe's Transparency and Consent Framework (TCF). It also foreshadowed the more sweeping GDPR (2018), which further tightened consent requirements and introduced significant penalties. In the short term, enforcement was inconsistent across EU member states, limiting immediate market disruption, but the directive established the regulatory philosophy — user consent as a prerequisite for data collection — that continues to shape global AdTech policy and the industry's long-term shift away from third-party cookies.