The tag fired before the banner.That is the whole problem.
ConsentCenter holds non-essential cookies and scripts until the visitor chooses, and only releases what they agreed to.
- 01 Scan
- 02 Hold
- 03 Release
Click a provision to read what it says.
Most cookie banners ask after the fact.
The tracker has already loaded.
Article 5(3) is about storing or reading anything on the device, not only cookies, and it requires consent before that happens. A banner that appears while the analytics script is already running is asking permission for something it has done.
Where this goes wrong first.
Scripts load on page view
Tags dropped into the template run before the visitor has seen any choice. The banner records a decision that changes nothing.
“Strictly necessary” stretched to fit
The exception is narrow: needed for the service the visitor asked for. Analytics and advertising rarely fit it, however they are labelled.
Pixels and local storage forgotten
The rule covers any storage or access on the device. A scan that only lists cookies misses the rest.
What changes for you.
Block non-essential cookies, scripts and pixels until consent.
Keep the strictly necessary category honest and documented.
Release only the categories the visitor accepted, and record it.
How it works
Scan
Find cookies, scripts and storage the site sets, and categorise them.
Hold
Block everything non-essential until the visitor makes a choice.
Release
Load only the accepted categories and keep a record of the choice.
How the banner should look.
A ConsentCenter banner set up for the ePrivacy Directive. Click it: accept, reject or open the preferences.
Allowed to run: Strictly Necessary
What it is doing
- Scripts, pixels and storage are held until the visitor chooses.
- Strictly necessary cookies are the only category always on.
- No optional category is pre-ticked, after Planet49.
- Only the accepted categories are released afterwards.
What the text actually says.
- ePrivacy Directive Article 5(3)
- Storing information, or gaining access to information already stored, on a user’s terminal equipment is allowed only with consent after clear and comprehensive information.
- Article 5(3), exemptions
- Consent is not needed where the storage or access is for the sole purpose of carrying out a transmission, or strictly necessary to provide a service the user explicitly requested.
- CJEU, Planet49 (C-673/17)
- The Court of Justice held in 2019 that a pre-ticked checkbox does not constitute valid consent to cookies.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Frequently asked questions
No. It is a directive, so each member state implements it in national law, and regulators publish their own guidance. The core rule in Article 5(3) is shared; details such as reject-button expectations vary.
The proposed ePrivacy Regulation that would have replaced the Directive was withdrawn by the European Commission in 2025. The Directive and the national laws implementing it remain in force.
It can help you find and categorise them. Deciding whether a given cookie is strictly necessary for your service is a judgement you should make with your counsel.
Bring us your ePrivacy Directive question.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.