Why the Exemption Matters

Under the ePrivacy Directive (Article 5(3)), storing or reading information on a user's device normally requires prior consent. There are two exceptions, and the one publishers rely on most is the exemption for storage that is strictly necessary to provide a service the user has explicitly requested. Everything that is not covered by that exemption sits behind your consent banner.

Many sites stretch this exemption to cover analytics, A/B testing, ad frequency capping and personalisation. Regulators have repeatedly pushed back on that reading, so it pays to understand exactly where the line sits.

The Two-Part Test

The exemption is not about what is convenient for you. It asks two questions:

1. Did the user explicitly request the service? Loading an article is a request. Adding an item to a basket is a request. Opening a chat widget you pushed on every page is not.
2. Is the storage strictly necessary to deliver exactly that service? If the service would still work, even in a less convenient form, without the cookie or identifier, the storage is probably not strictly necessary.

Note that “necessary for our business model” is not the same as “necessary for the service the user asked for.” Advertising revenue keeps a free site alive, but ad-targeting identifiers are not needed to display an article.

Commonly Accepted Examples

• Session and authentication cookies that keep a logged-in user logged in during a session.
• Shopping basket cookies that remember items while the user checks out.
• Load-balancing identifiers that route a request to the right server.
• Security cookies used to detect repeated failed logins or to defend against forged requests.
• The consent record itself, because remembering the user's choice is required to honour it.
• Interface preferences the user set deliberately, such as language, when they are stored for the session or because the user chose them.

Commonly Misclassified Examples

• Analytics cookies. Some authorities allow limited, privacy-preserving audience measurement under narrow conditions, but standard analytics tags generally need consent. Check the guidance of the authority that applies to your audience.
• Advertising and retargeting identifiers. These are never needed to deliver the content itself.
• Social sharing buttons and embedded widgets that set third-party cookies on page load.
• A/B testing and personalisation that is not requested by the user.
• Frequency capping for ads. It helps the user experience, but it is not essential for delivering the page.

Duration and Scope Still Matter

A cookie that is genuinely essential can still become problematic if it lives longer or collects more than the function needs. A session cookie that persists for a year, or a security cookie that also writes a marketing profile, loses its protection. Keep the lifetime short and the contents minimal.

Document Your Reasoning

For every cookie or storage item you classify as strictly necessary, write down three things: the user-requested function it supports, why that function would break without it, and its lifetime. A short table maintained alongside your cookie inventory is enough. When you review the list, challenge each entry: if the only argument is “we have always done it this way,” move it behind consent.

The exemption also applies to more than cookies. Local storage, session storage, device fingerprinting and SDK identifiers in apps fall under the same Article 5(3) logic, so include them in your review.

Where FlexyConsent Fits

FlexyConsent is a Google-certified CMP (CMP ID 317), certified by IAB Europe and IAB Canada, with a banner available in 57 languages. A CMP lets you hold non-essential tags until the user has chosen, while your genuinely essential items continue to load. Deciding which category each cookie belongs to is still your call, so keep your documented reasoning up to date.

Key Takeaways

• The exemption covers storage strictly needed for a service the user explicitly requested, not storage needed for your revenue.
• Session, basket, load-balancing, security and consent-record cookies are the typical qualifying examples.
• Analytics, advertising, social widgets and personalisation generally need consent.
• Lifetime and contents matter: keep essential cookies short-lived and minimal.
• Apply the same test to local storage, session storage and app identifiers.
• Document the reasoning for every item you classify as strictly necessary and review it regularly.