privacy terms-of-service european-union consent
EU Cookie Law can I use cookies before users&#39; consent?
<p>I am trying to get my website to be EU Cookie compliant and I have encountered some plugins which have something called "implied consent" in other words a popup appears on the website saying something like</p>

<blockquote>
  <p>Cookies help us deliver our services. By using our services, you agree to our use of cookies.</p>
</blockquote>

<p>along with two buttons: <code>"Read more"</code> and <code>"Got it"</code>. So my question is: Can I use cookies before the user has clicked on any of the buttons?</p>

<p>The <a href="http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:EN:HTML" rel="nofollow noreferrer">ePrivacy directive</a> (Article 5(3)) requires prior informed consent for storage (or access) of information stored on a user's terminal equipment. </p>

<p>In other words - <strong>you must ask users</strong> if they agree to most cookies and similar technologies <strong>before the site starts to use them</strong>.</p>

<p>That is not always technically possible or creates catastrophic UX, so take a close look at which cookies are exempt from consent according to the EU advisory body on data protection: <a href="https://iapp.org/media/pdf/resource_center/wp194_Cookie-Consent-Exemption_06-2012.pdf" rel="nofollow noreferrer">Opinion 04/2012 on Cookie Consent Exemption</a> (<a href="http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf" rel="nofollow noreferrer">original, dead link</a>) (user‑input cookies (session-id), authentication cookies, user‑centric security cookies, multimedia content player cookies, user‑interface customisation cookies, third‑party social plug‑in content‑sharing cookies etc.).</p>

<p><strong>Update 2019:</strong>  Europe’s top court says <a href="https://techcrunch.com/2019/10/01/europes-top-court-says-active-consent-is-needed-for-tracking-cookies/" rel="nofollow noreferrer">active consent is needed for tracking cookies</a>. There are <a href="https://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm" rel="nofollow noreferrer">few exemptions</a> of cookies that generally do NOT require consent:</p>

<ul>
<li>User input cookies, for the duration of a session</li>
<li>Authentication cookies, for the duration of a session</li>
<li>User centric security cookies, used to detect authentication abuses and linked to the functionality explicitly requested by the user, for a limited persistent duration</li>
<li>Multimedia content player session cookies, such as flash player cookies, for the duration of a session</li>
<li>Load balancing session cookies, for the duration of session.</li>
<li>User interface customisation cookies, for a browser session or a few hours, unless additional information in a prominent location is provided (e.g. “uses cookies” written next to the customisation feature</li>
</ul>
