united-kingdom european-union
What law forces cookie dialogs on websites?
<p>The Web is now covered with poorly designed, intrusive and ineffective dialogs warning about cookies.</p>

<p>Presumably this is as a result of an EU directive. Which UK law enacts this directive?</p>

<p>As SJuan76 mentions in a comment, the first cookie-related EU law was:</p>

<blockquote>
  <p><a href="https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32009L0136" rel="noreferrer">Directive <strong>2009/136/EC</strong></a> of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws </p>
</blockquote>

<p>This being an EU Directive, it required transcription into UK law to be valid in the UK. This was effected by:</p>

<blockquote>
  <p><a href="http://www.legislation.gov.uk/uksi/2011/1208/made" rel="noreferrer">The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011</a></p>
</blockquote>

<p>This is a statutory instrument made under the European Communities Act 1972, and came into force on 26 May 2011.</p>

<p>It is not a directive, it is a <em>regulation</em></p>

<p>More specifically, it is the General Data Protection Regulation, or <a href="https://eugdpr.org/" rel="nofollow noreferrer">GDPR</a>; we even have a <a href="https://law.stackexchange.com/questions/tagged/gdpr">tag for it</a>.</p>

<p>Now to the core of the question, GDPR being a <em>regulation</em> and not a directive means that it enters into effect without need of national Parliaments to adapt their laws to enact it. Or, as the <a href="https://eugdpr.org/the-regulation/gdpr-faqs/" rel="nofollow noreferrer">GDPR FAQ page explains</a></p>

<blockquote>
  <p>What is the difference between a regulation and a directive?  </p>
  
  <p>A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the the previous legislation, which is a directive.</p>
</blockquote>

<p>In any case, some aspects of the GDPR<sup>1</sup> are left to the national Parliaments to decide. In the UK there is the <a href="https://ico.org.uk/for-organisations/data-protection-act-2018/" rel="nofollow noreferrer">Data Protection Act of 2018</a></p>

<p><hr/>
<sup>1</sup>For example definition of what is the age limit for "minors" or if permission is enough to process highly sensitive data like health data.</p>

<p>SJuan76's comment from a different angle:</p>

<blockquote>
  <p>GDPR incorporates many provisions that affect cookies, as those can be
  used to gather personal data (e.g. if a cookie tracks which pages you
  visit in order to sell publicity then GDPR stipulates that consent is
  needed), but does not focus on them. It does not supersede or extend
  the cookie law (i.e. it is not derived from it) but it forces
  additional constraints. – SJuan76 3 hours ago</p>
</blockquote>

<p>Basically, the Cookie Directive and GDPR operate on 2 different levels, which might overlap: we can say that GDPR applies only as long as the cookie is collecting data considered "personal" or "online identifiers" by the Regulation. If it happens, then the consent window (you called it "dialogs warning") has to be more strict, as per GDPR requirement (I am just mentioning one of the effects). Otherwise, the less-strict Directive will apply.</p>
