An online store that targets or tracks people in the EU must get consent for non-essential cookies and show a privacy notice wherever it collects data. The cookie rule is Article 5(3) of the ePrivacy Directive, not the GDPR, and access requests are due within one month of receipt.
This guide is for Gulf e-commerce and website managers who sell to, ship to or track customers in Europe.
Which law governs your cookie banner, the GDPR or ePrivacy?
Placing or reading a cookie is governed by the national law that transposes Article 5(3) of Directive 2002/58/EC. The GDPR governs what you do with the data afterwards, and it defines valid consent. The EDPB Cookie Banner Taskforce set out this split in its report adopted on 17 January 2023.
Article 5(3) allows storing or reading information on a visitor's device only with consent, after clear information on the purposes. The only exemptions cover transmitting a communication and what is strictly necessary for a service the user explicitly requested.
The rule covers any information, personal data or not, as the Court of Justice held in Planet49 (C-673/17) on 1 October 2019. EDPB Guidelines 2/2023 place tracking pixels in web pages and e-mails within it.
Some vendor pages present the banner as purely a GDPR Article 6 matter. The duty to ask comes from Article 5(3), while the GDPR, usually through Article 6(1)(a) consent, covers the processing that follows. Legitimate interests can never justify placing a tracker, and invalid cookie consent makes the later processing unlawful too.
The one-stop shop does not apply to ePrivacy, so national authorities enforce their own cookie rules with no lead authority to coordinate them. A Gulf store with no EU establishment has no lead authority under the GDPR either.
What must the banner do before and after a visitor chooses?
The taskforce report records the common minimum positions of EU authorities. It does not replace national rules.
- No cookie that needs consent fires before the visitor chooses.
- Every layer with an "Accept" button also offers a way to refuse. A vast majority of authorities treat a missing reject option as an infringement.
- Refusal is not hidden as a link in body text, and its text is readable.
- No pre-ticked boxes on the second layer.
- Cookies labelled "strictly necessary" really are, and you can show an authority why.
- Visitors can withdraw at any time as easily as they consented, for example through a permanent icon.
EDPB Guidelines 05/2020 on consent add that scrolling never counts as consent, and that consent cannot come in the same action as accepting your terms. Planet49 adds that you must say how long cookies operate and whether third parties can access them.
What has the CNIL fined online sellers for?
On 1 September 2025 the CNIL fined the Irish subsidiary that runs shein.com for Europe EUR 150 million under Article 82 of the French Data Protection Act. Advertising trackers fired as soon as visitors arrived. Neither of two banners explained the advertising purpose, and the second layer did not name the third parties. After "Reject all", trackers were still placed and read.
The CNIL held that the one-stop shop did not apply, because trackers fall under ePrivacy. The same day it fined Google EUR 325 million, for trackers and for ads shown in Gmail without consent.
The CNIL's sanctions list for 2025 also includes a catalogue distance seller fined EUR 3,000 for cookie consent, and a furniture seller fined EUR 600,000 for failures including cookies and e-mail marketing consent. These are French decisions under French law, not a measure of every EU authority.
What must your privacy notice and marketing consent cover?
Article 13 applies when you collect data, so link the notice from checkout, account sign-up and the newsletter form. It must name you, your EU representative where Article 27 applies and any DPO. It must state purposes and legal basis, recipients, transfers, retention, your customers' rights, including to withdraw consent, and the right to complain.
Data from marketplaces or partners triggers an Article 14 notice, due within one month at the latest, or at first contact if earlier.
Marketing e-mail needs prior consent under ePrivacy Article 13(1). Article 13(2) lets you market your own similar products to a customer whose e-mail you got in a sale. You must offer a free, easy opt-out at collection and in every message. If a customer objects to direct marketing, you must stop, and Article 21(3) allows no exceptions.
You must be able to prove consent (GDPR Article 7(1)). The EDPB expects session details, the workflow at the time and a copy of what was shown, not just a claim that the website was configured correctly. In May 2025 the CNIL fined a marketing and website design company EUR 900,000, partly over proof of consent.
How fast must you answer a customer's data request?
Article 12(3) gives you one month from receipt. You can extend by two months for complex or numerous requests if you tell the person why within the first month. Requests are free, and an access request needs no reason and no set format.
The EDPB Guidelines 01/2022 on access (version 2.1, 30 May 2024) settle the clock. It starts when the request reaches any of your official channels, even if nobody has noticed it. A request received on 5 March is due by 5 April. Some pages count from the day after receipt, but the EDPB counts from the day itself.
Do not ask a logged-in customer for a passport copy. The EDPB calls that disproportionate, and ID copies create their own security risk. Use a confirmation link or a code. Purchase history counts as personal data too, so search every system, using your record of processing as the map.
The EDPB's 2024 enforcement action covered 1,185 controllers and found missing documented procedures. Many reported very few requests, which may mean staff do not recognise them. Train customer-facing teams to spot a request on any channel.
The Saudi Implementing Regulation is the nearest home-law mirror: 30 days, extendable by up to 30 more with advance notice, and a record of every request, oral ones included. Our guide to Saudi PDPL enforcement covers that side.
What will an authority ask you to prove?
There is no audit standard for this. Authorities ask for records, and these answer the usual questions.
| Requirement | Rule | Evidence to keep |
|---|---|---|
| No non-essential cookies before a choice | ePrivacy Art. 5(3) | Cookie and tracker inventory with purpose, duration and third party, plus a pre-consent load test |
| Refusing is as easy as accepting | ePrivacy Art. 5(3), EDPB taskforce | Screenshots of each banner layer with the reject option |
| Purposes, durations and third parties shown | Planet49 | First and second layer wording |
| Withdrawal works and stops tracking | GDPR Art. 7(3) | Test records after "Reject all" and after withdrawal |
| Marketing consent or soft opt-in | ePrivacy Art. 13 | Opt-in record, or proof of the sale and the opt-out offered |
| Proof of consent | GDPR Art. 7(1) | Session, timestamp, wording shown and workflow version |
| Notice at checkout and sign-up | GDPR Arts 12 and 13 | Notice with every Art. 13 item and a map of collection points |
| Requests answered within one month of receipt | GDPR Art. 12(3) | Request register with receipt date, deadline and any extension letter |
To keep these records in one management system, see our guide to ISO/IEC 27701.
How AGS can help
Three kits cover this topic in editable Microsoft Word and Excel files. None is software.
- EU GDPR Website & E-Commerce Compliance Toolkit: 283 documents, including a pre-consent blocking verification checklist, cookie rejection and consent withdrawal verifications, and 13 website notices.
- EU GDPR Consent & Data Subject Rights Management System: 237 documents, including a one-month deadline calculation guide and workflows from access to objection.
- EU GDPR Privacy Notice & Transparency Management System: 104 documents, including 14 model notices.
Frequently asked questions
Can we block the site until visitors accept cookies?
The EDPB says a cookie wall that hides content until the user clicks "Accept" gives no genuine choice, so consent is not free. The CNIL said in its Google decision that cookie walls are not illegal in themselves if a balanced alternative keeps consent free and informed.
Is the EU cookie law about to change?
The Commission withdrew its ePrivacy Regulation proposal on 6 October 2025, so the Directive stays in force. The proposed Digital Omnibus of 19 November 2025 would add GDPR Article 88a, with single-click refusal and no new request for at least six months after a refusal. It would also add a proposed Article 88b on machine-readable consent signals. The proposal still awaits a committee decision in the European Parliament.
Does our Saudi or UAE PDPL programme cover EU customers?
No. It does not replace the GDPR or national ePrivacy rules. Each law sets its own consent rules, such as provable consent under UAE Decree-Law 45 of 2021, Article 6.
What if a child gives consent on our site?
Where you rely on consent for an online service offered directly to a child, Article 8 sets the age at 16, or lower by national law but not below 13. Below that age a parent must give or authorise consent, and you must make reasonable efforts to verify it.
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by the European Commission, the European Data Protection Board, the CNIL or any supervisory authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
