Legal explainer, published 1 October 2026; national implementation and UK amendments matter.
What happened
The EU ePrivacy Directive addresses storing or accessing information on a user’s equipment, with national implementing rules. GDPR governs processing of personal data. In the UK, PECR contains the relevant storage-and-access rules, alongside UK GDPR. The precise analysis depends on the technology, purpose and jurisdiction.
Source: EUR-Lex — original source ↗
What it means for your website
This distinction explains why a French cookie fine may be based on national legislation rather than described accurately as a GDPR Article 83 penalty. It also explains why a cookie exemption does not automatically settle every question about later processing of personal information. For your website, start by mapping what happens in the browser and then what happens to the information collected. One review concerns storage or access; another concerns the purpose, basis and handling of personal data. Do not combine them into a single green tick that suggests the whole business has been certified.
Three useful next steps
- Identify the jurisdictions relevant to your audience and business.
- Separate browser storage from later data processing.
- Use the applicable local rules when assessing exceptions.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
EUR-Lex — original sourceEU GDPR — official textUK PECR regulation 6Our practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.