Cookie consent baseline

What it is

The ePrivacy Directive (the 'cookie law') predates GDPR but still governs cookie behaviour in the EU. The combined GDPR+ePrivacy regime is what regulators actually enforce: prior consent, granular categories, easy refusal. The proposed ePrivacy Regulation that would have replaced it was withdrawn by the European Commission in 2025, so the 2002 Directive remains the operative law.

Why it matters

European DPAs have ramped up enforcement against dark-pattern banners and silent tracking. Even outside the EU, a clean consent layer is becoming the baseline trust expectation.

Who it applies to

Any site with EU traffic, plus increasingly any site claiming to respect user privacy.

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 2 supporting factors pass.

0 of 2 supporting factors are currently collected. Sites where the remaining 2 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

GDPR , CCPA , ePrivacy Reg.

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 2 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• Colorado Privacy Act 2 shared factors Privacy Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
• Connecticut Data Privacy Act 2 shared factors Privacy Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
• COPPA 2 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• HIPAA 2 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.

Other references

• guidance EDPB Guidelines 03/2022 on dark patterns
• spec IAB Europe Transparency & Consent Framework (TCF)