The EU's 2011 cookie law came from a single amended clause

The revenue mechanism

Directive 2009/136/EC, published in the Official Journal on 18 December 2009, amended the EU's 2002 ePrivacy Directive and required member states to transpose the change by 25 May 2011, the date most sources treat as the practical start of Europe's cookie-consent requirement. The amending directive's text replaced Article 5(3) so that storing, or accessing already-stored, information on a subscriber's or user's device is only allowed where that person has given consent after being given clear information about the processing's purpose. This is the legal root of the cookie banner: any publisher setting an advertising or analytics cookie, the mechanism most programmatic revenue still depends on, is storing information on a device and falls inside the clause.

What the documents show

The amended Article 5(3) carves out two exceptions: storage or access for the sole purpose of transmitting a communication, and storage or access strictly necessary for a service the user explicitly requested, such as a shopping cart or login session. Recital 66 explains the intent in less technical terms: third parties may want to store or access device information for purposes ranging from legitimate cookie uses to spyware, and it calls for the right to refuse to be as user-friendly as possible. A second document, the original 2002 ePrivacy Directive text the 2009 amendment replaced, shows what changed: the 2002 version only required that a user be given information and be offered the right to refuse storage, an opt-out standard, before the 2009 amendment replaced it with an opt-in consent requirement.

The assumptions exposed

The 2011 amendment predates GDPR by seven years and uses narrower vocabulary; it does not define consent in the detailed, affirmative-act terms Article 7 later supplied, one reason regulators eventually read the two instruments together. A publisher should not assume the strictly-necessary exception is broad: it covers a service the user explicitly requested, not whatever a publisher finds operationally useful, such as most analytics or advertising measurement. It is also a directive, not a regulation, so its wording in national law can differ slightly by country even though the obligation is shared.

What to check before you rely on it

This is an editorial checklist, not legal advice: confirm which cookies genuinely fall inside the strictly-necessary exception versus which require consent; confirm the applicable national transposition, since implementing statutes differ in some details even where substance matches; and confirm any consent mechanism addresses this directive's requirement as well as GDPR's later, stricter standard.

• Which cookies on the site are genuinely necessary for a service the reader explicitly asked for, rather than for measurement or advertising?
• Does the national law implementing this directive in the site's key markets differ from the EU text in any material way?
• Is the consent standard applied to cookies as strict as the standard applied to other personal-data processing under GDPR?

The 2011 date is often shorthand for when the cookie law started, but more precisely, per the directive's own text, it is when the transposition deadline for the amended consent clause fell.