Cookie scrutiny, third-party cookie demise, ePrivacy Regulation
Cookie consent has drawn sustained regulatory scrutiny. The ePrivacy Directive and national implementing laws remain the current rules. The Commission withdrew its 2017 ePrivacy Regulation proposal on 6 October 2025. Browser controls and advertising technology continue to change, so current platform behaviour should be checked separately from the legal rule.
| Development | Detail |
|---|---|
| NOYB complaints (2021) | 422 complaints to ten European DPAs over cookie consent mechanisms |
| CNIL fines (Jan 2022) | Totalling €210 million for cookie consent failures |
| Privacy Sandbox | Google's Chrome plan to replace third-party-cookie tracking |
| Safari | Already blocks all third-party cookies by default |
| ePrivacy Regulation | The 2017 replacement proposal was withdrawn on 6 October 2025 |
The ePrivacy Regulation would be a regulation, giving greater harmonisation than the patchwork of national implementations of the Directive. Once finalised it won't be directly applicable in the UK, but UK organisations targeting EU individuals would still likely need to comply.
Key terms - quick answers
What is “CNIL”?
What is “Privacy Sandbox”?
What is “ePrivacy Regulation”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.