When we talk about "cookies", we're really using a linguistic shortcut. A cookie, in the strict sense, is a small file stored in a visitor's browser. But today, it's just one method among many for collecting data.
In reality, many tools can track a visitor's activity on a website:
scripts that send information to third-party services (like Google or Meta),
small pieces of code that remember a visitor's behavior (such as the chosen language or visited pages),
or even more invisible techniques that allow identifying a device without storing anything at all.
đ In summary, the word "cookies" is a generic term that encompasses all these mechanisms. And these are what must be subject to consent when the law requires it.
Two distinct sets of rules apply to them:
â
Rules on terminal access â the ePrivacy directive in Europe, transposed by national law in each Member State. They govern the storing or reading of information on the visitor's device, regardless of the nature of that information. These are what determine what must be subject to consent.
â
Personal data protection laws â the GDPR in Europe, UK GDPR in the United Kingdom, or CCPA in California. They govern the processing of personal data that may result from this collection.
This is why a mechanism may require consent even if it collects no personal data: it's the terminal access that matters, not the nature of the information. And this access includes simply reading information already present on the device â as these techniques do when they identify a device without storing anything on it.
âïž In the next articles in this series, we will primarily use the terms "services" or "providers" to refer to these trackers, in order to better reflect the different forms of data collection.