EU GDPR + ePrivacy cookie rules

It can. Under Article 3(2), the GDPR applies to businesses outside the EU that process personal data of people in the EU when they offer goods or services to them (paid or free) or monitor their behavior in the EU, which includes analytics and advertising tracking. A site that ships to EU customers or runs ad tracking on EU visitors should assume it applies.

Article 27 requires such businesses to name a representative in the EU in writing, unless the processing is occasional, doesn’t involve large-scale sensitive or criminal data, and is unlikely to put people’s rights at risk.

The cookie rule itself comes from the ePrivacy Directive, Article 5(3): storing or reading information on a visitor’s device needs their consent, after clear information, unless it’s strictly necessary to send a communication or to provide a service the visitor asked for. The GDPR sets the bar for that consent: freely given, specific, informed and unambiguous (Article 4(11)); you must be able to show it was given (Article 7(1)); and it must be as easy to withdraw as to give (Article 7(3)). Silence, pre-ticked boxes and inactivity aren’t consent (Recital 32).

People can ask to access, correct, delete or port their data, and object to its use. Answer within one month; you can extend by two more months where necessary, if you tell the person within the first month (Article 12(3)).

The highest tier of GDPR fines is up to €20 million or 4% of annual worldwide turnover, whichever is higher. Cookie rules are also enforced under each country’s ePrivacy law. France’s CNIL, for example, fined Google €150 million and Facebook €60 million in December 2021 because refusing cookies took more effort than accepting them, and in September 2025 fined Shein €150 million over cookies.

Third-party resources count too. In January 2022 a Munich court ordered a website owner to pay €100 because loading Google Fonts from Google’s servers passed the visitor’s IP address to Google without consent; the court noted the fonts could be used without connecting to Google.

In November 2025 the European Commission proposed a “Digital Omnibus” that would move the cookie rules into the GDPR and widen the consent exceptions. As of this review it is still a proposal in the European Parliament and Council; the current rules apply until a final text is adopted and in force.