The ePrivacy Directive (2002/58/EC) is the EU's sector-specific law on privacy and electronic communications — often called "the cookie law." Its Article 5(3) is the reason cookie banners exist: it requires prior consent before any information is stored on, or accessed from, a user's device — cookies, pixels, fingerprinting — unless strictly necessary to deliver the requested service. It predates the GDPR and works alongside it as lex specialis for device access. Legitimate interest under GDPR can't override the ePrivacy consent rule. The long-awaited ePrivacy Regulation was meant to replace it but remains unadopted in 2026 — Member States apply their national implementations.