List every cookie and device read with its purpose

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

ePrivacy Directive Article 5(3) needs consent before storing or reading anything on a person's device. The exception is what is strictly needed for the service they asked for. It covers cookies, local storage, pixels and device fingerprints alike. Each country writes it into its own law. In Sweden it is chapter 9 section 28 of the electronic communications act, lag (2022:482), which the Post and Telecom Authority, PTS, supervises. The consent itself works as Store nothing extra without a yes says. This list proves which entries need it.

Examples

JavaScript example

// Playwright: every cookie set before consent must be on the list as strictly needed
const allowed = new Set(deviceStorage.filter(entry => entry.consent === 'not-needed').map(entry => entry.name));
const cookies = await page.context().cookies();
expect(cookies.map(cookie => cookie.name).filter(name => !allowed.has(name))).toEqual([]);

Python example

# Playwright for Python: the same check
allowed = {entry["name"] for entry in device_storage if entry["consent"] == "not-needed"}
unlisted = [c["name"] for c in page.context.cookies() if c["name"] not in allowed]
assert unlisted == []

How to check

A browser test loads every page template with no consent given and lists the cookies and storage keys set. Every one is on the list and marked as strictly needed. With consent given, every new key is on the list too.

Sources

• ePrivacy Directive 2002/58/EC, Article 5(3)
• Lag (2022:482) om elektronisk kommunikation, chapter 9 section 28

Related rules

• WEB-207 Store nothing extra without a yes in Website