A startup pitch says “GDPR equals cookie law.” Which correction sho…

Question

A startup pitch says “GDPR equals cookie law.” Which correction should privacy counsel give?

Accepted Answer

The GDPR sets general rules for personal-data processing, while cookie and electronic-communications overlays are primarily addressed through ePrivacy instruments that interact with—but are not identical to—the GDPR. — Calling GDPR “the cookie law” is like calling traffic code “the parking-meter statute.” GDPR is the big personal-data rulebook; ePrivacy is the specialist chapter for cookies, terminal equipment, and electronic communications. They talk to each other on a website, but they are not the same instrument.

Answer

Cookies are governed exclusively by the US CAN-SPAM Act, so GDPR never applies to any website tracking.

Answer

The GDPR is only a cookie statute; ePrivacy never addresses electronic communications or terminal equipment.

Answer

Cookie rules live only in NIS 2, which replaced both GDPR and ePrivacy for all online tracking.

A startup pitch says “GDPR equals cookie law.” Which correction should privacy counsel give?

Short Explanation

Full Explanation