A startup pitch says “GDPR equals cookie law.” Which correction should privacy counsel give?
Select an answer to reveal the explanation.
Short Explanation
Calling GDPR “the cookie law” is like calling traffic code “the parking-meter statute.” GDPR is the big personal-data rulebook; ePrivacy is the specialist chapter for cookies, terminal equipment, and electronic communications. They talk to each other on a website, but they are not the same instrument.
Full Explanation
The GDPR sets general rules for personal-data processing, while cookie and electronic-communications overlays are primarily addressed through ePrivacy instruments that interact with—but are not identical to—the GDPR. Privacy counsel should correct a startup pitch that equates GDPR with cookie law by restoring both layers: general processing principles and rights under the Regulation, plus confidentiality/terminal-equipment rules under ePrivacy where engaged. Cookies are not governed exclusively by the US CAN-SPAM Act. The GDPR is not only a cookie statute with ePrivacy irrelevant. Cookie rules do not live only in NIS 2 as a replacement for both GDPR and ePrivacy. Exam caveat: “GDPR equals cookie law” is a classic false compression—pick interaction, not identity. Operational check: split website compliance tickets into GDPR notice/lawful-basis tasks and ePrivacy cookie/terminal-equipment tasks with different acceptance criteria before launch. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.