What is the ePrivacy Directive (the cookie law)?

The ePrivacy Directive is the EU law that requires consent before storing or accessing information on a visitor's device, which is what makes cookie banners legally necessary. It works alongside the GDPR, and each EU country's national law implements it, as does the UK's PECR.

What it actually says

The rule is simple in principle: do not store information, or access information already stored, on someone's device without their informed consent. The only exceptions are communications transmission and strictly necessary cookies for a service the user requested.

How it relates to GDPR

ePrivacy governs the act of setting or reading the cookie; the GDPR governs what happens to the personal data afterward. A site needs to satisfy both, which is why banners ask before trackers run and privacy policies explain the processing.