AI chat widget and website tracker consent sheet: cookies, local storage and pixels under ePrivacy Article 5(3) (EDPB Guidelines 2/2023, Planet49) for accountants and their small business clients
What you get: a finished website tracker and AI chat widget consent sheet in three tabs: a tracker tab (one row per cookie, local-storage item, pixel, tracking link or chat widget script) with a formula that says CONSENT FIRST or which narrow exemption may apply, plus a fix column that flags anything firing before the visitor chooses; a banner check tab with seven yes/no tests taken from EU law and the Court of Justice; and a consent record tab so the client can show who agreed to what and when. Five made-up rows show how it fills in.
Short answer: Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) allows storing information on, or reading information from, a visitor's device only with consent after clear and comprehensive information about the purposes, unless it is for the sole purpose of transmitting a communication or strictly necessary for a service the visitor explicitly requested. The European Data Protection Board says this is not only about cookies: local storage, tracking pixels, tracking links, unique identifiers and some IP-based tracking can be covered too (Guidelines 2/2023, version 2.0, adopted 7 October 2024). An AI chat widget, analytics script or ad pixel added to a client site is therefore a consent question before it is a GDPR question.
Why accountants and bookkeepers should look at this now
- AI chat widgets are the new tracker. Many clients add an AI chatbot to their site with one line of code. Many widgets store a visitor ID in a cookie or in local storage as soon as the page loads, before anyone opens the chat. Check what the client's own widget does.
- "It is not personal data" is not an answer. The Court of Justice ruled in Planet49 (C-673/17, 1 October 2019) that Article 5(3) applies whether or not the stored or accessed information is personal data.
- Pre-ticked boxes do not count. The same judgment says consent is not valid through a pre-checked box the user must untick, and that the information given must include how long the cookies last and whether third parties can access them.
- It is a quick win in a client review. One page of this sheet per client website turns a vague "is our cookie banner fine?" into a list of named scripts with a fix next to each.
Step 1: tab 1, trackers (one row per item)
Open the client's site in a private browser window, open the browser's developer tools and look at cookies, local storage and network requests before clicking anything on the banner. Add one row per item you see, and one row per script you know the site uses (from the site builder's settings or the client's web agency).
| Column | What to write | Source |
|---|---|---|
| A. Item | Cookie or storage key name, or script name (for example the chat widget's script) | |
| B. Type | Cookie, local storage, tracking pixel, tracking link, unique identifier, IP-only tracking, chat widget storage, other | EDPB Guidelines 2/2023, sections 2 and 3 |
| C. Set by | The client's own domain (first party) or another company's domain (third party), with the domain | WP29 Opinion 04/2012, section 2.3 |
| D. Purpose | What it does, in plain words (login, basket, language choice, chat history, statistics, ads, AI training by the supplier) | Art. 5(3) ePD ("purposes") |
| E. Function the visitor explicitly asked for | Yes/No: is it tied to something the visitor actively asked for (adding to basket, logging in, opening the chat, choosing a language)? | Art. 5(3) ePD; WP29 Opinion 04/2012, criterion B |
| F. Strictly necessary for that function | Yes/No: would that function fail without it? | Art. 5(3) ePD; WP29 Opinion 04/2012, criterion B |
| G. Only to carry the transmission | Yes/No: sole purpose is carrying the communication over the network (for example a load-balancing session cookie) | Art. 5(3) ePD; WP29 Opinion 04/2012, criterion A and section 3.5 |
| H. Any other purpose | Yes/No: also used for analytics, ads, profiling, cross-site tracking or the supplier's own product improvement or AI training | WP29 Opinion 04/2012, sections 4.1 to 4.3 |
| I. Lifetime | Session, or the expiry shown (for example 13 months) | Planet49, ruling point 3 |
| J. Third parties with access | Names of other companies that can read it, or "none" | Planet49, ruling point 3 |
| K. Fires before the visitor chooses | Yes/No: present before any click on the banner | Art. 5(3) ePD ("only allowed on condition that ... has given his or her consent") |
| L. Result | Formula below | Our working rule |
| M. Banner names purpose, lifetime and third parties | Yes/No | Art. 5(3) ePD; Planet49, ruling point 3 |
| N. Fix | Formula below | Our working rule |
Result formula for L2 (Google Sheets or Excel), then fill down:
=IF(A2="","",IF(H2="Yes","CONSENT FIRST",IF(G2="Yes","MAY BE EXEMPT: TRANSMISSION ONLY",IF(AND(E2="Yes",F2="Yes"),"MAY BE EXEMPT: STRICTLY NECESSARY","CONSENT FIRST"))))Fix formula for N2:
=IF(A2="","",IF(AND(L2="CONSENT FIRST",K2="Yes"),"FIX: BLOCK UNTIL CONSENT",IF(M2<>"Yes","FIX: ADD PURPOSE, LIFETIME, THIRD PARTIES TO BANNER","OK")))The order of tests and the result words are our working rule, not the law's wording. "MAY BE EXEMPT" means only that the item could fit one of the two exemptions in Article 5(3). The EDPB guidelines say whether an exemption applies must be assessed case by case, with the national transposition and national authority guidance (Guidelines 2/2023, paragraph 4). Write the reason in column D and check your country's guidance.
Made-up example rows (not a real website)
| A | B | C | E | F | G | H | I | K | L (result) | N (fix) |
|---|---|---|---|---|---|---|---|---|---|---|
| basket_id | Cookie | First party | Yes | Yes | No | No | Session | No | MAY BE EXEMPT: STRICTLY NECESSARY | OK (banner lists it) |
| chat_visitor_id (AI chat widget) | Local storage | Third party (widget supplier) | No | No | No | Yes (supplier's analytics) | 12 months | Yes | CONSENT FIRST | FIX: BLOCK UNTIL CONSENT |
| chat_session (set only after "Start chat") | Local storage | First party | Yes | Yes | No | No | Session | No | MAY BE EXEMPT: STRICTLY NECESSARY | FIX: ADD PURPOSE, LIFETIME, THIRD PARTIES TO BANNER |
| _stats_id (analytics) | Cookie | First party, analysed by a supplier | No | No | No | Yes | 13 months | Yes | CONSENT FIRST | FIX: BLOCK UNTIL CONSENT |
| Ad pixel in newsletter | Tracking pixel | Third party | No | No | No | Yes | n/a | Yes | CONSENT FIRST | FIX: BLOCK UNTIL CONSENT |
Why these results: WP29 Opinion 04/2012 lists user-input session cookies (such as a basket), authentication session cookies, user-centric security cookies, multimedia player session cookies, load-balancing session cookies and short-term interface customisation cookies as items that can be exempt if not used for other purposes. It says analytics cookies are not strictly necessary for a function the user asked for (section 4.3), and third-party advertising cookies are not exempt (section 4.2). The EDPB says tracking pixels and tracking links, including in emails, fall under Article 5(3) (Guidelines 2/2023, paragraphs 47 to 51).
Step 2: tab 2, banner checks (seven yes/no tests)
| # | Test | Source |
|---|---|---|
| 1 | Nothing in tab 1 marked CONSENT FIRST fires before the visitor chooses | Art. 5(3) ePD |
| 2 | No pre-ticked boxes or switches already set to "on"; consent is a clear affirmative action | Planet49 ruling point 1; GDPR Art. 4(11) |
| 3 | The banner or linked notice states each purpose, how long each item lasts and whether third parties can access it | Art. 5(3) ePD; Planet49 ruling point 3 |
| 4 | The consent request is clearly distinguishable from other text, in clear and plain language | GDPR Art. 7(2) |
| 5 | The visitor is told before agreeing that consent can be withdrawn at any time | GDPR Art. 7(3) |
| 6 | Withdrawing is as easy as giving consent (for example a link or button on every page that reopens the choices) | GDPR Art. 7(3) |
| 7 | The client can show that consent was given (tab 3 is kept) | GDPR Art. 7(1) |
Score cell: =COUNTIF(C2:C8,"Yes")&" of 7" with Yes/No answers in column C. Anything below 7 goes in the client letter.
Step 3: tab 3, consent record
| Column | What to keep |
|---|---|
| A. Date and time | When the choice was made |
| B. Banner version | Version or date of the banner text shown |
| C. Choice ID | The random ID the consent tool stores (not a name) |
| D-F. Categories | Statistics, marketing, chat widget extras: Yes/No each |
| G. Withdrawn on | Date, if the visitor later changed their mind |
Most consent tools keep this log for you; the tab is where the client notes which tool keeps it and where to export it. Keeping it supports GDPR Article 7(1) where the processing relies on consent.
AI chat widgets: four questions to ask the supplier
- Which cookies or local-storage keys does the widget set, and does it set any before the visitor opens the chat?
- Can loading be delayed until the visitor clicks "chat" or gives consent?
- Does the supplier use the stored IDs or chats for its own purposes (analytics, product improvement, model training)? If yes, that is "any other purpose" in column H.
- Which other companies can access the stored information (column J)?
The answers also feed the client's privacy notice and processor agreement. Our free sheets: privacy notice AI section · GDPR Article 7 consent record · transfer check for US suppliers · ePrivacy email marketing permission sheet.
Paragraph for the client letter (template)
We checked [website] on [date] before accepting any cookie choice. [number] items set or read information on visitors' devices without consent although they are not needed for anything the visitor asked for: [items]. Under Article 5(3) of the ePrivacy Directive as transposed in [country], these need consent first. Please ask your web developer to block them until the visitor agrees, and to add purpose, lifetime and third-party access for each item to the banner. Withdrawing consent must be as easy as giving it.
The template wording is ours. Replace the brackets.
Keep the AI tools list in one place
List the client's AI chat widget and other AI tools in the EURO AI Register free edition. It runs in your browser with no account and no upload, covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Attach this consent sheet as the evidence record for the widget.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
National law
Article 5(3) is in a directive, so each country applies it through its own law, and the national data protection or telecoms authority enforces it and sets the penalties. Rules on first-party statistics, consent lifetimes and banner design differ between countries. Check your national law and your authority's cookie guidance. This page covers the EU texts in force as we read them today.
Frequently asked questions
Does the cookie rule cover local storage and pixels, not only cookies?
Yes, according to the EDPB. Its Guidelines 2/2023 on the technical scope of Article 5(3) cover tracking pixels and tracking links (including in emails), information processed locally and then sent to a server, unique identifiers, IP-based tracking where the IP address comes from the user's device, and IoT reporting.
Does it matter whether the information is personal data?
No. In Planet49 (C-673/17) the Court of Justice ruled that Article 5(3) is not interpreted differently according to whether the stored or accessed information is personal data.
Can analytics run without consent as "strictly necessary"?
WP29 Opinion 04/2012 says analytics cookies are not strictly necessary to provide a function explicitly requested by the user, so they do not fall under the exemption. It noted that first-party aggregated statistics carry less privacy risk. Some national authorities have since issued their own guidance on audience measurement, so check your country.
Not legal advice. The sheet helps a person check a website; it does not decide whether an exemption applies, what your national law says or which penalties apply. When in doubt, ask your data protection authority or a lawyer. Spotted an error? Write to mininglife7@gmail.com and we correct it.
Sources
- Directive 2002/58/EC (ePrivacy Directive), consolidated text of 19.12.2009: Article 5(3) — eur-lex.europa.eu, CELEX 02002L0058-20091219 (read 28 Oct 2026)
- Directive 2009/136/EC: Recital 66 — eur-lex.europa.eu, CELEX 32009L0136 (read 28 Oct 2026)
- Court of Justice, Case C-673/17 Planet49, judgment of 1 October 2019 (Grand Chamber), operative part points 1 to 3 — eur-lex.europa.eu, CELEX 62017CJ0673 (read 28 Oct 2026)
- Regulation (EU) 2016/679 (GDPR): Articles 4(11) and 7(1)-(4) — eur-lex.europa.eu, CELEX 32016R0679 (read 28 Oct 2026)
- European Data Protection Board, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0, adopted 7 October 2024: paragraphs 1, 4, 44, 47-63 — edpb.europa.eu (read 28 Oct 2026)
- Article 29 Working Party, Opinion 04/2012 on Cookie Consent Exemption (WP 194), adopted 7 June 2012: sections 2, 3, 4 and 5 — ec.europa.eu (read 28 Oct 2026)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.