Yes there is. More specifically, it’s the Privacy and Electronic Communications Directive 2002/58/EC, which each member state adjusts their own laws to follow. It’s published here:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
The relevant part:
> Article 5
> Confidentiality of the communications
> 3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
If you want to argue that companies have a legal alternative to showing you cookie banners, then by all means do so. But don’t say there’s no law because there clearly is. This is a misleading and inflammatory headline.
Edit: Yes, I read the article. To draw a distinction between “must obtain consent” and “must show UI that obtains consent” is of no value unless you want to write an article with a shocking headline.
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
The relevant part:
> Article 5
> Confidentiality of the communications
> 3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
If you want to argue that companies have a legal alternative to showing you cookie banners, then by all means do so. But don’t say there’s no law because there clearly is. This is a misleading and inflammatory headline.
Edit: Yes, I read the article. To draw a distinction between “must obtain consent” and “must show UI that obtains consent” is of no value unless you want to write an article with a shocking headline.