Cookie consent under Slovak law
Short answer
Consent is needed whenever something is stored on a user's device or read from it. There are only two exceptions: transmitting a message over a network, and what is strictly necessary for a service the user has expressly requested. Consent must be demonstrable and given in advance, so analytics and marketing cookies may not load before the user gives it. The rule is not limited to cookies; it covers local storage and similar techniques as well.
2 statutory citations below · law as at
A cookie banner is not a matter of Regulation (EU) 2016/679 but of the Act on electronic communications. That act determines when consent is required. The GDPR determines what such consent has to look like in order to be valid.
What is decisive is the wording of § 109(8) of Act 452/2021 Coll. It does not mention cookies at all. It speaks of storing information on a terminal device and of gaining access to it, which covers local storage, session storage, pixels and browser fingerprinting techniques.
When consent is not required
The Act recognises two exceptions. The first is storage or access whose sole purpose is to transmit or facilitate the transmission of a message over a network.
The second is what is strictly necessary to provide an information society service that the user has expressly requested. That covers logging in, the contents of a basket, load balancing or a remembered language.
Analytics do not fall under the exception, not even where they serve the operator's own statistics only. The user did not ask for them and the site works the same for the user without them.
What consent has to look like
It must be demonstrable, so the site must be able to show who gave it, when and to what extent.
It must be given in advance. A script that loads before the user clicks makes the banner pointless, even where the user then refuses.
The Act does not itself set out the requirements for consent; it refers to a separate regulation, which is the GDPR. Under it, consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give.
It follows from the requirement that consent be freely given that a pre-ticked box or continued browsing is not consent, and that refusing may not be substantially harder than accepting. This is exactly what supervisory authorities object to in banners where accepting takes one click and refusing takes three.
What this means for a website operator
The operator has to know what the site stores on the device. Without a list there is no way to say what is necessary and what needs consent; most items are added by third-party tools without anyone noticing.
If a site uses no cookies other than the necessary ones, it does not need a banner. An unnecessary banner is not the safer option, it only makes the experience worse.
Information about what is stored and for how long belongs in a document that is available without consent being given.
What the statute says word for word
The wording comes from the same verified corpus of statutes the Paragrafo advisor runs on. Every link opens Slov-Lex, the official register, so you can compare it yourself.
Každý, kto ukladá alebo získava prístup k informáciám uloženým v koncovom zariadení užívateľa, je na to oprávnený iba ak užívateľ udelil preukázateľný súhlas spĺňajúci náležitosti podľa osobitného predpisu.To nebráni technickému uloženiu údajov alebo prístupu k nim, ktorých jediným účelom je prenos alebo uľahčenie prenosu správy prostredníctvom siete, alebo ak je to bezpodmienečne potrebné pre poskytovateľa služieb informačnej spoločnosti na poskytovanie služby informačnej spoločnosti, ktorú výslovne požaduje užívateľ.Common misconceptions
A banner with an accept button only
The Act requires consent meeting the requirements of the GDPR, and the first of them is that it be freely given. If one click only lets the user accept and refusal is hidden two levels deeper in the settings, there is no free choice.
Scripts load before the decision is made
The most common mistake in practice. The banner appears, but the measurement code is already running. Consent is then given for something that has already happened.
A cookie policy is confused with a privacy policy
These are two documents with different purposes. A cookie policy describes what is stored on the device and for how long. A privacy policy describes the processing of personal data as a whole.
The assumption that the rule applies to cookies only
The Act speaks of information stored on a terminal device. From the point of view of consent, local storage, session storage and similar techniques are in the same position as cookies.
Frequently asked questions
Does every website need a cookie banner?
No. If a site stores on the device only what is strictly necessary for a service the user requested, consent is not required and no banner is needed. It is always needed once analytics or marketing tools are added.
Is Google Analytics a necessary cookie?
No. The user did not ask for traffic measurement and the service works the same without it, so it does not fall under the exception in § 109(8) and requires consent.
Is it enough for the information about cookies to be in the privacy policy?
The duty to inform can be met that way, but consent cannot. Consent must be given by a separate active act of the user before information is stored on or read from the user's device.
How long does consent last?
The Act sets no specific period. Consent must, however, remain demonstrable and revocable, which is why in practice it is renewed when the scope of the stored information changes.
Documents this affects
Have a more specific question?
The Paragrafo advisor answers from the wording of Slovak statutes and names the provision each answer rests on.
Ask the advisor