Cookies in Slovakia: consent under Section 109(8) of the Electronic Communications Act
You may store or read information on a user’s device (cookies, localStorage, pixels, fingerprinting) only with their demonstrable consent. The exception is technically necessary storage. The Slovak regulator ÚRSO, together with the Personal Data Protection Office, requires refusing to be as easy as consenting.
Key points
- Legal basis: Section 109(8) of Act No. 452/2021 Coll. on electronic communications (zákon o elektronických komunikáciách); consent must meet the GDPR standard.
- Consent must be obtained before cookies are stored — not after the fact.
- Without consent, only cookies necessary to transmit a communication or for a service the user has expressly requested are allowed.
- A “Reject all” button should be on the first layer of the banner, next to “Accept all”.
- No pre-ticked categories; closing the banner with the cross is not consent.
- Withdrawing consent must be as easy as giving it.
Uncertain The EU is negotiating the Digital Omnibus package, which would change the cookie rules. Until it is adopted, the current Section 109(8) and the ÚRSO opinion apply.
What this is about
Section 109(8) of Act No. 452/2021 Coll. on electronic communications requires the user’s demonstrable consent for storing information on their terminal equipment or accessing it. This is not just about cookies in the narrow sense — it equally covers localStorage, pixels, SDKs in apps and other techniques that work with the user’s device.
The Regulatory Authority for Electronic Communications and Postal Services (Úrad pre reguláciu elektronických komunikácií a poštových služieb, ÚRSO), together with the Personal Data Protection Office (Úrad na ochranu osobných údajov), has issued an opinion explaining what consent it considers valid. Consent must meet the GDPR standard: freely given, specific, informed and unambiguous.
When consent is not needed
Without consent you may only use technical storage or access whose sole purpose is to transmit a communication over a network, or which is strictly necessary to provide a service the user has expressly requested. Typically:
- a session cookie for login or a shopping basket,
- storing a language choice that the user made themselves,
- security mechanisms, for example form protection.
Analytics, A/B testing, remarketing, advertising pixels and most embedded third-party content (maps, videos, social media) are not strictly necessary. You should describe even the strictly necessary cookies in your cookie information.
What ÚRSO expects from a cookie banner
| Element | Yes | No |
|---|---|---|
| Timing | Consent before cookies are stored | Storing cookies and asking afterwards |
| Choice | “Accept all” and “Reject all” on the first layer | Rejection hidden in the settings |
| Granularity | Separate consent for each purpose | One consent “for everything” |
| Default setting | Necessary on, everything else off | Pre-ticked categories |
| Wording | “I agree”, “Accept” | “I understand” (acceptable only for strictly necessary cookies) |
| Closing with the cross | Treated as a refusal | Treated as consent |
| Content blocking | The site works without consent | A full-page banner that will not let you through without consent |
| Withdrawal | As easy as giving consent (link in the footer) | Having to write an e-mail |
The Office also recommends recording consent in a provable way and asking again after a reasonable period — it mentions 12 months.
The simplest route: don’t use cookies that need consent
If a website does not need third-party analytics or advertising, the cleanest solution is not to have such cookies at all. Then you do not need a cookie banner either — a statement that the site does not use cookies requiring consent is enough. This LAWIT website is built exactly that way.
The link with the GDPR
If you obtain personal data through cookies and process them further (e.g. profiling for advertising), you also need a legal basis for that processing under Article 6 GDPR. The opinion states that the most suitable basis will usually be consent.
What to do
- Take stock: which cookies and third-party scripts the site loads before any click.
- Block analytics and marketing scripts until the user gives consent.
- Add “Reject all” to the first layer of the banner and remove pre-ticked boxes.
- Add a permanent “Cookie settings” link to the footer for withdrawing consent.
- Keep a record of consent so that you can prove it.
Sources
- ÚRSO: Opinion on obtaining consent under Section 109(8) of Act No. 452/2021 Coll. (in Slovak)
- Act No. 452/2021 Coll. on electronic communications — Zákony pre ľudí (in Slovak)
- Podnikajte.sk: Cookies and the rules for processing them from 1 February 2022 (in Slovak)
- Regulation (EU) 2016/679 (GDPR) — EUR-Lex
Sources checked on 12 October 2026. How we correct errors.