Skip to main content
Cookie Gate
Category: Tracking Technologies

Terminal Equipment Storage

Also known as: storage on terminal equipment, storage and access technologies
Simply put

Terminal equipment storage refers to the placing of information onto, or reading of information from, a device that a person uses to connect to a network, such as a computer, smartphone, or tablet. Cookies are the most familiar example, but the concept also covers other technologies that write to or read from a user's device. In the UK, rules on this activity fall under the Privacy and Electronic Communications Regulations (PECR).

Formal definition

In the context of UK ePrivacy law, 'terminal equipment' is the device belonging to a subscriber or user, and PECR applies to any technology that stores information on, or gains access to information stored on, that terminal equipment. This scope is technology-neutral: it captures cookies as well as similar techniques such as pixels, local storage, software development kits (SDKs), and device fingerprinting, so long as they involve storage on or access to the device. The rules generally require prior, informed consent for such storage or access, subject to exemptions (for example, activity strictly necessary to provide a service the user has requested); the concepts of 'terminal equipment' and 'subscriber or user' derive from the underlying ePrivacy framework, and equivalent provisions exist under the EU ePrivacy Directive as implemented in individual Member States. Note that the term 'terminal equipment' also has an unrelated general telecommunications and engineering meaning (for example Data Terminal Equipment); this entry addresses only its use in the storage-and-access context. The consent obligation for placing or accessing information sits under ePrivacy rules, while any subsequent processing of personal data is separately governed by the GDPR (or UK GDPR).

Why it matters

Terminal equipment storage sits at the heart of cookie and tracking compliance because it defines the trigger point for legal obligations. In the UK, PECR applies whenever a technology stores information on, or accesses information stored on, a subscriber's or user's terminal equipment. This means the rules attach to the act of writing to or reading from the device itself, independently of whether personal data is later processed. Understanding this scope helps organisations identify which of their web and app activities fall within ePrivacy consent requirements in the first place.

The concept matters most because it is deliberately technology-neutral. Focusing only on cookies risks overlooking pixels, local storage, SDKs, and device fingerprinting, which can all involve storage on or access to a device and therefore generally attract the same consent obligations. Teams that scope compliance narrowly around the word 'cookie' may leave equivalent tracking techniques unaddressed, creating gaps between what they disclose to users and what actually happens on the device.

A further reason for care is the layered legal analysis. The consent obligation for placing or accessing information sits under ePrivacy rules such as PECR, while any subsequent processing of personal data is separately governed by the UK GDPR (or the GDPR in EU Member States). Treating the two regimes as a single step can lead organisations to assume that satisfying one automatically satisfies the other, which is not the case. Because enforcement positions and regulator guidance in this area continue to evolve, professionals should treat the boundaries of specific exemptions as fact-dependent rather than settled.

Who it's relevant to

Privacy and data protection officers
Those responsible for compliance need to map where storage and access technologies operate across their organisation's websites and apps, because the terminal equipment concept defines which activities fall within PECR and require consent. This includes technologies beyond cookies, such as pixels, local storage, SDKs, and fingerprinting.
Legal and compliance counsel
Legal teams advising on ePrivacy and data protection must distinguish the consent obligation for storage and access under PECR from the separate obligations governing any resulting personal data processing under the UK GDPR. They also need to assess whether specific activities qualify for exemptions such as strict necessity, which is fact-dependent and can be contested.
Web and app developers
Developers implementing tracking, analytics, and functional features determine, at a technical level, when a service writes to or reads from a user's device. Understanding that any such storage or access can trigger consent requirements, regardless of whether a cookie is involved, helps ensure that consent gating is applied before the activity occurs.
Marketing and analytics teams
Teams deploying measurement pixels, advertising tags, and third-party SDKs should recognise that these techniques generally fall within the same storage-and-access rules as cookies. Scoping compliance around the term 'cookie' alone risks overlooking equivalent technologies that also require consent under UK ePrivacy rules.

Inside Terminal Equipment Storage

Storage of Information on Terminal Equipment
The act of placing information, such as cookies, into the storage of a user's device (the terminal equipment). Under the ePrivacy Directive and its national implementations in the EU, this act is regulated in its own right, independently of whether the stored information constitutes personal data.
Access to Information Already Stored
The complementary act of reading or gaining access to information already held in the terminal equipment. In most EU jurisdictions, both storing and accessing information trigger the ePrivacy consent requirement, subject to limited exemptions.
Terminal Equipment
The user's device on which information is stored or from which it is accessed, such as a computer, smartphone, tablet, or connected device. The concept is generally framed around the user's equipment rather than the specific technology used to store data.
Technology-Neutral Scope
The rules typically apply regardless of the mechanism used. Beyond HTTP cookies, this can include local storage, SDKs, pixels, software identifiers, and certain fingerprinting techniques, because these also involve storing or accessing information on the device. The literal use of a cookie is not required for the rules to apply.
Consent Requirement and Exemptions
In most EU jurisdictions, prior consent is required before storing or accessing information, unless an exemption applies. Common exemptions relate to storage or access that is strictly necessary to transmit a communication or to provide a service the user has explicitly requested. Analytics and advertising storage generally fall outside these exemptions.
Relationship to the GDPR
The ePrivacy rules govern the storing and access itself, while the GDPR governs any subsequent processing of personal data that results. These are separate legal regimes, and satisfying one does not automatically satisfy the other.

Common questions

Answers to the questions practitioners most commonly ask about Terminal Equipment Storage.

Does the rule against storing information on terminal equipment only apply to cookies?
No. The ePrivacy Directive's provisions on storing or accessing information on a user's terminal equipment are technology-neutral. They apply not only to cookies but also to similar techniques such as tracking pixels, local storage, software development kits (SDKs) in apps, and device fingerprinting. The relevant question is generally whether information is being stored on, or read from, the user's device, not the specific technology used to do so. As a result, replacing cookies with an alternative storage method does not by itself remove the obligation to obtain consent where consent would otherwise be required.
If I have a lawful basis under the GDPR, does that mean I can store information on a user's device without separate consent?
Not necessarily. The storing of, or access to, information on terminal equipment is governed by the ePrivacy rules, which in most EU jurisdictions require prior consent unless an exemption (such as strict necessity for a service explicitly requested by the user) applies. Any subsequent processing of personal data is separately governed by the GDPR. These are distinct legal questions. Satisfying a GDPR lawful basis does not automatically satisfy the ePrivacy requirement for the storage or access step, and the two should be assessed independently.
When do I need consent before storing information on a user's device?
In most EU jurisdictions, prior consent is generally required before storing or accessing information on a user's terminal equipment, unless a recognized exemption applies. The commonly cited exemptions cover storage that is strictly necessary to transmit a communication or to provide a service the user has explicitly requested. Storage tied to analytics, advertising, or non-essential functionality typically falls outside these exemptions and generally requires prior consent. The precise scope of exemptions can vary between national implementations and evolving regulator guidance, so the specific facts of each use case matter.
How should consent for terminal equipment storage be captured to be considered valid?
Where the applicable framework relies on consent, valid consent under the GDPR standard must be freely given, specific, informed, and unambiguous, and given through a clear affirmative action taken before storage or access occurs. Pre-ticked boxes, reliance on continued browsing as implied consent, and cookie walls are widely considered problematic or non-compliant in the EU. Practically, this often means presenting a consent interface that allows genuine choice per purpose or category before non-exempt storage takes place. Requirements differ under other regimes, such as certain US state laws that rely on opt-out rather than opt-in.
How can I identify all forms of terminal equipment storage on my website or app?
A practical approach is to audit the technologies operating in your environment, since the obligation can attach to cookies as well as pixels, local storage, SDKs, and fingerprinting techniques. This typically involves scanning or inspecting what is written to and read from the device, mapping each item to a purpose, and identifying which entries may qualify for an exemption and which may require prior consent. Because this depends on technical facts specific to your implementation, the classification of any given item should be reviewed against current guidance rather than assumed.
What records should I keep about terminal equipment storage and the consent obtained?
Where consent is the basis for storage or access, organizations are generally expected to be able to demonstrate that valid consent was obtained. This often involves logging or record-keeping showing what the user was presented with, what they chose, and when. Consent management platforms (CMPs) can support this record-keeping, but a tool does not by itself guarantee compliance and does not replace legal judgment about whether the consent captured meets the applicable standard. The specific retention and documentation expectations can vary by jurisdiction and regulator guidance.

Common misconceptions

The rules on storing and accessing information only apply when personal data is involved.
In most EU jurisdictions the ePrivacy rules on terminal equipment apply to the act of storing or accessing information regardless of whether that information is personal data. Separately, if personal data is processed, the GDPR also applies.
Only cookies are covered by these requirements.
The rules are generally technology-neutral. Local storage, SDKs, pixels, software identifiers, and certain fingerprinting techniques can also involve storing or accessing information on terminal equipment and may fall within the same requirements, even though they are not literally cookies.
Any technology that is technically necessary for the website to function is automatically exempt from consent.
Exemptions are typically narrow, generally covering storage or access strictly necessary to transmit a communication or to provide a service explicitly requested by the user. Whether a specific use qualifies depends on the facts, and categories such as analytics and advertising generally do not qualify in EU jurisdictions.

Best practices

Assess each storage or access operation on the device separately from any downstream data processing, and evaluate ePrivacy obligations and GDPR obligations as distinct questions.
Inventory all technologies that store or access information on user devices, including cookies, local storage, SDKs, pixels, and fingerprinting techniques, rather than limiting the review to cookies.
Apply exemptions narrowly and document, on a case-by-case basis, why a given operation is strictly necessary or explicitly requested, rather than treating broad categories as exempt.
Obtain prior consent for non-exempt storage and access in EU jurisdictions before the storing or accessing occurs, using clear affirmative action rather than pre-ticked boxes or implied consent.
Confirm the geographic and legal scope of your obligations, since requirements differ between the EU, the UK, and individual US states, and adjust the consent approach accordingly.
Treat consent management tools as support for compliance rather than a guarantee of it, and pair them with documented legal assessment of which operations require consent.