When an EU directive is repealed, what happens to member state law? It's my understanding that when the EU make a directive, member states then transpose it into force, usually with legislation. But what happens when an EU directive is repealed? Do member state laws also get repealed automatically? Or is it up to the member state to choose what they do, if anything? And in practice, is there a case that usually happens?
The point of directives is that they concern areas of law where the EU does not legislate directly. They create a requirement that member states must achieve through their own legislation. In the EU's own words A "directive" is a legislative act that sets out a goal that all EU countries must achieve. Were a directive to be repealed, it would remove a constraint on national law. That would not automatically lead to a repeal of national law. Of course, national law itself could have a provision effecting the automatic repeal, but that might be problematic because most repeals seem actually to be modifications or recodifications, where national legislatures might be better off amending their transposing legislation rather than replacing it.
The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.) As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid: This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data. However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site. So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.
If the GDPR applies, then the e-privacy directive (EPD) (formally Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002) almost surely also applies. However, this being a directive rather than a regulation, the implement6ing laws may vary in different countries. The relevant provision is Article 5 paragraph (3) which reads: Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia [among others] about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. This governs cookies and any other local data, that is, data stored on or read from the user's equipment. What this means is: A site operator must disclose, in detail, what cookies or other local data the site stores on or reads from the user's device. Even strictly required data (cookies) must be disclosed. A site may not store or read any local data until after consent has been obtained. The user must have the option to consent to or refuse consent to individual data items separately. Giving consent may not be a condition of permission to use the site. Consent must be opt-in, not opt-out, that is the default must be &quot;No consent&quot;. Local data (including cookies) that is &quot;strictly necessary&quot; for the operation of the site is exempt from the requirement of consent, but not from the requirement of disclosure, and that means specific disclosure. It must be at least as easy to cancel consent later as it was to give consent initially. Do my Stripe cookies count as essential cookies? If the Stripe cookies count as essential, is it legal to provide no option to turn them off? Have I met my legal requirements in terms of disclosure? The terms and conditions and privacy policy were generated by Termly. I don't know stripe well enough to be sure, but they might. What do they do that is essential for operating the site? Yes. No, not if the disclosures in the question are the only ones you make. As I understand it, you must provide at least a link to a page that shows each specific cookie that you read or set, and what data is stored in that cookie, even for strictly required cookies. Update: I should mention t6hat although the above describes my understanding of the current legal requirements, I have read that enforcement of those requirements does not seem to be a priority for the relevant authorities at this time. Other aspects of data protection, such as proper security to avoid data breaches, and having a proper legal basis for processing, and other GDPR requirements, as opposed to e-Privacy requirements, seem to get more attention and resources from the relevant authorities. Having read the comment by the OP, it does seem that at least some of the stripe cookies are strictly required and need not have consent. The stripe cookie policy linked to is better than many sites currently offer. It does not go into fully specific detail, but it may be that the dashboard does, and that together the two are fully compliant. Linking to this policy (and if possible directly to the stripe cookie dashboard) would seem to me to cover most of the issues here.
Testing the law means running a case under that law and having a court rule on it. In common law jurisdictions, the judiciary does not give opinions on whether a bill proposed or an act passed by the legislature is legal or not - they decide controversies that arise under those acts. The executive is obliged to follow the law so if they do something the law prohibits or don’t do something the law requires then someone with standing (usually someone affected by that act or omission) can take them to court and seek an order for them to stop (an injunction) or to do what they are required to do (a writ of mandamus). In the present situation, it’s my understanding (and I may be wrong) that Parliament has enacted a law that requires the Executive (in the person of the relevant Minister of the Crown) to request an extension from the EU if Parliament has not approved a Brexit deal. Testing the law would mean the Minister not doing that or stating an intention not to do it. A person with standing can then petition the court for a writ of mandamus requiring the Minister to do it. If the Minister still refuses they would be in contempt and subject to being gaoled until they did.
The legal line is EU laws, with some considerations (at the time of enacting them) about what other countries and international organizations (like the WTO) reactions. The practical line is enforcement. As the country with the biggest stick (not only militarily but economically) the USA provides the best examples: the ongoing Huawei affair, with one tip executive arrested on the grounds of a Chinese company selling technology to NK. the Helms-Burton Act that punishes foreign companies trading with Cuba, and that asserts that USA courts can decide on issues of private property in Cuba. the Iran embargo. In the Google case, it is even simpler. If Google wants to do business in the EU, it must follow EU law like everyone else (same happens in the USA and elsewhere). The fact that parent company is registered in the USA is not relevant. And probably, the fine has been issued not to the parent company but to the subsidiary registered within the EU. In the John Doe CASE, France (not the EU) could try first to seize any of his assets in France and, if those are not enough, go to the USA courts and try to have them enforce its judgements. But if what John did was not illegal in the USA then the courts would probably refuse to do so. That does not mean that John is guaranteed to be immune to any consequences, as France could block international money transfers to John's accounts, force Amazon (or whoever) to make his shop unavailable in France, block his page, and even issue an international warrant that would mean that Jhon would have the risk of being arrested if he ever leaves the USA.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
Regulations - Yes, Acts of Parliament - very rarely In in the united-kingdom diagrams are found in regulations, for example legislation dealing with roadside symbols. There are two kinds of legislation in the UK: Acts of Parliament and Statutory Instruments (normally called Regulations). The procedure by which an Act of Parliament is passed is that it has to be approved by both Houses of the legislature and then receive Royal Assent (Royal Assent is a formality). The procedure in each House is that the main debates occur at the Committee Stage when amendments are proposed and voted on. At the next stage (Third Reading) the House votes again on whether to approve the Bill in its amended form. Statutory Instruments (Regulations) are issued by the government (executive) and are known as delegated legislation because the government only has power to issue a regulation if an Act (called the parent Act) gives it power to do so. As you would expect there are safeguards. First of all the courts can declare invalid (ultra vires) any regulation whose terms go outside the limits of the power delegated by the Parent Act. Sometime the parent Act will provide that Regulations issued by the government under delegated powers become law without further involvement of Parliament but sometimes an Act will provide for some limited further Parliamentary scrutiny. This can be either by the Positive Resolution (the regulation will not become law until Parliament approve it) or by the Negative Resolution procedure (the regulation will become law unless Parliament passes a resolution annulling it). A key point, in the context of the question, is that neither the Positive nor the Negative Resolution procedure allows Parliament to amend the regulation - Parliament only has a binary choice to approve or disapprove. Of course if they disapprove then the government can issue a new amended regulation which then goes through the same process but the Positive/Negative resolution procedure does not allow Parliament itself to amend any regulation. I think this explains why diagrams which are sometimes found in regulations are rarely found in Acts. Constitutional proprieties require any Bill to be amendable and any member of the legislature can propose a amendment. If the Bill included diagrams then there would be huge practical problems because any member who wanted to amend a diagram would have to produce his own amended diagram which he might not be able to do/might not have time to do before parliamentary deadlines. So constitutional proprieties would normally mean that in practice Bills must be solely words. Regulations however cannot be amended by Parliament (see above) so such considerations do not prevent regulations from containing diagrams. Having said that normally Bills will only contain words, there is this example of an Act which includes a diagram of a symbol. That symbol, however, is defined in an international convention so in practice no parliamentarian would want to amend it. I know of no examples in the UK where a Bill (as distinct from regulations) contains an image which a member of the legislature might want to propose an amendment to.
The EULA is in most jurisdictions a legally binding contract; there is plenty of case law that supports this. You can only be liable under a contract for breaching its terms and only to the extent that the other party suffers harm from that breach. Clearly, if you haven't read the terms then you are greatly increasing the chance that you will inadvertently breach them but not reading them would not, of itself, be a breach and I can't see what harm could flow anyway.