\begin{table}[h]
\centering
\begin{tabular}{lcccc}
\hline
Interpretation & First-party & Technical third-party & Non-technical third-party & Profiling \\
\hline
A &  &  &  &  \\
B &  &  &  & $\checkmark$ \\
C &  &  & $\checkmark$ & $\checkmark$ \\
D &  & $\checkmark$ & $\checkmark$ & $\checkmark$ \\
E & $\checkmark$ & $\checkmark$ & $\checkmark$ & $\checkmark$ \\
\hline
Type of cookie & First-party & Technical third-party & Non-technical third-party & Profiling \\
Examples & Authentication, user-input memory, security & Multimedia player settings, load balancing & Social plug-ins, performance analytics & Behavioral advertising, tracking services \\
\hline
\end{tabular}
\caption{Cookies subject to consent in different interpretations of the ePrivacy Directive. We verify violations according to (B).}
\label{table_4}
\end{table}

essential and, thus, not exempted. This is the case of profiling cookies.

However, such guidelines are not part of the ePrivacy Directive. Hence, the definition of a ``necessary element'' to offer a service is subject to interpretation by National Data Protection Authorities. We illustrate different approaches in Table~\ref{tab:table_4}, based on different definitions of necessary cookie. Helped by Opinion 04/2012, we identify four types of cookies, represented as columns in the table. Starting from the left, they are sorted from the most to the least likely to be necessary. Indeed, first-party cookies are very likely to be necessary (e.g., for authentication), while profiling cookies, installed by e.g., behavioral advertising platforms, are very far from being essential. We then formalize five different interpretations of the ePrivacy Directive that differ in the type of cookies subject to consent. The most permissive approach (A) represents the extreme scenario where no cookie is subject to consent, that clearly breaks the spirit of the Directive. On the opposite side, the approach (E) represents the strictest interpretation, which mandates that all cookies need prior consent. In this work, we verify the compliance to the interpretation (B), which is the most tolerant approach that mandates consent for some kind of unnecessary cookies. According to (B), only profiling cookies need prior users' consent, while all others do not. Thus, our definition of violations becomes very conservative -- i.e., we prefer to neglect some violations, than to incur false positives.

\subsection{7.2.2 Transposition into national legislation}

The European regulatory landscape is not homogeneous. All EU MSs must transpose EU Directives into their legislation as a minimum level of harmonization. As such, EU MSs have transposed the ePrivacy Directive in different ways \cite{44,56}. For the sake of simplification, we group such transpositions into three categories. A graphical representation of ePrivacy Directive interpretations (and EU MSs of application) is provided in Figure~\ref{fig:figure_12}.

\begin{figure}[h]
\centering
\includegraphics{figure_12.pdf}
\caption{ePrivacy Directive transposition into EU MSs legislation.}
\label{figure_12}
\end{figure}

(i) The strictest category prescribes the opt-in mechanism -- i.e., the user must provide consent. The consent must be obtained before cookies are used. This interpretation is in force in 11 EU MSs.

(ii) More flexible interpretations allow the consent to be implied -- i.e., inferred from the behavior of the user. In other words, consent can be conveyed by clicking a link or scrolling through a website. In 9 MSs, regulations allow implied consent.

(iii) Tolerant interpretations of the ePrivacy Directive do not require consent. The website must show a Cookie Bar warning users about the use of cookies, that can