Cookie Law: What Slovenian legislation requires of websites

Cookie Law: What Slovenian Legislation Requires from Websites

Yes, Slovenian legislation requires prior, informed, and demonstrable consent for all non-essential cookies. The key regulations are ZEKom-2 and the GDPR, with oversight carried out by the Information Commissioner. The only exceptions are technically essential cookies and cookies needed to transmit a communication. Violations can be penalized, so every website operator needs to be able to prove when and how a user gave their consent.

In short:

• Valid cookie consent must be freely given, specific, informed, unambiguous, and demonstrable, and the consent management system needs to support this.
• Non-essential cookies, such as advertising, analytics, and personalization cookies, can only run with the user's explicit consent, apart from technically essential cases.
• The consent management system must block non-essential scripts until the user confirms, and must log the time, source, and content of their decision.
• Implementing compliance requires an inventory of cookies, correct categorization, preparing a cookie policy, choosing the right tool, and regularly testing that it works.
• Oversight is carried out by the Information Commissioner and the European Data Protection Board, and fines of up to 1,000 EUR can be issued for violations.

Table of Contents

• What cookies are, and which tracking technologies the law covers
• The legal framework in Slovenia: ZEKom-2 and its connection to the GDPR
• When you need consent, and what exceptions are allowed
• What valid consent means, and what technical conditions it must meet
• A step-by-step path to compliance on your website
• Oversight and penalties: the role of the Information Commissioner
• A practical checklist for website owners
• Moxy-web: experience implementing cookie compliance
• When it's worth entrusting compliance to an expert
• Sources
• Frequently asked questions

What cookies are, and which tracking technologies the law covers

A cookie is a small text file a website stores on your computer or phone so it can "remember" settings, a login, or behavior on your next visit. But the law doesn't just cover classic cookies — it covers any storage of, or access to, data on a user's device.

That means technologies many people overlook are covered too:

• Local storage and session storage in the browser, which applications use to store session data.
• Web beacons, or tracking pixels, which measure whether an email was opened or a page was visited.
• Digital fingerprinting, where a site identifies a device through a combination of browser settings, without a classic cookie.
• Flash or local shared objects, which are rarer but still present on older systems.

For a website, this means any analytics tool, advertising pixel, or content-personalization tool falls under the same legal framework as an ordinary cookie.

The legal framework in Slovenia: ZEKom-2 and its connection to the GDPR

The core regulation is the Electronic Communications Act (ZEKom-2), whose provision known as the cookie article requires that storing data, or accessing data, on terminal equipment is only allowed if the user has been clearly informed in advance and has given consent. The law also sets out the exceptions and the scope of regulatory oversight.

ZEKom-2 defines when consent is required. The GDPR defines what counts as valid consent. The General Data Protection Regulation requires that every consent be freely given, specific, informed, and unambiguous, which also applies to cookies that process personal data.

The Information Commissioner notes that the legal protection under ZEKom-2 applies regardless of whether a cookie actually involves personal data. The mere fact of storing or accessing data on a device is enough to trigger it. As a website operator, you therefore need to comply with both regulations at once, not just whichever one seems stricter.

Practical implementation guidance largely draws on documents from the Information Commissioner and opinions from the European Data Protection Board (EDPB), which coordinate interpretation across the EU.

When you need consent, and what exceptions are allowed

Most cookies used on websites today fall into the non-essential category. This includes:

• Advertising cookies and remarketing pixels.
• Analytics tools, apart from the rare ones that operate strictly anonymized, without storing identifiers.
• Cookies for content personalization, recommendation systems, and A/B testing.

The law allows only two exceptions. The first is a cookie strictly necessary for transmitting a communication over an electronic communications network. The second is a cookie the user explicitly requires in order to use a service they themselves asked for — a shopping cart cookie in an online store, say, or one that keeps a user logged in.

What matters is the user's perspective, not the operator's. A feature that's commercially important to you as the site owner isn't automatically "essential" in the legal sense. Monetization through advertising, for instance, is never an exception, even though the site might not be financially viable without it.

What valid consent means, and what technical conditions it must meet

The GDPR sets five conditions for consent: it must be freely given, specific, informed, unambiguous, and demonstrable. Each of these conditions carries a direct technical consequence for your website.

A pre-ticked consent box isn't valid, since the user didn't actively make a choice. The same applies to a banner that installs cookies the moment a visitor arrives, only offering the option to decline afterward. A setup like that doesn't comply with ZEKom-2 or GDPR requirements, since consent arrives too late.

Technically, you need to ensure three things:

1. A Consent Management Platform that clearly breaks cookies down into categories and allows separate consent for each one.
2. Blocking non-essential scripts until the user actually confirms consent — not merely until the banner is displayed.
3. Logging proof of consent, including the time, source, and content of the user's choice.

Pro tip: Declining needs to be just as easy as accepting. The "reject all" button should be visually equal to the "accept all" button, since an unbalanced layout is considered hidden pressure toward consent.

A step-by-step path to compliance on your website

Compliance isn't a one-time fix — it's a process that needs to be maintained with every change to the tools on your site.

1. Take an inventory of your cookies. Check which tools, analytics, and advertising pixels are actually running on your site.
2. Categorize the cookies by purpose: essential, analytics, functional, advertising.
3. Draft a cookie policy that clearly separates essential cookies from those requiring consent, including how long each is retained.
4. Choose a CMP and connect it to every script that loads cookies.
5. Block non-essential scripts until consent is confirmed, ideally with asynchronous loading that doesn't slow down the page.
6. Test and document how it works across different devices and browsers.

For online stores, the picture is more complex. Transaction tracking, purchase-journey analytics, and remarketing campaigns often run in parallel, which makes correctly integrating your scripts even more important for a store than for a simple brochure site. A cart cookie is an exception; a remarketing cookie is not, even though both may appear to "help" with the purchase.

Oversight and penalties: the role of the Information Commissioner

Enforcement of cookie rules is carried out by the Information Commissioner, who can issue a fine of up to 1,000 EUR per individual violation, and can also order other administrative measures. In practice, inspections most often check whether a site displays a consent mechanism at all, and whether it actually blocks scripts before consent is confirmed.

As an operator, you need to keep records of consents obtained, a valid cookie policy, and technical documentation proving how the system works. Without this evidence, it's difficult to demonstrate compliance, even if the system is actually set up correctly.

A practical checklist for website owners

Before diving into the technical implementation, ask yourself which of the following already holds true for your site, and which doesn't.

• Do you have a complete list of every cookie and tracking technology on your site?
• Does your cookie policy clearly separate essential cookies from consent-based ones?
• Are non-essential scripts actually blocked until consent is confirmed?
• Do you log the time, source, and content of every consent?
• Do you regularly check that new tools (a new pixel, a new plugin) haven't bypassed your consent system?

For small businesses, it makes sense to order priorities as follows:

When integration involves multiple advertising networks, complex analytics systems, or an online store with remarketing, it's worth seeking professional technical or legal help, since a mistake in blocking a single script can invalidate compliance across the entire site.

Moxy-web: experience implementing cookie compliance

In working with clients, three mistakes come up most often: a cookie wall that doesn't let a user view the site without consenting to every category; unlogged consents that can't be produced during an inspection; and scripts that load before consent is confirmed because the CMP was only set up visually, not technically.

A consent management system is often integrated directly into the site's code, rather than added as an afterthought layered over the existing setup, which allows non-essential scripts to be blocked until consent is confirmed and every consent to be logged with enough data to serve as proof if needed. Once the system is in place, we regularly test it with every major change to the site, since a new advertising tool or plugin can quickly break compliance.

— Ziga

When it's worth entrusting compliance to an expert

Manually hunting for scripts in your code and guessing which cookie is "essential" quickly becomes risky, especially for an online store with multiple advertising networks or a site with a decade of installed plugins behind it. When building or redesigning websites, stores, and applications, Moxy-web handles cookies during development itself, not as a fix tacked on after the project wraps up, which means fewer surprises if you're ever inspected.

It's worth seeking help when you have complex integrations with external systems, an online store running remarketing, or simply don't know which of the ten scripts on your site actually needs consent. The team can take an inventory of your existing cookies, set up technical blocking of scripts until consent is confirmed, and advise on drafting your cookie policy, while also handling hosting and long-term site maintenance. To ask about implementation or a site redesign, visit the Moxy-web homepage and describe the scope of your site or store.

Sources

For the exact text of the regulations, check Article 157 of ZEKom-2 and the Information Commissioner's guidelines on cookies. An overview of GDPR requirements for online privacy at the EU level is also useful. For a broader look at compliance in specialized services, the guide to GDPR compliance in language services is a helpful resource too.

• EU — Online privacy: what businesses need to do (Slovenian)
• Information Commissioner — Cookies: answers to frequently asked questions
• Legislation (Zakonodaja)

Frequently asked questions

Does Slovenian law require consent for every cookie?

No — the exceptions are technically essential cookies and cookies needed to transmit a communication. For all others, including analytics and advertising cookies, prior, informed consent is required.

Which law governs cookies in Slovenia?

The core regulation is ZEKom-2, complemented by the GDPR in defining what counts as valid consent. Enforcement is carried out by the Information Commissioner.

What's the fine for non-compliance with cookie rules?

The Information Commissioner can issue a fine of up to 1,000 EUR per individual violation, and can also order other administrative measures.

Does an online store need a special cookie consent tool?

The law doesn't prescribe a specific tool, but in practice a Consent Management Platform (CMP) is needed to block scripts and log proof of consent. Moxy-web integrates such a system directly when building or redesigning a website.

What counts as proof of valid consent?

A record of the time, source, and content of the user's choice, which you need to retain and produce on request during an inspection. Without these records, compliance is hard to demonstrate, even if the technical setup is correctly configured.

Recommended

• Website Data Security Without Guesswork
• A Legally Compliant Online Store in Slovenia: What You Need to Set Up
• How to Protect Forms from Online Abuse
• The Best Ways to Protect User Data