The European Commission’s draft ePrivacy Regulation appears to transfer legal responsibility for the storage and retrieval of cookies from websites to web browsers. However, where the subsequent processing of cookies involves personal data, website operators will still be responsible for ensuring this complies with the General Data Protection Regulation. Applying general, rather than specific, legislation to this processing should result in a better experience for both the operators of websites and their users.