This paper examines the European and Croatian legal framework relevant for the regulation of cookies. Specifically, an analysis of the provisions of the ePrivacy Directive regarding consent related to the General Data Protection Regulation is conducted. The criteria of valid consent for cookies are examined in particular detail, as well as exemptions when consent is not required. In order to clarify these criteria, the stances of the European Data Protection Board are explained, as well as the case law of the Court of Justice of the European Union. Moreover, an analysis is conducted regarding the national implementation of the ePrivacy Directive through the Electronic Communications Act, as well as the activities of the Croatian regulatory bodies. Subsequently, a study regarding cookies is carried out on the most popular Croatian websites. The collected data is compared with previous domestic and global studies. Furthermore, the conducted research examines cookie banners and privacy policies on select domestic websites. Specifically, examples of websites that are not in accordance with the legal framework are shown. Finally, the provisions of the proposal for the ePrivacy Regulation are analysed. Both positive and negative aspects of the proposed regulation are considered. In addition to ePrivacy Regulation proposal, other solutions are presented that will affect the way cookies are utilized in the future.