The ePrivacy directive (Article 5(3)) requires prior informed consent for storage (or access) of information stored on a user's terminal equipment.
In other words - you must ask users if they agree to most cookies and similar technologies before the site starts to use them.
That is not always technically possible or creates catastrophic UX, so take a close look at which cookies are exempt from consent according to the EU advisory body on data protection: Opinion 04/2012 on Cookie Consent Exemption (original, dead link) (user‑input cookies (session-id), authentication cookies, user‑centric security cookies, multimedia content player cookies, user‑interface customisation cookies, third‑party social plug‑in content‑sharing cookies etc.).
Update 2019: Europe’s top court says active consent is needed for tracking cookies. There are few exemptions of cookies that generally do NOT require consent:
- User input cookies, for the duration of a session
- Authentication cookies, for the duration of a session
- User centric security cookies, used to detect authentication abuses and linked to the functionality explicitly requested by the user, for a limited persistent duration
- Multimedia content player session cookies, such as flash player cookies, for the duration of a session
- Load balancing session cookies, for the duration of session.
- User interface customisation cookies, for a browser session or a few hours, unless additional information in a prominent location is provided (e.g. “uses cookies” written next to the customisation feature