This hub explains the current Directive 2002/58/EC baseline: communications confidentiality, service security and breach handling, traffic and location data, terminal-equipment access, caller privacy, directories, and direct marketing.
Start with applicability and the regulated operation. Then follow the grouped guides for communications-provider duties, terminal-equipment and cookie controls, marketing permissions, evidence, deadlines, and country-specific enforcement review.
The Directive works through Member State implementing law. The Commission approved withdrawal of the proposed ePrivacy Regulation on 16 July 2025, and the withdrawal notice was published on 6 October 2025. Its draft rules and fine levels are not current law; validate each implementation and enforcement conclusion for the relevant country.
Focused ePrivacy guidance
Start with the direct-marketing channel or the storage or access operation, then apply the relevant national law. Keep the later assessment under the General Data Protection Regulation (GDPR), which governs personal-data processing, as a separate step.
sets the rules for unsolicited marketing by email, text, fax, and automated calling. Check the channel, recipient, and national law before choosing prior consent, the existing-customer , or another permitted route. Keep consent, sender identity, objections, and suppression-list evidence together.
Review ePrivacy direct-marketing rulesThe covers storing information on, or reading information from, a person's phone, computer, or other . Record what each cookie, tracking pixel, software development kit (SDK), local identifier, or device application programming interface (API) stores or reads. Use an exemption only when every condition fits.
Run the Article 5(3) terminal-equipment testThe customer is a narrow exception to prior email-marketing consent. Use it only when the seller obtained the contact details during a sale, markets its own similar products or services, and offers a free, easy objection at collection and in every message. Check the applicable national law.
Review the soft opt-in conditionsUse the timeline to separate the Directive adopted on 12 July 2002, the 2009 amendments due for national transposition by 25 May 2011, GDPR-era consent interpretation, and EDPB Article 5(3) guidance. Withdrawn Commission proposals, including the 2017 ePrivacy Regulation proposal withdrawn in 2025, and later proposals are not binding law.
Start with the operation and applicable national implementation. Then move to communications-provider duties, terminal-equipment controls, marketing permissions, evidence, deadlines, or a focused comparison.
Identify the regulated operation, the relevant actor, the Directive article, and the Member State implementation that supplies operational and enforcement detail.
Cover confidentiality, provider security and breach duties, traffic and location data, and the boundaries between ePrivacy and later GDPR processing.
Classify each storage or access operation, test the two narrow exemptions, and validate banner, analytics, and consent behavior against national practice.
Choose the channel-specific permission route, prove every soft-opt-in condition, identify the sender, and operate free objection and suppression controls.
Turn the legal classification into owned controls, replayable consent records, recurring reviews, and a Member State enforcement file without inventing an EU-wide fine table.
Keep the ePrivacy trigger distinct from GDPR, DSA advertising, and UK PECR work, or use the FAQ for a focused answer.
This hub is the shared starting point for privacy, legal, product, analytics, marketing, and engineering teams. Confirm the technical operation first, then assign the ePrivacy rule, consent status, exemption rationale, jurisdiction check, and retained evidence.
