ePrivacy
Check EU ePrivacy Directive rules for Article 5 confidentiality, Article 5(3) terminal access, consent exemptions, direct marketing, and GDPR interplay.
This hub explains the current Directive 2002/58/EC baseline: communications confidentiality, service security and breach handling, traffic and location data, terminal-equipment access, caller privacy, directories, and direct marketing.
The Directive works through Member State implementing law. The Commission approved withdrawal of the proposed ePrivacy Regulation on 16 July 2025, and the withdrawal notice was published on 6 October 2025. Its draft rules and fine levels are not current law; validate each implementation and enforcement conclusion for the relevant country.
Article 5 protects confidentiality of communications and related ; traffic and location-data use cases must be separated from ordinary website tracking and checked against the provider role and purpose.
Article 5(3), as amended in 2009, covers storing information or gaining access to information already stored on ; EDPB technical guidance treats the scope as broader than cookies and not limited to personal data.
Consent must meet GDPR conditions where ePrivacy refers to consent. Exemptions are narrow: transmission-only access or access for an information society service explicitly requested by the user.
Direct marketing by automated calling systems, fax, or electronic mail generally needs prior consent, while the customer requires collection during a sale, own similar products or services, and easy free opt-out.
Providers of publicly available electronic communications services also face security, breach-notification, traffic-data, location-data, caller-identification, and directory duties. National transposition determines the operational procedure, authority, remedy, and penalty.
Separate the secrecy of electronic communications from later personal-data processing; ePrivacy protects communications and even where the GDPR also applies.
Check whether a cookie, SDK, pixel, local storage, identifier, IoT report, or similar technique stores information or gains access to information on a user's .
Use the narrow transmission and tests before treating a cookie as essential; advertising, cross-site tracking, and most analytics need consent or a jurisdiction-specific exemption analysis.
starts with prior consent for automated calls, fax, and electronic mail, with a only for a customer's electronic contact details, the sender's own similar products or services, and easy free objection at collection and in each message.
Use the Directive for the EU baseline, then identify the Member State law that governs the operation. National law and authority practice supply the territorial test, consent-interface detail, rules for channels not fully harmonized by , breach procedure, competent authority, penalties, and remedies.
Directive 2002/58/EC was adopted on 12 July 2002 and originally required national transposition by 31 October 2003. Directive 2009/136/EC introduced the current Article 5(3) consent wording and required its national measures by 25 May 2011. Those dates explain the legal history; current duties still come from each Member State's implementing law.
Use the timeline to separate the Directive adopted on 12 July 2002, the 2009 amendments due for national transposition by 25 May 2011, GDPR-era consent interpretation, and EDPB Article 5(3) guidance. Withdrawn Commission proposals, including the 2017 ePrivacy Regulation proposal withdrawn in 2025, and later proposals are not binding law.
Start with the direct-marketing channel or the storage or access operation, then apply the relevant national law. Keep the later assessment under the General Data Protection Regulation (GDPR), which governs personal-data processing, as a separate step.
sets the rules for unsolicited marketing by email, text, fax, and automated calling. Check the channel, recipient, and national law before choosing prior consent, the existing-customer , or another permitted route. Keep consent, sender identity, objections, and suppression-list evidence together.
The covers storing information on, or reading information from, a person's phone, computer, or other . Record what each cookie, tracking pixel, software development kit (SDK), local identifier, or device application programming interface (API) stores or reads. Use an exemption only when every condition fits.
The customer is a narrow exception to prior email-marketing consent. Use it only when the seller obtained the contact details during a sale, markets its own similar products or services, and offers a free, easy objection at collection and in every message. Check the applicable national law.
Start with the operation and applicable national implementation. Then move to communications-provider duties, terminal-equipment controls, marketing permissions, evidence, deadlines, or a focused comparison.
Identify the regulated operation, the relevant actor, the Directive article, and the Member State implementation that supplies operational and enforcement detail.
Cover confidentiality, provider security and breach duties, traffic and location data, and the boundaries between ePrivacy and later GDPR processing.
Classify each storage or access operation, test the two narrow exemptions, and validate banner, analytics, and consent behavior against national practice.
Choose the channel-specific permission route, prove every soft-opt-in condition, identify the sender, and operate free objection and suppression controls.
Turn the legal classification into owned controls, replayable consent records, recurring reviews, and a Member State enforcement file without inventing an EU-wide fine table.
Keep the ePrivacy trigger distinct from GDPR, DSA advertising, and UK PECR work, or use the FAQ for a focused answer.
"Subject to a number of conditions, cookies used for audience measurement are exempt from consent."
"Member States shall ensure the confidentiality of communications"
"the storing of information, or the gaining of access to information already stored"
"does not exclusively apply to cookies"
"The General Data Protection Regulation protects personal data."
"The Commission has approved the withdrawal of those pending proposals"
Next steps
Confirm the technical operation, then assign the ePrivacy rule, consent status, exemption rationale, jurisdiction check, and evidence records to privacy, legal, product, analytics, marketing, or engineering owners.
Turn ePrivacy cookie, analytics, communications, and marketing questions into owned tasks, evidence requests, and jurisdiction checks.
Answer ePrivacy Directive, Article 5(3), consent, exemption, analytics, , and GDPR interplay questions with cited outputs.
Coordinate ePrivacy amendments, guidance, and enforcement-monitoring milestones across teams.
Review your cookie inventory, consent UX, analytics setup, communications-data use, marketing permissions, and retained evidence.