Applicability TestEU

EU ePrivacy Directive Applicability Test

Decide which ePrivacy obligations apply to your product, tracking stack, and marketing.

Scope cookies/SDKs (Article 5(3)), communications confidentiality, and direct marketing (Article 13).

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

ePrivacy isn't one yes/no question. Different obligations apply based on what you do: (1) storing/accessing information on user devices (cookies/SDKs/fingerprinting), (2) handling electronic communications content/metadata, and (3) sending direct marketing. Use this page to reach a defensible outcome and store an evidence-backed decision memo.

Section 1

Step 1 - Do you store/access information on "terminal equipment" (Article 5(3))?

If your product stores or accesses information on a user's device, ePrivacy Article 5(3) logic is usually your first gate.

This includes cookies, local storage, mobile SDK identifiers, and similar tracking techniques. The hard part is mapping each item to consent vs an exemption.

Inventory: cookies, pixels, SDKs, local storage, device identifiers, and fingerprinting-like techniques.
For each item: purpose, data collected, lifespan, who sets it, who receives data, and where it runs (web/app).
Decision: consent required vs exemption ("strictly necessary" / transmission) with documented reasoning.

Section 2

Step 2 - Are you an electronic communications service/provider (content + metadata)?

If you provide communications functionality (including modern OTT messaging/voice), you also need to treat communications confidentiality and metadata as a distinct compliance track.

Even when the GDPR applies, ePrivacy can particularize and complement privacy requirements for communications data.

Classify data: communications content vs communications metadata (time, recipients, location, routing, etc.).
List use cases: delivery, spam/security, analytics, product improvement, advertising, and lawful access requests.
Define retention and access controls per use case; keep an evidence trail for why each use is allowed.

Section 3

Step 3 - Do you send direct marketing by email/SMS/IM (Article 13)?

If you send direct marketing via electronic communications, ePrivacy's unsolicited communications rules are a dedicated workstream.

Treat this like an operational system: consent capture, proof, opt-out, and suppression lists.

Identify channels: email, SMS, push/IM, automated calling, and similar.
Define legal model: consent vs soft opt-in (where applicable) + opt-out mechanics per message.
Evidence: consent logs, timestamp, source, wording/version, withdrawal logs, and suppression list controls.

Section 4

Step 4 - Where does GDPR fit (the "after the cookie" layer)?

A common compliance failure is mixing ePrivacy and GDPR layers. As a simplified model: ePrivacy often governs the device access/reading layer; GDPR often governs subsequent processing of personal data.

Your documentation should explicitly separate these layers and show how you ensure consent validity and information duties.

Document the split: (A) placement/reading (ePrivacy national law) vs (B) subsequent processing (GDPR).
Map which authority/enforcement model applies and whether one-stop-shop mechanisms apply (often not for ePrivacy).
Align consent UX with GDPR consent conditions and information requirements where GDPR is the legal basis.

Section 5

Output: an exportable ePrivacy decision memo

Make your outcome auditable: a 1 - 2 page memo that explains what applies, why, and what you did about it.

Keep it updated as your tracking stack and marketing workflows change.

Scope: products, domains/apps, audiences, markets, vendors, and tracking technologies.
Article 5(3) mapping: tracker-by-tracker consent vs exemption decisions with reasoning.
Banner/CMP design choices and evidence strategy (logs, versions, tests).
Direct marketing model and evidence pack (consent, opt-out, suppression).
Links to deeper subpages for implementation and enforcement readiness.

Recommended next step

Turn EU ePrivacy Directive Applicability Test into an operational assessment

Assessment Autopilot can take EU ePrivacy Directive Applicability Test from deciding whether these obligations apply in practice to a reusable workflow inside Sorena. Teams working on EU ePrivacy Directive can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU ePrivacy Directive Applicability Test

Start from EU ePrivacy Directive Applicability Test and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU ePrivacy Directive

Review your current process, evidence gaps, and next steps for EU ePrivacy Directive Applicability Test.

Explore next step

Primary sources