This test helps decide whether an EU ePrivacy rule is triggered by an electronic communications service, confidentiality of communications, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, or .
Designed for privacy, product, marketing, analytics, web, mobile, CRM, and legal teams that need a documented scope decision before launch or change approval.
Test the operation, actor, and country before choosing an ePrivacy control. Ask whether the flow concerns a publicly available electronic communications service, protected communications or related traffic data, storage of or access to information on , or . A yes answer identifies an EU-level Directive rule, not the complete operational answer: record the relevant Member State implementing law and competent authority, then assess any separate GDPR processing before or after the communication, storage, or access event.
Start with the actual user journey, actor, and countries reached, not the vendor category. A website tag, mobile SDK, email pixel, in-app analytics event, connected-device telemetry flow, communications feature, or CRM campaign can each trigger different ePrivacy questions.
Mark the relevant branch when the facts involve a publicly available electronic communications service or network, confidentiality of communications and related traffic data, storage or access on a user's , or by electronic mail, automated calling, fax, SMS, or comparable stored-message channels. Then identify the national transposition that turns the Directive rule into an enforceable local requirement.
Sources (2)
Supports the core scope test for publicly available electronic communications services, communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
publicly available electronic communications services
Historical Commission explanatory material about the then-proposed ePrivacy Regulation, including its intended distinction from GDPR personal-data protection and its intended treatment of communications confidentiality and information on users' devices.
confidentiality of electronic communications
For cookies, SDKs, pixels, local storage, app identifiers, device APIs, and similar techniques, apply Article 5(3) as a technical test. The EDPB frames the test around information, , a public electronic communications context, and storage or gaining access.
Do not limit the review to personal data. The EDPB guidance treats "information" as broader than personal data, and Article 5(3) can apply even where the value read from or written to a device is technical, transient, locally generated, or originally stored by another party.
Sources (2)
Provides the four technical elements for Article 5(3) applicability and examples covering URL and pixel tracking, local processing, IP-only tracking, IoT reporting, and unique identifiers.
information
Article 5(3) is the legal source for the storage/access condition and the transmission and strictly-necessary exceptions.
storing of information, or the gaining of access
If Article 5(3) applies, classify the technology by purpose. Consent is normally required unless the storage or access is solely for carrying out the transmission of a communication, or is strictly necessary to provide an information society service explicitly requested by the user.
Treat analytics, advertising, affiliate tracking, behavioural profiling, social plug-in tracking, product improvement, market research, and cross-site measurement as non-exempt unless the cited evidence supports a narrower conclusion. First-party or session status alone is not enough; the purpose controls the answer.
Sources (2)
Supports the two Article 5(3) exemption criteria and examples of cookies more likely or less likely to be exempt.
strictly necessary
Supports practical scrutiny of essential-cookie classifications and the need to demonstrate why listed cookies are essential.
essentiality
Where consent is required, test the interface before any non-exempt access or storage happens. A valid consent flow needs a real choice, a clear affirmative action, purpose-specific information, and a withdrawal route that is as easy to use as the grant route.
Cookie-banner review should include both the first layer and deeper settings. The EDPB taskforce material flags common risk patterns: no reject option where consent is requested, pre-ticked boxes, misleading link or color design, confusing legitimate-interest presentation for cookie placement or reading, overbroad essential labels, and hidden withdrawal controls.
Sources (2)
Supports the GDPR consent quality requirements used for ePrivacy consent, including freely given, specific, informed, unambiguous consent, no cookie walls, no scrolling consent, and easy withdrawal.
clear affirmative action
Supports the banner QA checks for reject controls, pre-ticked boxes, deceptive design, legitimate-interest confusion, essential classifications, and withdrawal access.
pre-ticked boxes
Do not collapse ePrivacy into a GDPR-only assessment. For cookie placement or reading, the taskforce report describes the ePrivacy framework for the placement or reading step and the GDPR framework for subsequent personal-data processing. Opinion 5/2019 also treats Articles 5(3) and 13 as extended ePrivacy scope areas that can overlap with GDPR.
For marketing, test Article 13 on its own. Prior consent is the baseline for automated calling systems, fax, and electronic mail for . The existing-customer exception is narrower: the same sender may market its own similar products or services when it obtained the electronic contact details in the context of a sale and gives a clear, free, easy objection opportunity at collection and in each message.
No. Record the Article 5(3) storage or access analysis first. GDPR consent conditions inform consent quality, and GDPR governs later personal-data processing, but the placement or reading of non-exempt cookies and similar technologies remains an ePrivacy scope question under national transposition.
No. The Article 5(3) test covers storage or access to information in , not only RFC-style cookies. Local storage, SDK identifiers, tracking pixels, device values, and locally generated data sent back over a network can be in scope.
Keep a dated data-flow map, cookie and SDK inventory, before-consent network trace, CMP configuration, consent and withdrawal logs, essential-cookie rationale, direct-marketing basis, suppression-list test, GDPR overlap note, source citations, approver, and reassessment triggers for product, vendor, country, or purpose changes.
Sources (3)
Supports the separation between ePrivacy-specific obligations and GDPR obligations where the same processing operation falls within both frameworks.
co-existence
Article 13 supports the direct-marketing test for electronic mail, automated calls, fax, and the existing-customer similar-products exception.
direct marketing
Supports the split between ePrivacy placement or reading of cookies and GDPR subsequent processing, and notes that the GDPR one-stop-shop mechanism does not apply to ePrivacy issues.
placement or reading of cookies
Sorena can convert this applicability test into a product-specific evidence pack with a tracker inventory, consent-state tests, direct-marketing basis records, GDPR overlap notes, and cited source support.
Ask questions tied to cited sources about Article 5(3), cookies, SDKs, pixels, consent UX, GDPR overlap, and direct-marketing scope using the cited sources on this page.
Review a product launch, marketing campaign, tracker inventory, or CMP configuration against the EU ePrivacy applicability test.
"terminal equipment"
"publicly available electronic communications services"
"storing of information, or the gaining of access"
"direct marketing"
"Cookie Banner Taskforce"
"essentiality"
"pre-ticked boxes"
"placement or reading of cookies"
"freely given"
"clear affirmative action"
"gaining access"
"information"
"interplay"
"co-existence"
"protects the confidentiality"
"confidentiality of electronic communications"
"sole purpose"
"strictly necessary"
Compare ePrivacy rules for device storage and access with DSA ad labels, advertiser disclosures, targeting information, profiling limits, and VLOP/VLOSE ad repositories.
Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence.
EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs.
Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps.
A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence.
Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay.
Build evidence that links each cookie or tracker decision to the banner shown, the user's signal, the live technical behavior, withdrawal, and later changes.
Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence.
Decide whether cookies, pixels, SDKs, local storage, identifiers, and analytics fall within Article 5(3), then document consent, an exemption, or escalation.
Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats.
Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up.
A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records.
Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats.
Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay.
Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats.
Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits.
Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence.
How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice.
Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits.
Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits.
Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing.
Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.
Compare the EU ePrivacy Directive with current UK PECR rules for device storage and access, statutory exceptions, consent, electronic-mail marketing, soft opt-ins, and enforcement.
Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats.
Decide whether an electronic-mail marketing audience meets every Article 13 soft opt-in condition, or must be suppressed or supported by valid prior consent.
Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks.
FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.
FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.
When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.
Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.
FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions.
FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.