--- title: "EU ePrivacy Directive Compliance Checklist" canonical_url: "https://www.sorena.io/artifacts/eu/eprivacy-directive/checklist" source_url: "https://www.sorena.io/artifacts/eu/eprivacy-directive/checklist" author: "Sorena AI" description: "A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "EU ePrivacy Directive" - "ePrivacy checklist" - "Article 5(3)" - "cookies" - "consent banner" - "direct marketing" - "terminal equipment" - "ePrivacy" - "Checklist" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU ePrivacy Directive Compliance Checklist A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records. *Compliance Checklist* *EU* ## EU ePrivacy Directive Compliance Checklist This checklist helps review cookies, pixels, SDKs, device identifiers, direct marketing, communications confidentiality, consent records, and GDPR follow-on processing. Built for privacy, product, marketing, web engineering, app engineering, security, and data governance teams that need auditable ePrivacy decisions without country-specific penalty assumptions. This checklist turns the EU ePrivacy Directive into an implementation review for websites, apps, connected products, messaging, and electronic direct marketing. Complete it one product or service at a time, and keep the evidence record with the release, campaign, or vendor decision it supports. ## 1. Build a terminal equipment inventory List every operation that stores information on, or gains access to information from, a user's or subscriber's terminal equipment. Do not limit the inventory to browser cookies: include pixels, tracked URLs, local storage, SDK identifiers, app permissions that send device-derived values back over a network, IoT reporting, and similar access patterns. For each entry, record the product surface, domain or app package, triggering event, first or third party, information read or written, purpose, duration, recipient, vendor, and whether the operation starts before the user has made a consent choice. - Inventory cookies, pixels, tracking links, local storage, SDK identifiers, authentication tokens, advertising identifiers, analytics identifiers, and connected-device reporting. - Separate storage from access where different actors perform them, because Article 5(3) can apply even when storage and access do not happen in the same step. - Flag any item that collects identifiers from a browser, app, email, connected car, connected TV, smart device, or relay device and sends them to a remote endpoint. - Record whether the information is personal data, but do not use that as the only scope test; Article 5(3) uses the broader concept of information in terminal equipment. Sources for this answer: - [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en?ref=sorena.io) - Supports the checklist scope for cookies, pixels, URLs, local processing, identifiers, and IoT access to terminal equipment. - [Commission ePrivacy overview](https://digital-strategy.ec.europa.eu/en/library/eprivacyeu-towards-future-proof-legal-framework-online-privacy?ref=sorena.io) - Commission material frames ePrivacy as protection for communications confidentiality and information on users' devices. ## 2. Classify the consent or exemption basis For each inventory row, decide whether the operation needs prior consent or fits one of the narrow Article 5(3) exemptions: technical storage or access solely for transmitting a communication, or storage or access that is strictly necessary to provide an information society service explicitly requested by the user or subscriber. Document the purpose from the user's point of view. A first-party session cookie used for a shopping basket or login session may be easier to justify than a persistent third-party identifier, but purpose and implementation decide the result. - Mark consent required for advertising, cross-site tracking, most third-party analytics, tracking pixels, tracked URLs, profiling, social plug-in tracking, and multi-purpose identifiers with any non-exempt purpose. - Mark exemption claimed only when every purpose attached to the cookie, SDK call, token, or identifier independently meets an exemption. - Check lifespan against purpose: exempt items should expire when no longer needed for the requested service or transmission. - Split multi-purpose cookies or identifiers so exempt service functions are not bundled with analytics, advertising, or product-improvement tracking. - For first-party analytics, record the specific legal analysis rather than treating analytics as automatically strictly necessary. Sources for this answer: - [Directive 2009/136/EC amendments to the ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02009L0136-20201221&ref=sorena.io) - Contains the amended Article 5(3) consent rule and the transmission and strictly-necessary exemptions. - [WP29 Opinion 04/2012 on Cookie Consent Exemption](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf?ref=sorena.io) - Supports the exemption checks for sole transmission purpose, strictly necessary service delivery, purpose separation, and cookie lifespan. ## 3. Test banner UX before release Where consent is required, test the live banner and preference center, not only the CMP configuration. The user should understand the purpose of the request, be able to reject non-essential access, avoid pre-ticked opt-ins, and withdraw consent through an accessible route after giving it. Block consent-requiring reads and writes until a positive consent action has been recorded. Do not rely on continued browsing, silence, hidden reject links, preselected categories, or a legitimate-interest toggle as the basis for Article 5(3) access. - Verify that no consent-requiring cookies, pixels, SDK calls, or tracked URLs fire before consent. - Show accept and reject choices in a way that does not make rejection materially harder to find or understand. - Keep category toggles off by default unless the category is genuinely exempt and clearly labelled as necessary. - Avoid designs that make users think consent is required to access content unless that claim is independently justified. - Make withdrawal as easy as giving consent, such as through a visible privacy settings link or equivalent persistent control. Sources for this answer: - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Supports the banner checks for reject options, pre-ticked boxes, misleading design, essential-cookie claims, and withdrawal access. - [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf?ref=sorena.io) - Supports the consent quality checks for freely given, specific, informed, unambiguous consent and demonstrability. ## 4. Keep consent logs and preference records Keep records that prove what the user saw, what choice they made, when the choice was made, what purposes and vendors it covered, and which technical operations were allowed as a result. A CMP event without the banner version, purpose taxonomy, and firing evidence is not enough for an audit trail. When consent changes or is withdrawn, update downstream tags, SDKs, audiences, campaign tools, and data-processing pipelines so the later processing reflects the current choice. - Store timestamp, consent status, purpose and vendor version, banner language or jurisdiction variant, user or device pseudonym, and CMP configuration version. - Link each consent state to the tag, pixel, SDK, or cookie list that was allowed at that moment. - Retain screenshots or rendered HTML for each banner and preference-center version used in production. - Record withdrawal events and prove that consent-requiring operations stopped or were reconfigured after withdrawal. - Review old consent records before relying on them; presumed consent or implied action records may not meet the GDPR consent standard. Sources for this answer: - [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf?ref=sorena.io) - Supports the need to demonstrate valid consent, keep references, and provide easy withdrawal mechanisms. - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Supports maintaining essential-cookie lists and withdrawal solutions that can be shown to authorities when requested. ## 5. Review direct marketing and soft opt-in Review every automated call, fax, email, SMS, and similar electronic-mail campaign before launch. Article 13 requires prior consent for direct marketing by automated calling systems, fax, or electronic mail, subject to the customer-contact soft opt-in for a seller's own similar products or services. For soft opt-in, keep evidence that the contact details were obtained in the context of a sale, the sender is the same natural or legal person, the marketing concerns own similar products or services, and the customer had a clear, distinct, free, and easy objection opportunity at collection and in each message. - Classify campaign channel, recipient type, source of contact details, product relationship, sender identity, and opt-out mechanism. - Do not use soft opt-in for third-party offers, unrelated products, rented lists, or contacts collected outside the sale context. - Include a valid address or mechanism for recipients to request that marketing cease. - Do not disguise or conceal the sender identity on whose behalf the communication is made. - Separate EU-level Article 13 checks from local Member State choices for other forms of unsolicited communications. Sources for this answer: - [Directive 2009/136/EC amendments to the ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02009L0136-20201221&ref=sorena.io) - Contains Article 13 rules for direct marketing consent, the customer-contact soft opt-in, objection rights, and sender identity. - [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf?ref=sorena.io) - Supports applying GDPR consent conditions where marketing or tracking relies on consent. ## 6. Check communications confidentiality, traffic data, and location data For communications services and features, review whether the service listens to, taps, stores, intercepts, monitors, records, analyzes, or otherwise accesses communications content or related traffic data. The ePrivacy Directive requires confidentiality of communications and related traffic data, subject to narrow exceptions such as user consent, legal authorization, technical storage necessary for conveyance, and lawful business recording for evidence of a commercial transaction or business communication. For traffic data, location data, and value-added services, record the purpose, duration, user information, consent or anonymization basis, withdrawal route, and personnel restrictions. Do not reuse communications data for marketing, analytics, or value-added services without the required basis and transparency. - Map communications content separately from related traffic data, billing data, fraud controls, and location data other than traffic data. - Confirm technical storage is limited to what is necessary to convey the communication. - Document any lawful business recording purpose and avoid treating it as a general monitoring permission. - For traffic-data marketing or value-added services, keep prior consent and withdrawal evidence. - For location data other than traffic data, use anonymization or consent and provide an easy, free way to temporarily refuse processing where applicable. Sources for this answer: - [Directive 2002/58/EC (ePrivacy Directive)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058&ref=sorena.io) - Supports checks for communications confidentiality, traffic data, location data, security information, and direct marketing. - [Commission ePrivacy factsheet](https://ec.europa.eu/digital-single-market/en/news/eurobarometer-eprivacy?ref=sorena.io) - Commission material distinguishes GDPR personal-data protection from ePrivacy protection for communications confidentiality and devices. ## 7. Tie ePrivacy decisions to GDPR follow-on processing After Article 5(3) storage or access, map any personal-data processing that follows: analytics profiles, advertising audiences, attribution, product telemetry, security analytics, CRM enrichment, or data sharing. The ePrivacy access decision and the GDPR processing analysis are connected, but they are not the same record. If Article 5(3) consent was required and was not validly obtained, do not assume the later GDPR processing can be repaired by legitimate interests. For personal-data processing that remains after lawful access, document the GDPR lawful basis, transparency, data minimization, retention, processor or controller role, transfer basis, and data-subject-rights handling. - Create one record for terminal-equipment access and a linked record for any later personal-data processing. - Use the same purpose taxonomy across banner text, consent logs, records of processing, vendor contracts, and data retention rules. - Check that consent withdrawal updates both terminal-equipment access and later processing that depends on consent. - Keep authority-competence assumptions separate; ePrivacy enforcement depends on national transposition, while GDPR competence remains for GDPR-only processing. - Escalate when one processing chain triggers both ePrivacy and GDPR but different teams own the controls. Sources for this answer: - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Supports separating the ePrivacy special rule for terminal-equipment access from GDPR analysis of prior or subsequent personal-data processing. - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Confirms that GDPR applies to subsequent processing after Article 5(3) storage or access, including where consent is the legal basis. ## 8. Close with an evidence pack Close the checklist only when the evidence pack can explain the technical fact pattern, the ePrivacy decision, the user interface, the consent or exemption basis, the marketing rule, the communications-data rule, and the GDPR follow-on analysis without relying on tribal knowledge. Reopen the checklist when a tag, SDK, campaign tool, CMP template, app permission, connected-device telemetry flow, vendor, recipient, purpose, retention period, or marketing audience changes. - Keep the terminal-equipment inventory, data-flow diagram, CMP configuration, tag scan, SDK scan, and consent-blocking test results. - Keep exemption memos for strictly necessary, transmission-only, authentication, security, UI preference, shopping basket, and media playback cases. - Keep banner screenshots, preference-center text, translations, rejection path tests, withdrawal tests, and pre-consent network traces. - Keep marketing campaign approvals, soft-opt-in evidence, opt-out suppression logs, sender identity checks, and message templates. - Keep communications confidentiality approvals, traffic-data and location-data basis checks, access restrictions, retention rules, and GDPR records linked to the same release or campaign. Sources for this answer: - [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en?ref=sorena.io) - Supports evidence requirements for technical scope decisions across cookies, pixels, identifiers, local processing, and IoT reporting. - [WP29 Opinion 04/2012 on Cookie Consent Exemption](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf?ref=sorena.io) - Supports evidence for exempt-purpose analysis, purpose separation, and strictly necessary decisions. *Recommended next step* *Placement: before sources* ## Review cookies, banners, campaigns, and communications data against cited ePrivacy sources Sorena can help convert this checklist into inventory rows, consent and exemption decisions, banner tests, campaign approvals, and evidence records for your website, app, or connected service. - [Open Research Copilot for ePrivacy](/solutions/research-copilot.md): Ask questions tied to cited sources about Article 5(3), consent banners, exemptions, direct marketing, communications confidentiality, and GDPR interplay. - [Talk through ePrivacy implementation](/contact.md): Review your ePrivacy inventory, CMP configuration, marketing workflow, and evidence gaps with Sorena. ## Primary sources - [Directive 2002/58/EC (ePrivacy Directive)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058&ref=sorena.io) - Primary directive text for confidentiality of communications, traffic data, location data, terminal equipment rules, and unsolicited communications. - Quote: "confidentiality of communications" - [Directive 2009/136/EC amendments to the ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02009L0136-20201221&ref=sorena.io) - Amended Article 5(3) and Article 13 wording for terminal equipment consent, exemptions, direct marketing, soft opt-in, and sender identity. - Quote: "storing of information" - [EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en?ref=sorena.io) - Technical scope guidance for cookies, pixels, tracked URLs, identifiers, local processing, and IoT terminal-equipment access. - Quote: "technical scope of Art. 5(3)" - [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf?ref=sorena.io) - Consent quality guidance for freely given, specific, informed, unambiguous, demonstrable, and withdrawable consent. - Quote: "clear affirmative action" - [EDPB Cookie Banner Taskforce report](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf?ref=sorena.io) - Cookie banner enforcement coordination material for reject options, pre-ticked boxes, misleading design, essential-cookie claims, and withdrawal. - Quote: "Cookie Banner Taskforce" - [WP29 Opinion 04/2012 on Cookie Consent Exemption](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf?ref=sorena.io) - Cookie exemption analysis for sole transmission purpose, strictly necessary service delivery, purpose separation, lifespan, analytics, advertising, and social plug-ins. - Quote: "Cookie Consent Exemption" - [EDPB Opinion 5/2019 on ePrivacy Directive and GDPR interplay](https://edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en.pdf?ref=sorena.io) - Interplay guidance for ePrivacy special rules, GDPR follow-on processing, authority competence, and coexistence between the two regimes. - Quote: "particularise and complement" - [Commission ePrivacy factsheet](https://ec.europa.eu/digital-single-market/en/news/eurobarometer-eprivacy?ref=sorena.io) - Commission overview distinguishing GDPR personal-data protection from ePrivacy protection for communications confidentiality and user devices. - Quote: "protects the confidentiality" - [Commission ePrivacy overview](https://digital-strategy.ec.europa.eu/en/library/eprivacyeu-towards-future-proof-legal-framework-online-privacy?ref=sorena.io) - Commission material on the ePrivacy initiative and the policy focus on online privacy, communications confidentiality, and device protection. - Quote: "future-proof legal framework" ## Related Topic Guides - [Are cookie walls allowed under the EU ePrivacy Directive?](/artifacts/eu/eprivacy-directive/faq/cookie-walls.md): FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats. - [Do Analytics Cookies Require Consent under the EU ePrivacy Directive?](/artifacts/eu/eprivacy-directive/faq/analytics-cookies.md): FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats. - [ePrivacy cookie consent vs DSA ads obligations: scope-bounded comparison](/artifacts/eu/eprivacy-directive/eprivacy-vs-dsa-ads.md): Compare ePrivacy cookie and tracking-consent duties with DSA ads workstreams without merging consent, transparency, and evidence obligations. - [ePrivacy Directive vs GDPR: cookies, communications, consent, and evidence](/artifacts/eu/eprivacy-directive/eprivacy-directive-vs-gdpr.md): Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence. - [EU cookie banner requirements under the ePrivacy Directive](/artifacts/eu/eprivacy-directive/eu-cookie-banner-requirements.md): EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs. - [EU ePrivacy analytics cookies: consent, exemption, and evidence guide](/artifacts/eu/eprivacy-directive/analytics-cookies.md): Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps. - [EU ePrivacy Applicability Test for Cookies, SDKs, Pixels, Communications, and Marketing](/artifacts/eu/eprivacy-directive/applicability-test.md): A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence. - [EU ePrivacy Article 5(3) terminal equipment test](/artifacts/eu/eprivacy-directive/article-5-3-terminal-equipment-test.md): A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence. - [EU ePrivacy Confidentiality of Communications: Article 5 controls](/artifacts/eu/eprivacy-directive/confidentiality-of-communications.md): Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay. - [EU ePrivacy consent-log evidence workflow for cookies and trackers](/artifacts/eu/eprivacy-directive/consent-log-evidence-workflow.md): Build an ePrivacy consent-log workflow that records cookie and tracker decisions, banner versions, consent signals, withdrawals, vendor evidence, and audit-ready outputs. - [EU ePrivacy cookie banner UX test cases](/artifacts/eu/eprivacy-directive/banner-ux-test-cases.md): Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence. - [EU ePrivacy Cookie Scope Classifier Workflow](/artifacts/eu/eprivacy-directive/cookie-scope-classifier-workflow.md): Classify cookies, pixels, SDKs, local storage, device identifiers, and analytics tracers under Article 5(3) ePrivacy rules, with consent and exemption evidence outputs. - [EU ePrivacy direct-marketing consent checklist](/artifacts/eu/eprivacy-directive/direct-marketing-consent-checklist.md): Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats. - [EU ePrivacy Directive compliance calendar for cookies, consent, and marketing](/artifacts/eu/eprivacy-directive/deadlines-and-compliance-calendar.md): Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up. - [EU ePrivacy Directive Compliance Guide for Cookies, Marketing, and Communications](/artifacts/eu/eprivacy-directive/compliance.md): Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats. - [EU ePrivacy Directive Cookies and Consent: Article 5(3), exemptions, and banner evidence](/artifacts/eu/eprivacy-directive/cookies-and-consent.md): Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay. - [EU ePrivacy Directive direct marketing rules for electronic mail](/artifacts/eu/eprivacy-directive/direct-marketing-rules.md): Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats. - [EU ePrivacy Directive Enforcement and Fines](/artifacts/eu/eprivacy-directive/enforcement-and-fines.md): Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits. - [EU ePrivacy Directive FAQ: cookies, consent, marketing, GDPR interplay](/artifacts/eu/eprivacy-directive/faq.md): Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence. - [EU ePrivacy Directive Member State Cookie Rules](/artifacts/eu/eprivacy-directive/member-state-cookie-rules.md): How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice. - [EU ePrivacy Directive Metadata and Location Data Guide](/artifacts/eu/eprivacy-directive/metadata-and-location-data.md): Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits. - [EU ePrivacy Directive penalties and fines: national enforcement caveats](/artifacts/eu/eprivacy-directive/penalties-and-fines.md): Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits. - [EU ePrivacy Directive Requirements: cookies, communications and marketing](/artifacts/eu/eprivacy-directive/requirements.md): Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing. - [EU ePrivacy Directive vs GDPR: cookies, communications, marketing, and evidence](/artifacts/eu/eprivacy-directive/eprivacy-vs-gdpr.md): Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing. - [EU ePrivacy Directive vs UK PECR: scope-bounded cookie and marketing comparison](/artifacts/eu/eprivacy-directive/eprivacy-vs-uk-pecr.md): Compare EU ePrivacy Directive rules with a UK PECR workstream requiring separate source review for cookies, terminal equipment, direct marketing, consent, soft opt-in, and evidence. - [EU ePrivacy soft opt-in FAQ for email marketing](/artifacts/eu/eprivacy-directive/faq/soft-opt-in.md): When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks. - [EU ePrivacy soft opt-in marketing checklist](/artifacts/eu/eprivacy-directive/soft-opt-in-marketing.md): Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats. - [EU ePrivacy soft opt-in marketing review workflow](/artifacts/eu/eprivacy-directive/soft-opt-in-marketing-review-workflow.md): Review whether an EU electronic-mail marketing send can rely on the ePrivacy soft opt-in, with checks for customer relationship evidence, similar products, opt-out, sender identity, suppression records, and national-law caveats. - [EU ePrivacy Strictly Necessary Cookie Exemptions](/artifacts/eu/eprivacy-directive/strictly-necessary-exemptions.md): Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks. - [Is a reject-all button required for EU ePrivacy cookie consent?](/artifacts/eu/eprivacy-directive/faq/reject-all-button.md): Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats. - [Strictly Necessary Cookies under the EU ePrivacy Directive](/artifacts/eu/eprivacy-directive/faq/strictly-necessary-cookies.md): FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions. - [What should CMP consent logs retain under the EU ePrivacy Directive?](/artifacts/eu/eprivacy-directive/faq/cmp-consent-logs.md): FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/eprivacy-directive/checklist.md