Use Article 5 as a confidentiality control: protect communications and related traffic data against listening, tapping, storage, interception, or surveillance unless users consent or a lawful authorization applies.
Built for product, legal, privacy, telecom, security, analytics, and vendor teams that need evidence for message handling, metadata processing, device access, recording, and GDPR handoffs.
Structured answer sets in this page tree.
Cited legal and guidance references.
Article 5 requires Member States to protect the confidentiality of communications and related carried through public communications networks and publicly available electronic communications services. It does not give providers a general analytics, security, or product-improvement permission. First identify the communication, the users concerned, and each act of listening, tapping, storage, interception, surveillance, or recording. Then document user consent, storage necessary for conveyance, legally authorized business recording, or the specific national legislative measure relied on.
The core rule is confidentiality of communications and related . The Directive defines a communication as information exchanged or conveyed between a finite number of parties through a publicly available electronic communications service, while traffic data is data processed for conveyance or billing.
For a product review, separate message content from and . Content can reveal the substance of an email, call, chat, or message. Traffic data and location data can reveal who communicated, when, through which route, on what device, and sometimes from where.
Article 5 is framed as a duty on Member States to secure confidentiality through national legislation. A provider therefore needs the applicable national implementation for case-specific questions such as recording notice, interception authority, remedies, and enforcement. The Directive supplies the EU baseline but does not itself settle every operational permission.
Article 5 prohibits listening, tapping, storage, and other interception or surveillance by anyone other than users unless the users concerned consent or the activity is legally authorized under the Article 15 framework. It also preserves technical storage that is necessary to convey a communication, but that carve-out does not turn into permission for product analytics, profiling, or secondary metadata reuse.
The Directive separately preserves legally authorized recordings made in lawful business practice to provide evidence of a commercial transaction or another business communication. The recording must fit that evidence purpose and the applicable national authorization; Article 5(2) is not a general call-recording permission. Document this route separately from user consent and technical transmission storage.
Confidentiality reviews often find a second ePrivacy issue: software that stores information on, or gains access to information already stored in, a user device. After the 2009 amendment, Article 5(3) generally requires consent after clear and comprehensive information, except for technical storage or access solely to transmit a communication or what is strictly necessary to provide a service explicitly requested by the user.
The EDPB treats Article 5(3) as broader than cookies. The technical review should cover pixels, tracked URLs, identifiers, local storage, browser or app APIs, IoT reporting, and unique identifiers where code instructs the terminal equipment to send back stored or generated information.
The evidence package should show how the service prevents unauthorized access to communications content and related . A policy statement alone does not show that the controls work. Engineering, security, privacy, support, vendor-management, and audit reviewers should be able to use the evidence.
For suppliers and embedded services, the key question is whether they can listen to, store, record, inspect, enrich, or receive communications data or terminal-equipment information. If they can, record the ePrivacy basis, contractual controls, technical controls, access logs, retention, and deletion evidence.
Not for the ePrivacy-governed traffic-data step if Article 6 of the ePrivacy Directive sets a narrower condition. The provider should first identify whether transmission, billing, interconnection, consent-based marketing of electronic communications services, a value-added service, dispute handling, or a legal authorization applies, then assess any later personal-data processing under GDPR.
Article 5 expressly covers communications and related . Commission ePrivacy materials also emphasize that metadata derived from electronic communications may reveal sensitive and personal information, so product evidence should cover both content access and metadata handling.
The ePrivacy Directive particularises and complements GDPR in the electronic communications sector. Where ePrivacy contains a special rule for a specific operation, such as traffic-data processing or terminal-equipment access, the product cannot bypass that rule by selecting a broader GDPR lawful basis.
GDPR still matters. Personal-data processing that is not specifically governed by an ePrivacy special rule remains subject to GDPR obligations, including transparency, data-subject rights, processor controls, security, retention, and international-transfer analysis. The practical split is operation by operation: ePrivacy for the communications or device-access step, GDPR for personal-data processing that follows unless ePrivacy also specifically regulates it.
Sorena can help turn communications flows, metadata use, device access, recording features, and GDPR handoffs into cited evidence requests and implementation checks.
Ask questions tied to cited sources about Article 5 confidentiality, traffic data, terminal-equipment access, consent, and GDPR interplay.
Check whether your product, provider, or supplier evidence supports the communications confidentiality claim.
"lex specialis to the GDPR"
"confidentiality of communications and the related traffic data"
"confidentiality of communications and the related traffic data"
"restricted to what is necessary"
"necessary, appropriate and proportionate"
"storing of information, or the gaining of access"
"freely given, specific, informed and unambiguous"
"does not exclusively apply to cookies"
"particularise and complement"
"protects the confidentiality of electronic communications"