Use Article 5 as a confidentiality control: protect communications and related against listening, tapping, storage, interception, or surveillance unless users consent or a lawful authorization applies.
Built for product, legal, privacy, telecom, security, analytics, and vendor teams that need evidence for message handling, metadata processing, device access, recording, and GDPR handoffs.
Article 5 requires Member States to protect the confidentiality of communications and related carried through public communications networks and publicly available electronic communications services. It does not give providers a general analytics, security, or product-improvement permission. First identify the communication, the users concerned, and each act of listening, tapping, storage, interception, surveillance, or recording. Then document user consent, storage necessary for conveyance, legally authorized business recording, or the specific national legislative measure relied on.
The core rule is confidentiality of communications and related . The Directive defines a communication as information exchanged or conveyed between a finite number of parties through a publicly available electronic communications service, while traffic data is data processed for conveyance or billing.
For a product review, separate message content from and . Content can reveal the substance of an email, call, chat, or message. Traffic data and location data can reveal who communicated, when, through which route, on what device, and sometimes from where.
Article 5 is framed as a duty on Member States to secure confidentiality through national legislation. A provider therefore needs the applicable national implementation for case-specific questions such as recording notice, interception authority, remedies, and enforcement. The Directive supplies the EU baseline but does not itself settle every operational permission.
Sources (2)
Defines communication, traffic data, and location data, then sets confidentiality, traffic-data, and location-data processing limits.
confidentiality of communications and the related traffic data
Explains why communications content and metadata require distinct protection and why the Commission viewed ePrivacy as complementary to GDPR.
metadata derived from electronic communications
Article 5 prohibits listening, tapping, storage, and other interception or surveillance by anyone other than users unless the users concerned consent or the activity is legally authorized under the Article 15 framework. It also preserves technical storage that is necessary to convey a communication, but that carve-out does not turn into permission for product analytics, profiling, or secondary metadata reuse.
The Directive separately preserves legally authorized recordings made in lawful business practice to provide evidence of a commercial transaction or another business communication. The recording must fit that evidence purpose and the applicable national authorization; Article 5(2) is not a general call-recording permission. Document this route separately from user consent and technical transmission storage.
Sources (1)
Supports the rule against interception or surveillance, the technical conveyance storage and business-recording caveats, and the erasure, anonymisation, purpose, and personnel limits for traffic data.
listening, tapping, storage or other kinds
Confidentiality reviews often find a second ePrivacy issue: software that stores information on, or gains access to information already stored in, a user device. After the 2009 amendment, Article 5(3) generally requires consent after clear and comprehensive information, except for technical storage or access solely to transmit a communication or what is strictly necessary to provide a service explicitly requested by the user.
The EDPB treats Article 5(3) as broader than cookies. The technical review should cover pixels, tracked URLs, identifiers, local storage, browser or app APIs, IoT reporting, and unique identifiers where code instructs the terminal equipment to send back stored or generated information.
Sources (2)
Shows the consent-based Article 5(3) wording for storing or accessing information in terminal equipment and the two technical exceptions.
storing of information, or the gaining of access
Supports the broader technical scope covering information, terminal equipment, access, storage, pixels, local processing, IoT, and identifiers.
does not exclusively apply to cookies
The evidence package should show how the service prevents unauthorized access to communications content and related . A policy statement alone does not show that the controls work. Engineering, security, privacy, support, vendor-management, and audit reviewers should be able to use the evidence.
For suppliers and embedded services, the key question is whether they can listen to, store, record, inspect, enrich, or receive communications data or terminal-equipment information. If they can, record the ePrivacy basis, contractual controls, technical controls, access logs, retention, and deletion evidence.
Not for the ePrivacy-governed traffic-data step if Article 6 of the ePrivacy Directive sets a narrower condition. The provider should first identify whether transmission, billing, interconnection, consent-based marketing of electronic communications services, a value-added service, dispute handling, or a legal authorization applies, then assess any later personal-data processing under GDPR.
Article 5 expressly covers communications and related . Commission ePrivacy materials also emphasize that metadata derived from electronic communications may reveal sensitive and personal information, so product evidence should cover both content access and metadata handling.
Sources (2)
Supports evidence for communications confidentiality, traffic-data purpose limits, personnel restrictions, erasure, anonymization, and consent.
restricted to what is necessary
Historical Commission explanatory material about the then-proposed ePrivacy Regulation and its intended distinction from GDPR personal-data protection for communications confidentiality and devices.
protects the confidentiality of electronic communications
The ePrivacy Directive particularises and complements GDPR in the electronic communications sector. Where ePrivacy contains a special rule for a specific operation, such as traffic-data processing or terminal-equipment access, the product cannot bypass that rule by selecting a broader GDPR lawful basis.
GDPR still matters. Personal-data processing that is not specifically governed by an ePrivacy special rule remains subject to GDPR obligations, including transparency, data-subject rights, processor controls, security, retention, and international-transfer analysis. The practical split is operation by operation: ePrivacy for the communications or device-access step, GDPR for personal-data processing that follows unless ePrivacy also specifically regulates it.
Sources (2)
Supports the lex-specialis relationship, co-existence, and the need to analyze each processing operation against ePrivacy and GDPR.
particularise and complement
States that the proposed ePrivacy Regulation was designed as lex specialis to GDPR for electronic communications data that qualify as personal data.
lex specialis to the GDPR
Sorena can help turn communications flows, metadata use, device access, recording features, and GDPR handoffs into cited evidence requests and implementation checks.
Ask questions tied to cited sources about Article 5 confidentiality, traffic data, terminal-equipment access, consent, and GDPR interplay.
Check whether your product, provider, or supplier evidence supports the communications confidentiality claim.
"metadata derived from electronic communications"
"lex specialis to the GDPR"
"listening, tapping, storage or other kinds"
"restricted to what is necessary"
"storing of information, or the gaining of access"
"freely given, specific, informed and unambiguous"
"does not exclusively apply to cookies"
"particularise and complement"
"protects the confidentiality of electronic communications"
"confidentiality of communications and the related traffic data"
"confidentiality of communications and the related traffic data"
"necessary, appropriate and proportionate"
Compare ePrivacy rules for device storage and access with DSA ad labels, advertiser disclosures, targeting information, profiling limits, and VLOP/VLOSE ad repositories.
Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence.
EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs.
Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps.
A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence.
A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence.
Build evidence that links each cookie or tracker decision to the banner shown, the user's signal, the live technical behavior, withdrawal, and later changes.
Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence.
Decide whether cookies, pixels, SDKs, local storage, identifiers, and analytics fall within Article 5(3), then document consent, an exemption, or escalation.
Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats.
Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up.
A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records.
Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats.
Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay.
Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats.
Source-backed guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits.
Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence.
How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice.
Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits.
Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits.
Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing.
Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.
Compare the EU ePrivacy Directive with current UK PECR rules for device storage and access, statutory exceptions, consent, electronic-mail marketing, soft opt-ins, and enforcement.
Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats.
Decide whether an electronic-mail marketing audience meets every Article 13 soft opt-in condition, or must be suppressed or supported by valid prior consent.
Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks.
FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.
FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.
When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.
Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.
FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions.
FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.