Artifact GuideEU

EU ePrivacy Directive deadlines and compliance calendar

Track the cited dates that define the ePrivacy Directive baseline, then run recurring reviews for cookies, terminal-equipment access, consent logs, direct marketing, and Member State transposition rules.

Built for privacy, legal, product analytics, web engineering, marketing operations, consent-management, and regional compliance owners who need a practical calendar without unsupported deadline claims.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

This calendar separates fixed ePrivacy source milestones from recurring operating checks. The and its 2009 amendment provide the dated legal baseline; day-to-day compliance depends on current cookie, consent, direct-marketing, and national-law reviews rather than invented future filing dates.

Section 1

Fixed source milestones to keep in the calendar

Record these dates as legal-history anchors, not as new implementation deadlines. They explain which version of the ePrivacy baseline a cookie, terminal-equipment, or direct-marketing control is being mapped against.

Do not add a future ePrivacy Regulation effective date. The Commission proposed an ePrivacy Regulation on 10 January 2017, then withdrew it on 6 October 2025. The separate Digital Omnibus proposal adopted by the Commission on 19 November 2025 would amend Directive 2002/58/EC, but EUR-Lex still lists procedure 2025/0360(COD) as ongoing. Unless an amendment is adopted and becomes applicable, the nationally implemented Directive remains the operating baseline.

12 July 2002: Directive 2002/58/EC was adopted as the privacy and electronic communications Directive.
31 July 2002: Directive 2002/58/EC was published in the Official Journal.
Before 31 October 2003: Member States were required to bring into force the provisions necessary to comply with Directive 2002/58/EC.
25 November 2009: Directive 2009/136/EC was adopted. It amended Directive 2002/58/EC, including Article 5(3), Article 13, and the new Article 15a enforcement framework.
18 December 2009: Directive 2009/136/EC was published in the Official Journal.
19 December 2009: Directive 2009/136/EC entered into force, on the day after publication.
25 May 2011: Member States were required to adopt and publish the measures necessary to comply with Directive 2009/136/EC and notify their Article 15a penalty provisions to the Commission.
10 January 2017: the Commission proposed an ePrivacy Regulation to update the current rules; use this as historical reform context, not as operative law.
6 October 2025: an Official Journal notice listed COM(2017) 10 final among withdrawn Commission proposals; remove any implementation plan that assumes the 2017 proposal will become law.
19 November 2025: the Commission adopted a separate Digital Omnibus proposal that includes amendments to Directive 2002/58/EC. Procedure 2025/0360(COD) remains ongoing, so track it as pending legislation, not as a current compliance deadline.

Sources for this answer

Directive 2002/58/EC (ePrivacy Directive)

Supports the 12 July 2002 adoption date, 31 July 2002 Official Journal publication date, and 31 October 2003 Member State transposition date.

Directive 2009/136/EC amendments to Directive 2002/58/EC

Supports the 25 November 2009 adoption, 18 December 2009 publication, 19 December 2009 entry into force, Article 5(3), Article 13, Article 15a, and the 25 May 2011 transposition and penalty-notification date.

Commission proposal COM(2017) 10 final

Supports the 10 January 2017 ePrivacy Regulation proposal context and prevents treating the proposal as an enacted compliance deadline.

Official Journal notice withdrawing the 2017 proposal

Confirms that COM(2017) 10 final and procedure 2017/0003(COD) were withdrawn in 2025.

EUR-Lex procedure 2025/0360(COD)

Tracks the ongoing Digital Omnibus procedure and its proposed amendments to Directive 2002/58/EC; the proposal is not current law.

Section 2

Cookie and terminal-equipment review cadence

Run this review whenever a website, app, SDK, tag manager, analytics configuration, advertising pixel, local-storage feature, connected-device flow, or user-agent identifier changes. Article 5(3) is triggered by storing information or gaining access to information already stored in a subscriber's or user's terminal equipment, not only by traditional browser cookies.

The review record should classify each technology as consent-required, strictly necessary for the user-requested service, necessary only for transmission, or blocked pending legal review. Keep the technical test tied to actual storage or access operations, not vendor labels.

Inventory cookies, pixels, URLs containing tracking parameters, SDK identifiers, local storage, device identifiers, and IoT reporting paths before each release.
For each item, record whether it stores information, accesses stored information, or only participates in transmission.
For an exemption claim, document the exact service requested by the user and why the storage or access is strictly necessary to provide it.
For audience-measurement tools, check national regulator conditions before relying on an exemption; CNIL's public guidance, for example, lists limits such as single-site scope, IP truncation, no cross-checking, opt-out, and a 13-month tracker lifetime.
Reopen the calendar item when a vendor changes purposes, retention, domains, identifiers, local processing, or downstream sharing.

Sources for this answer

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

Supports treating Article 5(3) as a technical storage/access assessment covering cookies, pixels, local processing, IoT reporting, and unique identifiers.

WP29 Opinion 04/2012 on Cookie Consent Exemption

Supports the two exemption tests for transmission-only cookies and strictly necessary cookies for a user-requested information society service.

CNIL Sheet 16: Use analytics on your websites and applications

Supports using national regulator guidance for analytics-cookie exemption conditions and flags that ePrivacy analytics positions may vary nationally.

Section 3

Consent banner and consent-log calendar items

Review consent banners and consent logs at each banner redesign, CMP configuration change, new purpose/vendor launch, regional rollout, or complaint. The calendar item should prove that consent-required storage or access is off by default and that the user's choice is captured with enough context to demonstrate consent quality.

The banner check should cover both ePrivacy placement or reading of cookies and any later GDPR-governed processing that follows from the storage or access event. Do not rely on the GDPR one-stop-shop mechanism for issues that fall only under the .

Confirm that consent-required cookies, pixels, SDKs, and similar technologies are not placed or read before a positive user action.
Keep evidence that consent was freely given, specific, informed, and unambiguous, with purpose, vendor, timestamp, user interface version, region, and withdrawal path.
Check whether the first layer gives a real refuse or reject path when an accept path is presented.
Remove pre-ticked choices and any inactivity, scrolling, or silence-as-consent pattern.
Review button contrast, link design, and wording for misleading pressure toward acceptance.
Maintain a withdrawal route that remains findable after the first consent decision.

Sources for this answer

EDPB Guidelines 05/2020 on consent

Supports the consent-quality checks for freely given, specific, informed, unambiguous consent and withdrawal evidence.

EDPB Cookie Banner Taskforce report

Supports practical banner review points on reject options, pre-ticked boxes, misleading design, legitimate-interest framing, and withdrawal access.

Section 4

Direct-marketing and national-law checks

Schedule a direct-marketing check before every new email, SMS, automated-calling, fax, or similar electronic-marketing program, and repeat it when countries, message types, lead sources, or customer-relationship assumptions change. Article 13 distinguishes prior consent for certain channels, a limited existing-customer electronic-mail path for similar products or services, and Member State choices for other direct-marketing communications.

Because the Directive is implemented through national law, the calendar should not treat a single EU-wide banner or marketing setting as final. Regional owners should maintain a country-by-country note for cookie placement, analytics exemptions, enforcement authority guidance, direct-marketing opt-in or opt-out rules, and legal-person protections.

Before each campaign, verify the channel, recipient type, country, source of electronic contact details, relationship to prior sale, product similarity, and opt-out wording.
For the existing-customer electronic-mail path, keep proof that the same organization collected the contact details in a sale context and gave a clear, distinct, free, easy objection opportunity at collection and in each message.
Block campaigns that hide the sender identity, lack a valid address for cessation requests, or route recipients to non-compliant marketing pages.
Check whether national legislation chooses consent or opt-out for direct-marketing communications outside the Article 13(1) and 13(2) cases.
For B2B audiences, verify the national rules protecting legitimate interests of subscribers other than natural persons.

Sources for this answer

Directive 2009/136/EC amendments to Directive 2002/58/EC

Supports the amended Article 13 rules for automated calling, fax, electronic mail, customer soft opt-in, sender identity, cessation address, and national-law choices.

Directive 2002/58/EC (ePrivacy Directive)

Supports the original Article 13 direct-marketing structure and the need to track Member State implementation.

EDPB Cookie Banner Taskforce report

Supports treating national law transposing the ePrivacy Directive as the applicable framework for cookie placement or reading complaints.

Section 5

Calendar evidence to keep current

The calendar should be short enough for operating teams to maintain, but it must preserve the reason a control was approved. Each row should link a source, a control owner, the affected countries, and the evidence that shows the current product or marketing behavior matches the rule.

Reopen a row when a source changes, a national authority updates guidance, a vendor changes its technology, a new tracking method appears, a consent interface changes, or a marketing program expands into a new country or channel.

Source anchor: Directive article, guidance document, national-regulator page, and source URL with the date the source was checked.
Technical proof: tag inventory, CMP configuration, blocked-by-default test, browser storage capture, SDK configuration, or network trace.
Consent proof: banner version, language, region, purposes, vendor list, accept/reject/withdrawal paths, and consent-log fields.
Marketing proof: campaign approval, contact-source evidence, opt-out copy, suppression-list operation, sender identity, and cessation address.
National-law proof: country owner, local rule summary, regulator guidance, and the next scheduled recheck trigger.

Sources for this answer

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

Supports keeping technical evidence for storage, access, terminal equipment, and emerging tracking techniques.

EDPB Guidelines 05/2020 on consent

Supports consent-log evidence for demonstrability and withdrawal controls.

CNIL Sheet 16: Use analytics on your websites and applications

Supports documenting local analytics-cookie exemption conditions instead of assuming one EU-wide operating rule.

Recommended next step

Keep cookie, consent, marketing, and national-law reviews current

Sorena can convert this calendar into cited-source review rows, owner assignments, release checks, consent evidence requests, and country-specific follow-up for ePrivacy work.

Research workflow

Open Research Copilot for EU ePrivacy Directive

Ask questions tied to cited sources about Article 5(3), cookie exemptions, consent evidence, direct marketing, and Member State implementation checks.

Explore next step

Talk to Sorena

Talk through ePrivacy implementation

Review your cookie calendar, consent logs, direct-marketing checks, national-law coverage, and source gaps with Sorena.

Explore next step

Primary sources

References and citations

CNIL Sheet 16: Use analytics on your websites and applications

cnil.fr

Referenced sections

Supports documenting local analytics-cookie exemption conditions instead of assuming one EU-wide operating rule.

"may be subject to national variation"

Commission proposal COM(2017) 10 final

eur-lex.europa.eu

Referenced sections

Supports the 10 January 2017 ePrivacy Regulation proposal context and prevents treating the proposal as an enacted compliance deadline.

"COM(2017) 10 final"

Directive 2002/58/EC (ePrivacy Directive)

eur-lex.europa.eu

Referenced sections

Supports the original Article 13 direct-marketing structure and the need to track Member State implementation.

"prior consent"

Directive 2009/136/EC amendments to Directive 2002/58/EC

eur-lex.europa.eu

Referenced sections

Supports the amended Article 13 rules for automated calling, fax, electronic mail, customer soft opt-in, sender identity, cessation address, and national-law choices.