Ops GuideEU

EU ePrivacy Directive Direct Marketing Rules

Build a provable marketing consent system: capture, withdrawal, and suppression.

Focus: consent vs soft opt-in model, opt-out UX, and evidence exports.

Author
Sorena AI
Published
Feb 21, 2026
Updated
Feb 21, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
2

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Feb 21, 2026
Updated Feb 21, 2026
Overview

Marketing compliance is usually broken by operations, not policy: missing proof, inconsistent wording, and weak suppression-list governance. Article 13 obligations are best implemented as a system: capture model, evidence logs, withdrawal propagation, vendor enforcement, and routine audits. The current baseline is the directive as implemented in national law, so keep the per-channel and per-market model explicit.

Section 1

Start with a channel-by-channel model

Define the legal model separately for each channel and market because national implementations and expectations can vary.

Your evidence must answer: who did you contact, why were you allowed, and how could they stop it?

  • Channels, email, SMS, instant messaging, push, and automated calls where applicable.
  • Model, prior consent or soft opt-in where national law allows it, with the specific constraints written down per market.
  • Always, opt-out must be easy and recorded, and suppression must be honored across every tool and vendor.
Section 3

Suppression lists: treat them as safety-critical data

Suppression lists are the control that prevents repeated violations.

They need access control, audit logs, and vendor propagation guarantees.

  • One suppression source of truth; no ad-hoc lists per tool.
  • Access controls + change logs; approvals for overrides (rare).
  • Vendors: contracts and technical integrations that enforce suppression.
Section 4

Evidence pack (what you should be able to export)

When questioned, speed matters. Build an export pack so you can respond with coherent evidence quickly.

Exportability is a measurable capability.

  • Consent capture flows + wording versions (screenshots/specs).
  • Consent and withdrawal logs (schema + sample exports).
  • Suppression governance SOP + vendor propagation evidence.
  • Campaign approval workflow and compliance checks.
Recommended next step

Use EU ePrivacy Directive Direct Marketing Rules as a cited research workflow

Research Copilot can take EU ePrivacy Directive Direct Marketing Rules from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on EU ePrivacy Directive can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

Related guides

Explore more topics

Confidentiality of Communications (ePrivacy Directive) | Traffic Data, Location Data, Content, and the OTT Gap
A practical guide to communications confidentiality under the current ePrivacy Directive, Directive 2002/58/EC: how to classify content, traffic data.
Cookies & Consent (ePrivacy Directive Article 5(3)) | Exemptions Test, Analytics, CMP Implementation
An advanced guide to cookie consent under the ePrivacy Directive (Directive 2002/58/EC): how Article 5(3) applies to cookies/SDKs/local storage.
Direct Marketing Consent Checklist (ePrivacy Article 13) | Proof, Opt-Out, Suppression Lists
A practical direct marketing consent checklist for ePrivacy (Directive 2002/58/EC, Article 13): consent capture fields, wording/version control.
ePrivacy Applicability Test (Directive 2002/58/EC) | Cookies Article 5(3), Marketing Article 13, Metadata
A practical EU ePrivacy applicability test: decide whether your product triggers terminal equipment access rules (cookies/SDKs/local storage/fingerprinting.
ePrivacy Checklist (Directive 2002/58/EC) | Cookie Banner, Consent Logs, Exemptions, Marketing Evidence
An audit-ready ePrivacy checklist: build a tracker inventory and Article 5(3) decision table (consent vs exemptions).
ePrivacy Compliance Program | Cookies, Consent UX, Evidence, Marketing Controls (Directive 2002/58/EC)
A practical ePrivacy implementation playbook: governance, tracker inventory and Article 5(3) decision table, cookie banner and CMP design.
ePrivacy Deadlines and Compliance Calendar | Directive Baseline, Banner Audits, Marketing Audits
A practical ePrivacy calendar built around the current directive baseline and recurring controls: the 2002 directive, the 2009 cookie amendment.
ePrivacy Directive Enforcement (Cookies + Marketing) | How Regulators Assess Cookie Banners, Consent, and Evidence
An advanced guide to ePrivacy Directive enforcement: who enforces national ePrivacy laws, what regulators look for in cookie banners and consent UX.
ePrivacy Directive Penalties and Fines | What "Effective, Proportionate, Dissuassive" Means + Risk Reduction Controls
Understand penalties and fine exposure under national laws implementing the ePrivacy Directive (Directive 2002/58/EC).
ePrivacy Directive Requirements (2002/58/EC) | Article 5(3) Cookies, Article 13 Marketing, Metadata + Evidence Map
A practical ePrivacy Directive requirements breakdown: terminal equipment access and cookie consent/exemptions (Article 5(3)).
ePrivacy Directive vs GDPR | Which Law Applies to Cookies, Tracking, Communications Metadata, and Marketing?
A practical, source-grounded split between the ePrivacy Directive and GDPR: ePrivacy for placement/reading on devices and communications confidentiality.
ePrivacy FAQ (Directive 2002/58/EC) | Cookies, Consent Exemptions, Cookie Walls, Marketing, Enforcement
High-signal ePrivacy answers: when cookies/SDKs need consent (Article 5(3)), what counts as strictly necessary (WP29 WP194).
ePrivacy vs GDPR (Cookie Stack Blueprint) | Align Consent UX, Tag Firing, Processing Purposes, and Evidence
A combined ePrivacy + GDPR implementation blueprint for cookies, tracking, and marketing.
EU Cookie Banner Requirements | ePrivacy Directive + GDPR Consent (EDPB) | UX Patterns + Test Cases
A practical cookie banner and CMP requirements guide: acceptance/reject parity, granularity, clear purposes, vendor transparency, no pre-ticked boxes.