The ePrivacy Directive does not create a single EU-wide fine table. Article 15a requires Member States to set and implement effective, proportionate, and dissuasive penalties for national ePrivacy rules.
This page helps separate EU-level duties from national enforcement, understand when GDPR supervisory practice is relevant, and maintain evidence for cookies, terminal-equipment access, communications data, and direct marketing.
ePrivacy enforcement is national in operation. The Directive sets the EU-level frame: Member States must transpose the rules, provide penalties, give enforcement powers, and support cross-border cooperation. There is no single EU fine amount to look up. An organization must identify which national ePrivacy law applies to the conduct, which authority can act, whether GDPR also governs later personal-data processing, and what evidence shows the risk was controlled.
Article 15a is the enforcement anchor. It requires Member States to lay down rules on penalties, including criminal sanctions where appropriate, for infringements of national provisions adopted under the Directive. Those penalties must be effective, proportionate, and dissuasive, and they may cover the period of a breach even if the breach has later been corrected.
The same article requires competent national authorities, and where relevant other national bodies, to be able to order cessation of infringements and to have investigative powers and resources, including power to obtain relevant information needed to monitor and enforce national ePrivacy rules. Article 15a(4) also allows relevant national regulatory authorities to adopt cross-border cooperation measures; it does not create the GDPR's one-stop-shop for ePrivacy-only enforcement.
Sources (2)
Article 15a requires Member States to set penalties and ensure competent authorities can stop, investigate, and enforce infringements of national ePrivacy provisions.
effective, proportionate and dissuasive
Explains that Member States can allocate ePrivacy enforcement to one or more bodies and that Article 15a gives discretion over penalties and enforcement design.
Implementation and enforcement
The Directive sets objectives and minimum enforcement features, but national law supplies the concrete penalty rules and authority powers. EDPB Opinion 5/2019 states that Member States have chosen different ways to allocate ePrivacy enforcement and that the Directive does not require only one national body to be competent.
That means a cross-border website, app, telecom service, CRM campaign, or analytics stack needs a country-by-country enforcement map before anyone can estimate sanctions. The EU-level sources support the principle of national penalties; they do not support a universal country penalty table on this page.
Sources (1)
Supports the distinction between EU ePrivacy obligations and nationally assigned enforcement competence, including the possibility of multiple competent bodies.
more than one national body
Do not start every enforcement matter with a fine calculation. Article 15a requires national bodies to have power to order cessation, while national law determines the complaint route, available judicial remedies, and which body can impose a penalty. An organization responding to a complaint should identify the requested outcome and legal route first.
Article 13(6) adds a specific court route for unsolicited communications. Member States must allow a natural or legal person adversely affected by an infringement of the national Article 13 rules, and with a legitimate interest in stopping or prohibiting it, to bring legal proceedings. The text includes an electronic communications service provider protecting its legitimate business interests. This provision should not be presented as a general EU damages rule for every ePrivacy breach.
Sources (1)
Article 2(7) inserted Article 13(6), which requires a legal-proceedings route for adversely affected natural or legal persons with a legitimate interest in cessation or prohibition; Article 15a separately addresses penalties, cessation orders, investigation, and cooperation.
may bring legal proceedings in respect of such infringements
ePrivacy and GDPR can apply to the same user journey, but not always to the same processing operation. For cookie placement or reading, the Cookie Banner Taskforce confirmed that the applicable framework is national law transposing the ePrivacy Directive. For subsequent personal-data processing after terminal-equipment access, GDPR can apply.
EDPB Opinion 5/2019 adds an important limit: GDPR supervisory authorities remain competent to enforce the GDPR, but they can directly enforce national ePrivacy rules only if national law gives them that competence. GDPR cooperation and consistency mechanisms do not apply to enforcement of national ePrivacy implementation as such, although they remain available for GDPR issues.
Sources (3)
Confirms the split between national ePrivacy law for cookie placement or reading and GDPR for subsequent processing, and notes that the GDPR one-stop-shop does not apply to ePrivacy issues.
placement or reading of cookies
Grounds the limit that data protection authorities cannot directly enforce national ePrivacy rules unless Member State law grants that competence.
only if national law confers
Provides GDPR consent criteria used where ePrivacy rules depend on valid consent, including demonstrability and withdrawal requirements.
withdraw their consent easily
This page intentionally avoids country fine amounts, regulator penalty matrices, and national rules not present in the cited sources. The EU-level sources support the enforcement architecture and evidence priorities, but they do not provide a complete operational answer for every Member State.
They also do not turn the withdrawn 2017 ePrivacy Regulation proposal's fine levels into current ePrivacy Directive penalties. Proposal materials are historical policy context only; current Directive exposure must be checked against national transposition and the competent authority's powers.
No. The Directive requires Member States to set effective, proportionate, and dissuasive penalties for national ePrivacy rules, but the sources do not support one EU-wide fine amount for the current Directive.
Only where national law gives that authority ePrivacy competence. EDPB Opinion 5/2019 says GDPR authorities remain competent for GDPR processing, but direct ePrivacy enforcement depends on Member State law.
Keep pre-consent scans, banner screenshots, CMP settings, consent and withdrawal logs, cookie and SDK inventories, exemption justifications, and retest records after changes to tags, vendors, analytics, ads, or releases.
No. Fixing the issue may stop the ongoing conduct and is important remediation, but Article 15a allows national penalties to cover the period of a breach even when the breach was later corrected. The actual consequence still depends on the applicable Member State law, competent authority, and case facts.
Sources (3)
Supports the limits around national competence, GDPR/ePrivacy coexistence, and the need to justify enforcement under the correct legal instrument.
enforcement decision must be justified
Used only as proposal context for the Commission's attempt to harmonise supervision and penalties; it is not treated as current Directive fine law.
COM(2017) 10 final
Confirms that the 2017 proposal was withdrawn, so its proposed penalty model cannot be used as current Directive law.
WITHDRAWAL OF COMMISSION PROPOSALS
Sorena can help turn this page into country-specific research prompts, cookie and consent evidence requests, GDPR/ePrivacy separation checks, and regulator-ready source trails.
Ask questions tied to cited sources about Article 15a, national enforcement competence, cookie-banner complaints, and GDPR/ePrivacy boundaries using the cited sources on this page.
Review your ePrivacy enforcement evidence, country source gaps, and consent-risk workflow with Sorena.
"only if national law confers"
"Implementation and enforcement"
"more than one national body"
"enforcement decision must be justified"
"effective, proportionate and dissuasive"
"may bring legal proceedings in respect of such infringements"
"Cookie Banner Taskforce"
"placement or reading of cookies"
"pre-ticked boxes"
"subject to national variation"
"may be subject to national variation"
"freely given, specific, informed and unambiguous"
"withdraw their consent easily"
"Technical Scope of Art. 5(3)"
"COM(2017) 10 final"
"Cookie Consent Exemption"
"strictly necessary"
"WITHDRAWAL OF COMMISSION PROPOSALS"
Compare ePrivacy rules for device storage and access with DSA ad labels, advertiser disclosures, targeting information, profiling limits, and VLOP/VLOSE ad repositories.
Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence.
EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs.
Source-backed guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps.
A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence.
A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence.
Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay.
Build evidence that links each cookie or tracker decision to the banner shown, the user's signal, the live technical behavior, withdrawal, and later changes.
Source-backed cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence.
Decide whether cookies, pixels, SDKs, local storage, identifiers, and analytics fall within Article 5(3), then document consent, an exemption, or escalation.
Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats.
Source-backed ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up.
A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records.
Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats.
Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay.
Source-backed guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats.
Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence.
How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice.
Source-backed guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits.
Source-backed guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits.
Source-backed map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing.
Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.
Compare the EU ePrivacy Directive with current UK PECR rules for device storage and access, statutory exceptions, consent, electronic-mail marketing, soft opt-ins, and enforcement.
Source-backed checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats.
Decide whether an electronic-mail marketing audience meets every Article 13 soft opt-in condition, or must be suppressed or supported by valid prior consent.
Source-backed guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks.
FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.
FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.
When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.
Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.
FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions.
FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.