ePrivacy Directive vs GDPR Cookies, communications, consent, and evidence

Protects privacy and confidentiality in the electronic communications sector, including communications, traffic data, location data, terminal-equipment information, directories, and unsolicited communications.

Protects natural persons with regard to personal-data processing and free movement of personal data, regardless of the communications technology used.

A cookie, pixel, SDK, email campaign, or messaging service can need an ePrivacy analysis even before the GDPR personal-data analysis is complete.

The Directive addresses providers of publicly available electronic communications services and public communications networks for several communications duties, while Articles 5(3) and 13 also impose rules relevant to website operators, app providers, advertisers, and other senders. The exact duty comes from national transposition.

GDPR applies to controllers and processors that process personal data within its material and territorial scope. A business can be a controller for its purposes even when a vendor performs the technical collection.

Identify the actor for each operation. Do not assume that only telecom providers face ePrivacy rules or that a technology vendor automatically carries the product operator's GDPR responsibility.

Article 5(3) controls storing information or gaining access to information already stored in a subscriber's or user's terminal equipment, unless the access is transmission-only or strictly necessary for a service explicitly requested by the user.

GDPR controls processing of personal data generated or obtained from that storage or access, such as analytics profiles, advertising segments, account matching, enrichment, sharing, retention, or transfers.

A compliant cookie banner is not the full GDPR answer. Keep a tracker inventory and consent log for ePrivacy, then a lawful-basis and accountability record for downstream personal-data processing.

Requires confidentiality of communications and related traffic data in the electronic communications sector, with specific rules for permitted processing and restrictions.

Requires lawful, fair, transparent, secure, and accountable processing when communications content, traffic data, location data, or customer records are personal data.

For messaging, calling, telecom, or communications metadata features, test confidentiality and traffic/location-data rules before relying on a general GDPR processing assessment.

Useful ePrivacy evidence includes tracker and SDK inventories, Article 5(3) classification, exemption analysis, consent screens, CMP settings, consent logs, withdrawal tests, marketing opt-in or soft-opt-in records, and national-rule notes.

Useful GDPR evidence includes ROPA entries, lawful-basis records, privacy notices, DPIAs or risk assessments where needed, processor terms, security measures, retention records, DSAR logs, breach records, and transfer files.

Use one linked evidence register if helpful, but tag each artifact by the operation and legal source it proves. Shared evidence should not blur the ePrivacy/GDPR boundary.

Article 13 requires prior consent for automated calling systems, fax, and electronic mail direct marketing, with a customer soft-opt-in for a seller's own similar products or services where free and easy objection is offered at collection and in each message.

GDPR still governs personal-data processing behind the campaign, including lawful basis for contact data, transparency, suppression records, segmentation, profiling, processor use, retention, and rights handling.

Keep two records: the ePrivacy marketing-permission or soft-opt-in facts, and the GDPR processing record for the CRM, audience, suppression, and profiling workflow.

ePrivacy duties are enforced through national laws transposing the Directive. The competent authority and penalty route depend on Member State implementation and the specific ePrivacy rule.

GDPR is enforced through data-protection supervisory authorities using GDPR powers, cooperation and consistency mechanisms, corrective powers, and administrative fines.

Do not invent EU-wide ePrivacy fines or country rules. Record the national transposition and authority checked whenever a concrete country answer is needed.

When ePrivacy requires consent, the consent must satisfy GDPR consent conditions; a user must receive clear information and have a real, specific, informed, unambiguous choice.

GDPR defines consent and adds proof, withdrawal, granularity, transparency, and conditionality constraints; consent is not valid if it is bundled or forced in a way that removes real choice.

For banners and marketing forms, preserve the exact user-facing copy, purposes, buttons, vendor choices, timing, consent state, refusal state, withdrawal path, and version history.