ePrivacy Directive vs GDPR Cookies, communications, consent, and evidence
This comparison helps separate ePrivacy duties for communications, terminal equipment, and unsolicited marketing from GDPR duties for personal-data processing.
Based on the ePrivacy Directive, EDPB Opinion 5/2019 on ePrivacy/GDPR interplay, EDPB Article 5(3) technical-scope guidance, EDPB consent guidance, and Commission ePrivacy/GDPR material.
The ePrivacy Directive and GDPR often apply to the same product journey, but they answer different questions. Under the principle, ePrivacy is the more specific rule for confidentiality of electronic communications, terminal-equipment storage or access, traffic and location data, and unsolicited communications. GDPR continues to govern personal-data processing that is not covered by an ePrivacy special rule, including transparency, rights, accountability, security, and later use of data obtained through cookies or similar technologies.
Side-by-side comparison
ePrivacy Directive vs GDPR: where each rule controls
Use these rows to decide whether the fact pattern is governed by an ePrivacy special rule, GDPR, or both in sequence.
Specific rules for electronic communications confidentiality, terminal-equipment storage or access, traffic and location data, and unsolicited communications, implemented through Member State law.
Second framework
GDPR
General EU personal-data framework for controllers and processors, covering lawful basis, transparency, rights, accountability, security, transfers, and enforcement where personal data is processed.
ePrivacy Directive vs GDPR: where each rule controls
Protects privacy and confidentiality in the electronic communications sector, including communications, traffic data, location data, terminal-equipment information, directories, and unsolicited communications.
The Directive addresses providers of publicly available electronic communications services and public communications networks for several communications duties, while Articles 5(3) and 13 also impose rules relevant to website operators, app providers, advertisers, and other senders. The exact duty comes from national transposition.
Explains that ePrivacy particularises GDPR where it contains a specific rule.
particularise
GDPR applies to controllers and processors that process personal data within its material and territorial scope. A business can be a controller for its purposes even when a vendor performs the technical collection.
Explains that GDPR remains applicable where ePrivacy does not contain a special rule.
co-existence
Identify the actor for each operation. Do not assume that only telecom providers face ePrivacy rules or that a technology vendor automatically carries the product operator's GDPR responsibility.
Article 5(3) controls storing information or gaining access to information already stored in a subscriber's or user's terminal equipment, unless the access is transmission-only or strictly necessary for a service explicitly requested by the user.
Supports the technical scope of information, terminal equipment, storage, and access.
storage or access
GDPR controls processing of personal data generated or obtained from that storage or access, such as analytics profiles, advertising segments, account matching, enrichment, sharing, retention, or transfers.
Explains that later personal-data processing after cookie access remains subject to GDPR where ePrivacy has no special rule.
subsequent processing
A compliant cookie banner is not the full GDPR answer. Keep a tracker inventory and consent log for ePrivacy, then a lawful-basis and accountability record for downstream personal-data processing.
Requires confidentiality of communications and related traffic data in the electronic communications sector, with specific rules for permitted processing and restrictions.
Primary source for confidentiality of communications and traffic/location-data rules.
confidentiality
Requires lawful, fair, transparent, secure, and accountable processing when communications content, traffic data, location data, or customer records are personal data.
Primary GDPR source for personal-data principles, security, and accountability.
processing of personal data
For messaging, calling, telecom, or communications metadata features, test confidentiality and traffic/location-data rules before relying on a general GDPR processing assessment.
Supports evidence categories for terminal-equipment access, communications data, and direct marketing.
consent
Useful GDPR evidence includes records of processing activities (ROPA), lawful-basis records, privacy notices, data protection impact assessments (DPIAs) or risk assessments where needed, processor terms, security measures, retention records, data subject access request (DSAR) logs, breach records, and transfer files.
Supports GDPR accountability and processing evidence categories.
accountability
Use one linked evidence register if helpful, but tag each artifact by the operation and legal source it proves. Shared evidence should not blur the ePrivacy/GDPR boundary.
Article 13 requires prior consent for automated calling systems, fax, and electronic mail direct marketing, with a customer soft-opt-in for a seller's own similar products or services where free and easy objection is offered at collection and in each message.
Article 13 supports direct-marketing consent and soft-opt-in conditions without adding country-specific rules.
direct marketing
GDPR still governs personal-data processing behind the campaign, including lawful basis for contact data, transparency, suppression records, segmentation, profiling, processor use, retention, and rights handling.
GDPR source for personal-data processing, transparency, rights, and accountability around marketing data.
lawfulness
Keep two records: the ePrivacy marketing-permission or soft-opt-in facts, and the GDPR processing record for the customer relationship management (CRM), audience, suppression, and profiling workflow.
ePrivacy duties are enforced through national laws transposing the Directive. The competent authority and penalty route depend on Member State implementation and the specific ePrivacy rule.
Supports the national-law and competent-authority caveats for ePrivacy enforcement.
Member States
GDPR is enforced through data-protection supervisory authorities using GDPR powers, cooperation and consistency mechanisms, corrective powers, and administrative fines.
Primary GDPR text for supervisory authorities, cooperation, corrective powers, and administrative fines.
supervisory authority
Do not invent EU-wide ePrivacy fines or country rules. Record the national transposition and authority checked whenever a concrete country answer is needed.
When ePrivacy requires consent, the consent must satisfy GDPR consent conditions; a user must receive clear information and have a real, specific, informed, unambiguous choice.
States GDPR consent conditions apply in ePrivacy contexts.
valid consent
GDPR defines consent and adds proof, withdrawal, granularity, transparency, and conditionality constraints; consent is not valid if it is bundled or forced in a way that removes real choice.
Supports consent quality, withdrawal, granularity, and demonstration requirements.
unambiguous
For banners and marketing forms, preserve the exact user-facing copy, purposes, buttons, vendor choices, timing, consent state, refusal state, withdrawal path, and version history.
Supports evidence consequences for consent collection and withdrawal.
withdraw consent
Scope boundary
ePrivacy Directive
Protects privacy and confidentiality in the electronic communications sector, including communications, traffic data, location data, terminal-equipment information, directories, and unsolicited communications.
Commission material distinguishes personal-data protection from communications and device confidentiality.
the device
Covered actors
ePrivacy Directive
The Directive addresses providers of publicly available electronic communications services and public communications networks for several communications duties, while Articles 5(3) and 13 also impose rules relevant to website operators, app providers, advertisers, and other senders. The exact duty comes from national transposition.
Explains that ePrivacy particularises GDPR where it contains a specific rule.
particularise
GDPR
GDPR applies to controllers and processors that process personal data within its material and territorial scope. A business can be a controller for its purposes even when a vendor performs the technical collection.
Explains that GDPR remains applicable where ePrivacy does not contain a special rule.
co-existence
Operational implication
Identify the actor for each operation. Do not assume that only telecom providers face ePrivacy rules or that a technology vendor automatically carries the product operator's GDPR responsibility.
Supports operation-by-operation scoping instead of whole-product substitution.
facts of the case
Trigger
ePrivacy Directive
Article 5(3) controls storing information or gaining access to information already stored in a subscriber's or user's terminal equipment, unless the access is transmission-only or strictly necessary for a service explicitly requested by the user.
Supports the technical scope of information, terminal equipment, storage, and access.
storage or access
GDPR
GDPR controls processing of personal data generated or obtained from that storage or access, such as analytics profiles, advertising segments, account matching, enrichment, sharing, retention, or transfers.
Explains that later personal-data processing after cookie access remains subject to GDPR where ePrivacy has no special rule.
subsequent processing
Operational implication
A compliant cookie banner is not the full GDPR answer. Keep a tracker inventory and consent log for ePrivacy, then a lawful-basis and accountability record for downstream personal-data processing.
Article 5(3) supplies the consent and exemption structure for terminal-equipment storage or access.
terminal equipment
Core obligations
ePrivacy Directive
Requires confidentiality of communications and related traffic data in the electronic communications sector, with specific rules for permitted processing and restrictions.
Primary source for confidentiality of communications and traffic/location-data rules.
confidentiality
GDPR
Requires lawful, fair, transparent, secure, and accountable processing when communications content, traffic data, location data, or customer records are personal data.
Primary GDPR source for personal-data principles, security, and accountability.
processing of personal data
Operational implication
For messaging, calling, telecom, or communications metadata features, test confidentiality and traffic/location-data rules before relying on a general GDPR processing assessment.
Supports evidence categories for terminal-equipment access, communications data, and direct marketing.
consent
GDPR
Useful GDPR evidence includes records of processing activities (ROPA), lawful-basis records, privacy notices, data protection impact assessments (DPIAs) or risk assessments where needed, processor terms, security measures, retention records, data subject access request (DSAR) logs, breach records, and transfer files.
Supports GDPR accountability and processing evidence categories.
accountability
Operational implication
Use one linked evidence register if helpful, but tag each artifact by the operation and legal source it proves. Shared evidence should not blur the ePrivacy/GDPR boundary.
Supports keeping separate legal bases for linked operations.
processing operations
Direct marketing
ePrivacy Directive
Article 13 requires prior consent for automated calling systems, fax, and electronic mail direct marketing, with a customer soft-opt-in for a seller's own similar products or services where free and easy objection is offered at collection and in each message.
Article 13 supports direct-marketing consent and soft-opt-in conditions without adding country-specific rules.
direct marketing
GDPR
GDPR still governs personal-data processing behind the campaign, including lawful basis for contact data, transparency, suppression records, segmentation, profiling, processor use, retention, and rights handling.
GDPR source for personal-data processing, transparency, rights, and accountability around marketing data.
lawfulness
Operational implication
Keep two records: the ePrivacy marketing-permission or soft-opt-in facts, and the GDPR processing record for the customer relationship management (CRM), audience, suppression, and profiling workflow.
Supports keeping granular, demonstrable consent evidence where consent is the basis.
specific
Enforcement
ePrivacy Directive
ePrivacy duties are enforced through national laws transposing the Directive. The competent authority and penalty route depend on Member State implementation and the specific ePrivacy rule.
Supports the national-law and competent-authority caveats for ePrivacy enforcement.
Member States
GDPR
GDPR is enforced through data-protection supervisory authorities using GDPR powers, cooperation and consistency mechanisms, corrective powers, and administrative fines.
Primary GDPR text for supervisory authorities, cooperation, corrective powers, and administrative fines.
supervisory authority
Operational implication
Do not invent EU-wide ePrivacy fines or country rules. Record the national transposition and authority checked whenever a concrete country answer is needed.
Explains that DPAs enforce ePrivacy directly only when national law grants that competence.
competent authority
Overlap and reuse
ePrivacy Directive
When ePrivacy requires consent, the consent must satisfy GDPR consent conditions; a user must receive clear information and have a real, specific, informed, unambiguous choice.
States GDPR consent conditions apply in ePrivacy contexts.
valid consent
GDPR
GDPR defines consent and adds proof, withdrawal, granularity, transparency, and conditionality constraints; consent is not valid if it is bundled or forced in a way that removes real choice.
Supports consent quality, withdrawal, granularity, and demonstration requirements.
unambiguous
Operational implication
For banners and marketing forms, preserve the exact user-facing copy, purposes, buttons, vendor choices, timing, consent state, refusal state, withdrawal path, and version history.
Supports evidence consequences for consent collection and withdrawal.
withdraw consent
Practical decision rule
How should teams decide which framework controls?
Identify the exact operation: communications confidentiality, terminal-equipment storage/access, traffic data, location data, direct marketing, or downstream personal-data processing.
Apply the ePrivacy special rule first where one exists, including Article 5(3), Article 6, Article 9, or Article 13 as relevant.
Apply GDPR to personal-data processing not specifically covered by that ePrivacy rule, including later analytics, profiling, sharing, retention, rights, security, transfers, and accountability.
Keep national ePrivacy implementation caveats visible; do not state country penalties or authority powers unless the national source has been checked.
Primary source for GDPR processing duties after the ePrivacy scoping step.
personal data
1
Section 1
Classify each operation before choosing the rule
For cookies, pixels, SDKs, device identifiers, local storage, connected-device reporting, email marketing, and communications metadata, first ask whether the operation is specifically regulated by national law transposing the ePrivacy Directive. If yes, that special rule sets the ePrivacy answer for that operation.
Then ask whether the same facts include personal-data processing before, after, or around the ePrivacy step. If they do, GDPR still has to be tested for the parts not specifically governed by ePrivacy.
Do not treat GDPR legitimate interests as a substitute for ePrivacy consent where Article 5(3), traffic-data, location-data, or direct-marketing rules require consent.
Do not stop at ePrivacy consent if the data is later profiled, enriched, shared, retained, transferred, or used for analytics or advertising; those later processing steps need a GDPR analysis.
Keep the evidence split by operation: terminal-equipment access, communications-service activity, direct marketing, and downstream personal-data processing.
Supports the lex specialis rule: ePrivacy special provisions take precedence only for the specific operations they regulate, while GDPR continues to apply elsewhere.
Primary ePrivacy Directive text for confidentiality, terminal equipment, traffic and location data, and unsolicited communications.
privacy and electronic communications
2
Section 2
What ePrivacy adds that GDPR does not supersede
The ePrivacy Directive protects communications confidentiality and terminal equipment as well as governing cookies. Its protection can apply even where the information is not personal data. EDPB Article 5(3) guidance explains that the covered object is information regardless of whether it is personal data, and that storage and access are separate technical notions.
That matters for engineering review. A tracker, pixel, SDK, connected-car report, local-processing design, or identifier read can be in ePrivacy scope before a team knows whether the resulting data identifies a person under GDPR.
Classify the technical act: storing information, gaining access to stored information, transmitting a communication, processing traffic data, processing location data, or sending unsolicited communications.
Record the device or endpoint involved, such as browser, app, phone, connected TV, connected car, wearable, or other terminal equipment.
Separate the ePrivacy exemption test from the GDPR lawful-basis test; the Article 5(3) exceptions are transmission-only access and access strictly necessary for a service explicitly requested by the user.
Commission material contrasts GDPR's personal-data focus with ePrivacy protection for communications confidentiality and devices.
confidentiality of electronic communications
3
Section 3
Consent is shared vocabulary, but not a shortcut
The ePrivacy Directive refers to consent for several operations, including Article 5(3) terminal-equipment storage or access and Article 13 electronic mail direct marketing. EDPB consent guidance states that GDPR consent conditions apply in ePrivacy situations: consent must be freely given, specific, informed, and unambiguous, and controllers must be able to demonstrate it.
If ePrivacy requires consent, the team cannot pick another GDPR lawful basis for the same storage, access, traffic-data, location-data, or marketing act. If personal data is processed after that act, GDPR still requires its own lawful basis and accountability evidence.
For cookie and SDK consent, keep the purposes, vendors, storage/access methods, user choice screen, reject and withdrawal paths, and consent log together.
For direct marketing, keep the prior-consent record or the Article 13 soft-opt-in facts, including the original sale context, own similar products or services, and free easy objection at collection and in each message.
For GDPR, keep the lawful basis, notice, data categories, retention, recipients, rights process, processor terms, and transfer analysis for downstream processing.
Article 13 supports prior consent for automated calls, fax, and electronic mail direct marketing, plus the customer soft-opt-in conditions.
unsolicited communications
4
Section 4
Enforcement and evidence depend on national implementation
The ePrivacy Directive is implemented through Member State law. EDPB Opinion 5/2019 states that Member States must appoint one or more authorities to supervise compliance with national ePrivacy rules, and that data-protection authorities can directly enforce ePrivacy only where national law gives them that competence.
Identify the national penalty provision and competent authority for the specific ePrivacy duty. GDPR has its own supervisory framework; its fine levels and cooperation procedures do not automatically govern an ePrivacy-only infringement.
For ePrivacy evidence, record the national rule checked, the competent authority assumption, and the operation covered by that rule.
For GDPR evidence, record the controller or processor role, GDPR obligation, supervisory-authority route, and any cross-border cooperation relevance.
Where the same conduct is investigated under both frameworks, keep a linked timeline so factual findings can be reused without pretending the legal powers are identical.
Supports the national-law caveat, ePrivacy authority competence limits, and continued GDPR competence for processing not covered by an ePrivacy special rule.
Primary GDPR text for personal-data processing, accountability, supervisory authorities, cooperation, corrective powers, and administrative fines.
protection of natural persons
5
Section 5
Run the two tests in sequence
A single feature can produce different answers at different steps. Map the technical operation first, then map every use of personal data that follows. The ePrivacy result does not approve the later processing, and a GDPR lawful basis does not remove an ePrivacy consent requirement.
The examples below show the sequence, not a universal outcome. National transposition can affect the ePrivacy rule, particularly for marketing and enforcement, and the GDPR result depends on the actual purposes, data, roles, and safeguards.
Authentication cookie: storage may fall within the Article 5(3) exception when it is strictly necessary for a service the user explicitly requested. If the cookie or linked account data is personal data, GDPR still governs purposes, transparency, security, retention, and rights.
Advertising pixel or SDK: if it stores information or reads terminal-equipment information, test Article 5(3) before it runs. If the resulting identifiers or profiles are personal data, separately document the GDPR lawful basis, notice, recipients, retention, profiling, and transfer position.
Marketing email to an existing customer: document prior consent or every condition of the Article 13 customer exception under the applicable national law. Separately document the GDPR basis for the contact list, segmentation, suppression record, and any profiling.
Communications metadata: test the Directive's specific traffic-data or location-data rule before the general GDPR analysis. A general legitimate-interests assessment cannot replace a consent requirement imposed by the applicable ePrivacy rule.
Supports applying an ePrivacy special rule to the operation it specifically regulates and GDPR to other personal-data processing in the same journey.
Recommended next step
This comparison helps split cookie, marketing, communications, and GDPR work
Sorena can turn the comparison on this page into cited scope decisions, consent checks, tracker evidence, marketing review records, and GDPR accountability tasks.
Source for the lex specialis relationship, GDPR coexistence, Article 95 effect, and enforcement competence caveats.
Supports the lex specialis rule: ePrivacy special provisions take precedence only for the specific operations they regulate, while GDPR continues to apply elsewhere.
Supports the national-law caveat, ePrivacy authority competence limits, and continued GDPR competence for processing not covered by an ePrivacy special rule.
Show 9 more
Supports applying an ePrivacy special rule to the operation it specifically regulates and GDPR to other personal-data processing in the same journey.
Explains that ePrivacy particularises GDPR where it contains a specific rule.
Explains that GDPR remains applicable where ePrivacy does not contain a special rule.
Supports operation-by-operation scoping instead of whole-product substitution.
Explains that later personal-data processing after cookie access remains subject to GDPR where ePrivacy has no special rule.
Supports keeping separate legal bases for linked operations.
Supports the national-law and competent-authority caveats for ePrivacy enforcement.
Explains that DPAs enforce ePrivacy directly only when national law grants that competence.
Supports the operation-by-operation decision rule and GDPR coexistence.