| Scope boundary | Protects privacy and confidentiality in the electronic communications sector, including communications, traffic data, location data, terminal-equipment information, directories, and unsolicited communications. | Protects natural persons with regard to personal-data processing and free movement of personal data, regardless of the communications technology used. | A cookie, pixel, SDK, email campaign, or messaging service can need an ePrivacy analysis even before the GDPR personal-data analysis is complete. |
|---|
| Covered actors | Where ePrivacy contains a special rule for the operation, that rule takes precedence for the specific storage, access, traffic-data, location-data, or marketing act. | GDPR still applies to personal-data processing not specifically governed by ePrivacy, including later profiling, analytics, data-subject rights, notices, security, retention, and transfers. | Do not ask which law wins for the whole product. Ask which operation is covered by a special ePrivacy rule and which related processing remains under GDPR. |
|---|
| Trigger | Article 5(3) controls storing information or gaining access to information already stored in a subscriber's or user's terminal equipment, unless the access is transmission-only or strictly necessary for a service explicitly requested by the user. | GDPR controls processing of personal data generated or obtained from that storage or access, such as analytics profiles, advertising segments, account matching, enrichment, sharing, retention, or transfers. | A compliant cookie banner is not the full GDPR answer. Keep a tracker inventory and consent log for ePrivacy, then a lawful-basis and accountability record for downstream personal-data processing. |
|---|
| Core obligations | Requires confidentiality of communications and related traffic data in the electronic communications sector, with specific rules for permitted processing and restrictions. | Requires lawful, fair, transparent, secure, and accountable processing when communications content, traffic data, location data, or customer records are personal data. | For messaging, calling, telecom, or communications metadata features, test confidentiality and traffic/location-data rules before relying on a general GDPR processing assessment. |
|---|
| Evidence record | Useful ePrivacy evidence includes tracker and SDK inventories, Article 5(3) classification, exemption analysis, consent screens, CMP settings, consent logs, withdrawal tests, marketing opt-in or soft-opt-in records, and national-rule notes. | Useful GDPR evidence includes ROPA entries, lawful-basis records, privacy notices, DPIAs or risk assessments where needed, processor terms, security measures, retention records, DSAR logs, breach records, and transfer files. | Use one linked evidence register if helpful, but tag each artifact by the operation and legal source it proves. Shared evidence should not blur the ePrivacy/GDPR boundary. |
|---|
| Timing and deadlines | Article 13 requires prior consent for automated calling systems, fax, and electronic mail direct marketing, with a customer soft-opt-in for a seller's own similar products or services where free and easy objection is offered at collection and in each message. | GDPR still governs personal-data processing behind the campaign, including lawful basis for contact data, transparency, suppression records, segmentation, profiling, processor use, retention, and rights handling. | Keep two records: the ePrivacy marketing-permission or soft-opt-in facts, and the GDPR processing record for the CRM, audience, suppression, and profiling workflow. |
|---|
| Enforcement | ePrivacy duties are enforced through national laws transposing the Directive. The competent authority and penalty route depend on Member State implementation and the specific ePrivacy rule. | GDPR is enforced through data-protection supervisory authorities using GDPR powers, cooperation and consistency mechanisms, corrective powers, and administrative fines. | Do not invent EU-wide ePrivacy fines or country rules. Record the national transposition and authority checked whenever a concrete country answer is needed. |
|---|
| Overlap and reuse | When ePrivacy requires consent, the consent must satisfy GDPR consent conditions; a user must receive clear information and have a real, specific, informed, unambiguous choice. | GDPR defines consent and adds proof, withdrawal, granularity, transparency, and conditionality constraints; consent is not valid if it is bundled or forced in a way that removes real choice. | For banners and marketing forms, preserve the exact user-facing copy, purposes, buttons, vendor choices, timing, consent state, refusal state, withdrawal path, and version history. |
|---|
| Practical decision rule | Protects privacy and confidentiality in the electronic communications sector, including communications, traffic data, location data, terminal-equipment information, directories, and unsolicited communications. | Protects natural persons with regard to personal-data processing and free movement of personal data, regardless of the communications technology used. | A cookie, pixel, SDK, email campaign, or messaging service can need an ePrivacy analysis even before the GDPR personal-data analysis is complete. |
|---|