Compare the EU and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing.
This page helps separate terminal-equipment access from personal-data processing, communications confidentiality from GDPR accountability, and ePrivacy marketing rules from broader privacy governance.
The and GDPR often apply to the same product journey, but they answer different first questions. ePrivacy asks whether a service stores or accesses information on terminal equipment, protects electronic-communications confidentiality, or sends covered direct marketing. GDPR asks whether personal data is processed and then applies controller, processor, lawful-basis, transparency, rights, security, transfer, and accountability duties.
Side-by-side comparison
EU ePrivacy Directive vs GDPR: concrete operating split
Use these rows to decide which law supplies the trigger, what consent or lawful-basis evidence is needed, where lex specialis limits GDPR analysis, and when national ePrivacy law must be checked.
Use for terminal-equipment storage/access, communications confidentiality, traffic and location data rules, and Article 13 direct marketing gates.
Second framework
GDPR
Use for personal-data processing, controllers and processors, lawful bases, transparency, rights, security, transfers, retention, breaches, and accountability.
EU ePrivacy Directive vs GDPR: concrete operating split
Has someone stored information on, or gained access to information already stored in, a subscriber or user terminal, or interfered with electronic-communications confidentiality?
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Technical scope guidance for information, terminal equipment, gaining access, storage, pixels, local processing, IoT reporting, and unique identifiers.
technical scope of Art. 5(3)
Is there processing of personal data about an identified or identifiable natural person, and who is the controller, processor, joint controller, recipient, or data subject?
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Start separate issue records. A tracker can trigger ePrivacy before any personal-data analysis, while a CRM import can trigger GDPR without Article 5(3) device access.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Confidentiality of electronic communications, related traffic data, terminal equipment, and information stored on or accessed from that equipment, including information that is not personal data.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Commission comparison that GDPR protects personal data while ePrivacy protects confidentiality of electronic communications and device integrity.
confidentiality of electronic communications and the device
Personal data and the rights and freedoms of natural persons, including fairness, transparency, purpose limitation, data minimisation, security, rights, and accountability.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Do not dismiss Article 5(3) because a value is non-personal; do not open a GDPR record unless there is personal-data processing.
Article 5(3) governs the storage/access step and applies through criteria for information, qualifying terminal equipment, and gaining access or storage. Terminal equipment must be connected or connectable to a public communications network, but the storage or access itself need not use that network.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Technical scope guidance for information, terminal equipment, gaining access, storage, pixels, local processing, IoT reporting, and unique identifiers.
technical scope of Art. 5(3)
GDPR governs subsequent personal-data processing such as user identification, analytics reporting, behavioural advertising, profiling, enrichment, disclosure, and retention.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
Evidence should split placement or reading from follow-on processing: tracker classification, purpose, exemption or consent decision, then GDPR lawful basis and processing record where personal data is used.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Article 5 requires national-law protection against listening, tapping, storage, interception, or surveillance of communications and related traffic data by persons other than users, subject to consent, necessary technical storage, or legal authorisation.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
privacy and electronic communications
GDPR applies to personal data in communications and related processing, but it does not supersede the ePrivacy confidentiality rule for the communications operation itself.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
For messaging, calling, email, logging, monitoring, or recording features, keep an ePrivacy confidentiality analysis and a separate GDPR processing analysis when personal data is handled.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Record of processing activities (ROPA), lawful-basis record, privacy notice, data protection impact assessment (DPIA) or risk assessment where needed, processor terms, retention schedule, data subject access request (DSAR) workflow, breach assessment, transfer file, consent proof where consent is used, and accountability approvals.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
One evidence repository is fine if every item is labelled by law, operation, source, owner, date, system, user-facing copy, and unresolved national-law caveat.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
Article 13 requires prior consent for automated calling systems, fax, and electronic mail direct marketing, includes a customer soft opt-in for own similar products or services, and leaves some choices to national legislation.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
privacy and electronic communications
GDPR still governs personal-data processing for marketing lists, profiling, segmentation, CRM records, transparency, rights, retention, and processors.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Do not rely on GDPR legitimate interests to bypass Article 13 where ePrivacy requires consent or an opt-out structure under national law.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
The Directive is implemented through national law; Member States set penalties and designate competent authorities for national ePrivacy rules, so country-specific enforcement and penalty claims require a national source.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
GDPR has EU-level supervisory-authority powers and administrative-fine provisions, but those powers do not automatically become ePrivacy powers unless national ePrivacy law confers them.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Escalate to country counsel or a national regulator source before stating an ePrivacy penalty amount, competent authority, soft-opt-in variant, or cookie exemption beyond the EU-level rule.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
When ePrivacy requires consent, the current standard is read through GDPR consent conditions: freely given, specific, informed, unambiguous, based on a clear affirmative action, demonstrable, and easy to withdraw.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Consent is one GDPR lawful basis and carries Article 7 proof and withdrawal duties; if GDPR processing uses another lawful basis, that does not remove an ePrivacy consent requirement for the storage/access or marketing operation.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Keep proof of the user-facing choice, purpose granularity, affirmative action, default state, refusal path, withdrawal path, and evidence that refusal did not create detriment.
Where ePrivacy specifically regulates an operation, its special rule takes precedence for that operation and may limit the GDPR lawful-basis menu for that operation.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
GDPR remains applicable to personal-data processing not specifically governed by ePrivacy, including prior or subsequent processing and GDPR rights or controller obligations not displaced by a special ePrivacy rule.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Mark the exact operation covered by ePrivacy. Do not label the entire product journey ePrivacy-only just because one tracker, communication, or marketing message is covered.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
Scope boundary
EU ePrivacy Directive
Has someone stored information on, or gained access to information already stored in, a subscriber or user terminal, or interfered with electronic-communications confidentiality?
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Technical scope guidance for information, terminal equipment, gaining access, storage, pixels, local processing, IoT reporting, and unique identifiers.
technical scope of Art. 5(3)
GDPR
Is there processing of personal data about an identified or identifiable natural person, and who is the controller, processor, joint controller, recipient, or data subject?
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Operational implication
Start separate issue records. A tracker can trigger ePrivacy before any personal-data analysis, while a CRM import can trigger GDPR without Article 5(3) device access.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Protected subject matter
EU ePrivacy Directive
Confidentiality of electronic communications, related traffic data, terminal equipment, and information stored on or accessed from that equipment, including information that is not personal data.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Commission comparison that GDPR protects personal data while ePrivacy protects confidentiality of electronic communications and device integrity.
confidentiality of electronic communications and the device
GDPR
Personal data and the rights and freedoms of natural persons, including fairness, transparency, purpose limitation, data minimisation, security, rights, and accountability.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Operational implication
Do not dismiss Article 5(3) because a value is non-personal; do not open a GDPR record unless there is personal-data processing.
Commission comparison that GDPR protects personal data while ePrivacy protects confidentiality of electronic communications and device integrity.
confidentiality of electronic communications and the device
Trigger
EU ePrivacy Directive
Article 5(3) governs the storage/access step and applies through criteria for information, qualifying terminal equipment, and gaining access or storage. Terminal equipment must be connected or connectable to a public communications network, but the storage or access itself need not use that network.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Technical scope guidance for information, terminal equipment, gaining access, storage, pixels, local processing, IoT reporting, and unique identifiers.
technical scope of Art. 5(3)
GDPR
GDPR governs subsequent personal-data processing such as user identification, analytics reporting, behavioural advertising, profiling, enrichment, disclosure, and retention.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
Operational implication
Evidence should split placement or reading from follow-on processing: tracker classification, purpose, exemption or consent decision, then GDPR lawful basis and processing record where personal data is used.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Core obligations
EU ePrivacy Directive
Article 5 requires national-law protection against listening, tapping, storage, interception, or surveillance of communications and related traffic data by persons other than users, subject to consent, necessary technical storage, or legal authorisation.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
privacy and electronic communications
GDPR
GDPR applies to personal data in communications and related processing, but it does not supersede the ePrivacy confidentiality rule for the communications operation itself.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Operational implication
For messaging, calling, email, logging, monitoring, or recording features, keep an ePrivacy confidentiality analysis and a separate GDPR processing analysis when personal data is handled.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Evidence record
EU ePrivacy Directive
Tracker and SDK inventory, Article 5(3) classification, consent or exemption rationale, consent management platform (CMP) screenshots and configuration, communications-recording analysis, traffic/location-data decision, marketing consent or soft-opt-in record, suppression list, and national-law check.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
GDPR
Record of processing activities (ROPA), lawful-basis record, privacy notice, data protection impact assessment (DPIA) or risk assessment where needed, processor terms, retention schedule, data subject access request (DSAR) workflow, breach assessment, transfer file, consent proof where consent is used, and accountability approvals.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Operational implication
One evidence repository is fine if every item is labelled by law, operation, source, owner, date, system, user-facing copy, and unresolved national-law caveat.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
Direct marketing
EU ePrivacy Directive
Article 13 requires prior consent for automated calling systems, fax, and electronic mail direct marketing, includes a customer soft opt-in for own similar products or services, and leaves some choices to national legislation.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
privacy and electronic communications
GDPR
GDPR still governs personal-data processing for marketing lists, profiling, segmentation, CRM records, transparency, rights, retention, and processors.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
Operational implication
Do not rely on GDPR legitimate interests to bypass Article 13 where ePrivacy requires consent or an opt-out structure under national law.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Enforcement
EU ePrivacy Directive
The Directive is implemented through national law; Member States set penalties and designate competent authorities for national ePrivacy rules, so country-specific enforcement and penalty claims require a national source.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
GDPR
GDPR has EU-level supervisory-authority powers and administrative-fine provisions, but those powers do not automatically become ePrivacy powers unless national ePrivacy law confers them.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Operational implication
Escalate to country counsel or a national regulator source before stating an ePrivacy penalty amount, competent authority, soft-opt-in variant, or cookie exemption beyond the EU-level rule.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Overlap and reuse
EU ePrivacy Directive
When ePrivacy requires consent, the current standard is read through GDPR consent conditions: freely given, specific, informed, unambiguous, based on a clear affirmative action, demonstrable, and easy to withdraw.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
GDPR
Consent is one GDPR lawful basis and carries Article 7 proof and withdrawal duties; if GDPR processing uses another lawful basis, that does not remove an ePrivacy consent requirement for the storage/access or marketing operation.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Operational implication
Keep proof of the user-facing choice, purpose granularity, affirmative action, default state, refusal path, withdrawal path, and evidence that refusal did not create detriment.
Consent standard for freely given, specific, informed, unambiguous consent, clear affirmative action, proof of consent, and easy withdrawal.
freely given, specific, informed and unambiguous
Practical decision rule
EU ePrivacy Directive
Where ePrivacy specifically regulates an operation, its special rule takes precedence for that operation and may limit the GDPR lawful-basis menu for that operation.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
GDPR
GDPR remains applicable to personal-data processing not specifically governed by ePrivacy, including prior or subsequent processing and GDPR rights or controller obligations not displaced by a special ePrivacy rule.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
Operational implication
Mark the exact operation covered by ePrivacy. Do not label the entire product journey ePrivacy-only just because one tracker, communication, or marketing message is covered.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
Practical decision rule
How should teams decide which rule controls a product change?
Write the technical operation first: storage/access, communication, marketing send, analysis, disclosure, retention, or deletion.
Apply ePrivacy first when the operation is Article 5(3) terminal-equipment access, communications confidentiality, traffic or location data, or Article 13 direct marketing.
Apply GDPR to every personal-data processing operation that is not specifically displaced by an ePrivacy special rule.
Create a national-law escalation item for penalties, competent authority, Article 13 options, or country-specific cookie and analytics exemptions.
Save separate evidence labels even when the same consent screen, tracker inventory, CRM record, or audit log supports both regimes.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
1
Section 1
Classify storage, access, and later processing
A cookie, SDK, pixel, app permission, connected-device identifier, or messaging feature should first be split into operations. The ePrivacy check covers the act of storing information on, or gaining access to information already stored in, terminal equipment and the confidentiality of communications. GDPR covers personal-data processing that happens before, during, or after those operations when information relates to an identified or identifiable person.
This split matters because Article 5(3) uses the word information, not personal data. The EDPB technical-scope guidance says Article 5(3) can apply even when the information accessed or stored is non-personal, while GDPR still needs a personal-data processing operation.
Classify each technical operation: store, access, transmit, analyse, profile, disclose, retain, or erase.
Run Article 5(3) for terminal-equipment storage/access before choosing a GDPR lawful basis for later personal-data processing.
Keep non-personal device access in the ePrivacy file even when no GDPR record is opened.
Open a GDPR record when the same journey creates personal-data processing, such as user profiles, analytics identifiers, customer relationship management (CRM) enrichment, or behavioural advertising.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
processing of personal data
2
Section 2
Use ePrivacy for communications confidentiality and marketing gates
Article 5 requires Member States to ensure confidentiality of communications and related traffic data through national legislation, with prohibitions on listening, tapping, storage, interception, or surveillance by persons other than users unless consent or a legal authorisation applies. GDPR can still apply to personal data in those communications, but it is not the first source for the confidentiality gate itself.
Article 13 is the direct-marketing gate for automated calling systems, fax, and electronic mail. It requires prior consent for covered direct marketing, contains the customer soft opt-in for electronic mail for a company's own similar products or services, and leaves some other direct-marketing choices to national legislation. Do not invent country outcomes from the EU text alone.
For communications features, document the confidentiality risk, any technical storage needed for transmission, and any lawful-business recording basis considered.
For email or SMS marketing, record whether prior consent or the Article 13 customer soft opt-in is being used.
For channels where Article 13 leaves options to national legislation, mark the country-law check as unresolved until the relevant national rule is reviewed.
For personal data inside the same journey, add GDPR transparency, lawful-basis, retention, rights, and processor evidence separately.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
particularise and complement
3
Section 3
Apply one consent quality standard, but keep the legal reason separate
The current refers to the old data-protection consent concept, and the EDPB consent guidelines state that GDPR conditions for valid consent apply in situations falling within the ePrivacy Directive. That does not make ePrivacy and GDPR the same rule; it means consent used for cookies, tracking, or marketing must meet the GDPR-level quality standard.
A compliant record should show the purpose shown to the user, the affirmative action, whether refusal was available without detriment, how withdrawal works, and how the controller can demonstrate consent. Scrolling, bundled consent, inaccessible rejection, and silent lawful-basis switching are poor evidence outputs for both regimes.
Store the banner or form version, language, purposes, vendors, default state, accept/reject controls, timestamp, and withdrawal path.
Show that consent is granular enough for distinct purposes such as analytics, advertising, marketing email, and location-based services.
Keep proof that withdrawal is available through the same practical interface and without lowering service levels.
When consent is withdrawn, separate the ePrivacy stop action from any GDPR erasure, retention, or lawful-basis reassessment.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
4
Section 4
Treat ePrivacy as lex specialis only for the operation it specifically regulates
EDPB Opinion 5/2019 describes ePrivacy as particularising and complementing GDPR. Where ePrivacy contains a special rule for a specific operation, such as Article 5(3) storage/access, traffic data, location data, or Article 13 direct marketing, that special rule takes precedence for that operation. GDPR continues to apply to personal-data processing that is not specifically governed by the ePrivacy rule.
The same opinion cautions that enforcement and competence are shaped by national transposition. Data-protection authorities enforce GDPR; they enforce national ePrivacy rules only where Member State law gives them that competence. Do not turn the EU Directive into a single EU-wide penalty table or a single regulator workflow.
Label each evidence item as ePrivacy-only, GDPR-only, or shared-with-limits.
For shared journeys, distinguish placement or reading of a tracker from subsequent storage, analysis, profiling, reporting, and disclosure of personal data.
Add a national-law check when the issue involves penalties, competent authority, Article 13 options, or country-specific cookie guidance.
Use one product inventory if useful, but keep separate source citations and legal conclusions for each obligation.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
subsequent processing activities
5
Section 5
Resolve the facts that change the answer
The comparison cannot decide a product from labels such as analytics, security, personalization, or marketing. Record what the technology does, which device information it stores or reads, whether the information relates to a person, who decides each purpose, and which Member State law implements the Directive.
Three boundaries cause repeated errors. Article 5(3) protects information in terminal equipment whether or not it is personal data. GDPR applies only when the information is personal data. The is not directly applied as a regulation: national transposition determines the operative rule, authority, and penalties.
Anonymous terminal-equipment information can still fall within Article 5(3), even though GDPR does not apply unless the information is personal data.
A strictly necessary Article 5(3) exception addresses the storage or access operation. It does not create a GDPR lawful basis for later personal-data processing.
A vendor's consent-management platform can collect evidence, but the relevant controller or sender still has to show which purposes, parties, technologies, and national rules the choice covered.
Article 13 sets an EU framework for unsolicited communications, but Member States retain choices for some channels and for communications to legal persons. Check the destination country's transposition before approving a campaign.
If a purpose changes after collection, repeat both analyses: determine whether new terminal-equipment access occurs and whether the new personal-data purpose has a GDPR basis and adequate notice.
Explains that Article 5(3) concerns information, whether or not it is personal data, and covers storage and access operations beyond conventional cookies.
Supports limiting lex specialis to the operation specifically regulated by ePrivacy and applying GDPR to other personal-data processing.
Recommended next step
Build one tracker, communications, and marketing evidence pack without merging legal tests
Sorena can help turn this comparison into cited records for Article 5(3), communications confidentiality, direct marketing, consent proof, GDPR follow-on processing, and national-law escalation points.
Primary ePrivacy Directive text for communications confidentiality, Article 5(3) terminal-equipment storage/access, traffic and location data, and Article 13 direct marketing.
Articles 5(3) and 13 support the information-based terminal-equipment test, direct-marketing framework, and national implementation caveats.
Technical scope guidance for information, terminal equipment, gaining access, storage, pixels, local processing, IoT reporting, and unique identifiers.
Explains that Article 5(3) concerns information, whether or not it is personal data, and covers storage and access operations beyond conventional cookies.
Explains how ePrivacy particularises and complements GDPR, when lex specialis applies, and how authority competence depends on GDPR scope and national ePrivacy transposition.
Supports limiting lex specialis to the operation specifically regulated by ePrivacy and applying GDPR to other personal-data processing.
Confirms the split between ePrivacy for cookie placement or reading and GDPR for subsequent personal-data processing and consent used as a GDPR lawful basis.
Primary GDPR text for personal-data processing, controller and processor obligations, rights, accountability, supervisory powers, and administrative fines.