Standalone answers for product, privacy, engineering, analytics, and marketing teams working through EU ePrivacy questions.
Covers terminal-equipment access, consent and exemptions, cookie-banner risks, direct marketing, GDPR overlap, national-law caveats, and evidence records.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this FAQ to answer concrete EU ePrivacy Directive questions before launching cookies, SDKs, pixels, analytics, communications-data processing, or electronic direct marketing. The Directive is implemented through Member State law, so these answers describe the EU baseline and flag where local law or regulator guidance must be checked. The rules apply to the electronic communications sector across the EU baseline, and in practice can affect EU-based and non-EU services that offer communications or tracking services to users in the EU.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats.
FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats.
When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks.
Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats.
FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with grounded examples, analytics caveats, evidence records, and national-law cautions.
FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats.
Article 13 sets a channel-specific baseline for unsolicited direct marketing. Automated calling systems without human intervention, fax, and electronic mail for direct marketing require prior consent unless the narrow existing-customer electronic-mail exception applies.
The existing-customer route applies only where a seller obtained electronic contact details from its customer in the context of selling a product or service, uses them for its own similar products or services, and gave the customer a clear, distinct, free, easy opportunity to object when the details were collected and in every later message. Article 13 also prohibits direct-marketing electronic mail that disguises or conceals sender identity or lacks a valid address for cease requests.
Only if Article 13(2)'s conditions are satisfied: the contact details were obtained in a sale, the same sender markets its own similar products or services, and the customer had a clear, distinct, free, easy chance to object both at collection and in each message.
No. Article 15a requires Member States to set effective, proportionate, and dissuasive penalties and enforcement powers for national provisions. Do not invent an EU-wide fine amount from the Directive.
The ePrivacy Directive particularises and complements the GDPR for electronic communications. Where the Directive has a special rule, such as Article 5(3) terminal-equipment storage/access, Article 6 traffic data, Article 9 location data, or Article 13 direct marketing, that special rule must be applied rather than replaced by a generic GDPR lawful basis.
GDPR still matters. It governs personal-data processing that is not specifically covered by the ePrivacy special rule, including later analysis, enrichment, sharing, retention, profiling, security logging, data-subject rights, controller and processor roles, international transfers, and accountability. If Article 5(3) consent is invalid, the later GDPR processing that depends on that collection may also be defective.
No. If Article 5(3) requires consent for storing or accessing information in terminal equipment, a GDPR lawful basis cannot replace that ePrivacy access rule. GDPR lawful-basis analysis applies to later personal-data processing that is not itself governed by a more specific ePrivacy rule.
Member States designate the competent authority or authorities for national ePrivacy rules. Data protection authorities enforce the GDPR, and may enforce national ePrivacy rules only where national law gives them that competence.
Evidence should prove both the legal classification and the implementation. A useful ePrivacy record links the source rule to a product fact: what was stored or accessed, why, by whom, on which terminal equipment, under which consent or exemption route, and what changed in production.
For national and enforcement caveats, the record should avoid unsupported country claims. Save the Member State checked, the competent authority guidance used, and the conclusion reached; if the grounding does not support a country rule or penalty amount, mark it unresolved rather than filling the gap.
Escalate any tracker classified as essential while also serving analytics, advertising, personalisation, or profiling; any banner without a clear reject path; any cookie wall; any marketing campaign relying on soft opt-in without sale-context proof; and any country-specific enforcement, B2B, call, or penalty claim not supported by current local authority material.
Use it as the EU baseline only. The Directive leaves national implementation and enforcement details to Member States, and the Cookie Banner Taskforce report also warns that its positions do not provide a standalone green light for every website or national-law context.
Sorena can help map cookies, SDKs, pixels, marketing sends, consent flows, national-law caveats, and evidence records against the cited ePrivacy sources.
Ask source-linked questions about Article 5(3), consent banners, exemptions, direct marketing, and GDPR interplay using the cited sources on this page.
Review your cookie inventory, consent evidence, direct-marketing controls, and country-law validation queue with Sorena.
"may be subject to national variation"
"privacy and electronic communications"
"for the purposes of direct marketing"
"store information or to gain access"
"additional national requirements"
"freely given, specific, informed and unambiguous"
"does not exclusively apply to cookies"
"special provisions prevail"
"complements General Data Protection Regulation"
"strictly necessary"