EU ePrivacy Directive Metadata and Location Data

Start by separating traffic data, location data that is also traffic data, and location data other than traffic data. The Directive defines traffic data as data processed for conveying a communication or billing it, and defines location data as data indicating the geographic position of terminal equipment.

That distinction matters because location information needed to transmit a communication can be traffic data under Article 6, while more precise or additional location data used for a value-added service is handled under Article 9.

For traffic data stored by a public communications network or publicly available electronic communications service provider, the default control is erasure or anonymisation when the data is no longer needed to transmit the communication.

The Directive allows narrower processing for subscriber billing and interconnection payments until the bill can no longer lawfully be challenged or payment pursued. It also allows processing for marketing electronic communications services or value-added services only to the extent and duration necessary, and only where the subscriber or user has consented.

Article 9 is the rule for location data other than traffic data. It allows processing only when the data is anonymised or when users or subscribers consent, and only to the extent and for the duration necessary for a value-added service.

Consent is not enough by itself. Before obtaining it, the service provider must tell users or subscribers what type of location data will be processed, the purposes and duration, and whether the data will be transmitted to a third party for the value-added service.

Metadata and location features often implicate more than one ePrivacy rule. Article 5 protects confidentiality of communications and related traffic data; Article 5(3) adds a separate rule when a service stores information on, or gains access to information already stored in, terminal equipment.

For apps, web SDKs, connected devices, tracking links, pixels, local storage, mobile sensors, or IP-derived identifiers, test whether the location or metadata feature involves terminal-equipment storage or access before treating it only as traffic or location data.

Article 15 lets Member States restrict certain ePrivacy rights and obligations, including Articles 5, 6, and 9, only through legislative measures that are necessary, appropriate, and proportionate for listed public-interest purposes. That is not a blank cheque for product analytics, marketing, or routine internal retention.

CJEU case-law in the grounding material confirms that general and indiscriminate retention or transmission of traffic and location data is tightly limited. The practical evidence record should therefore identify the specific national law or authority instruction relied on, but this page does not state country-by-country retention rules, interception powers, or penalties.

A useful review record should prove the classification, legal rule, data minimisation, notice, consent or anonymisation route, access restriction, and national-law boundary for each traffic or location-data use case.

Use this checklist when launching telecom services, messaging or call features, connected-device features, location-based services, communications analytics, billing logs, fraud-detection workflows, or marketing based on communications metadata.