Artifact GuideEU

EU ePrivacy Directive Metadata and Location Data

A focused guide to the ePrivacy Directive rules for communications metadata: traffic data, location data other than traffic data, anonymisation, consent, value-added services, and national-law limits.

Built for privacy, telecom, product, analytics, engineering, legal, and compliance teams that need to separate service-necessary processing from consent-based or national-law processing.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 31, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 31, 2026

Overview

Classify the data before choosing a rule. is data processed to convey a communication on an electronic communications network or to bill for it; it can include routing, duration, time, volume, protocol, network, and terminal-location data when those fields serve transmission or billing. Article 5 protects communications and related traffic data. Article 6 applies to traffic data processed and stored by providers of public communications networks or publicly available electronic communications services. Article 9 applies to location data other than traffic data relating to users or subscribers of those networks or services. A website or app that is not such a provider may still trigger Article 5(3) through device storage or access and GDPR through later personal-data processing. Article 15 permits only legislated, necessary, appropriate, and proportionate national restrictions for listed public-interest aims. This page does not supply country-specific retention or interception authority.

Section 1

Classify the metadata before choosing a rule

Start by separating , location data that is also traffic data, and location data other than traffic data. The Directive defines traffic data as data processed for conveying a communication or billing it, and defines location data as data indicating the geographic position of terminal equipment.

That distinction matters because location information needed to transmit a communication can be under Article 6, while more precise or additional location data used for a value-added service is handled under Article 9.

Record whether the data is routing, duration, time, volume, protocol, network, connection, billing, or terminal-location data used to carry the communication.
Classify location data under Article 6 when it is processed for transmission or billing. A geographic signal alone does not make it .
Treat precise location features, navigation, location-based alerts, and location-based advertising as likely Article 9 or Article 5(3) issues unless the facts show they are strictly transmission-only.
Keep a data-flow note showing the service, provider, subscriber or user group, data fields, purpose, duration, recipient, and withdrawal or refusal control.

Sources for this answer

Directive 2002/58/EC (ePrivacy Directive)

Defines traffic data, location data, value-added services, confidentiality, and the Article 6 and Article 9 processing rules for communications metadata.

Directive 2009/136/EC amendments to the ePrivacy Directive

Shows the amended Article 5(3) terminal-equipment rule and prior-consent wording for traffic-data marketing or value-added services.

Section 2

Apply Article 6 to traffic data

For stored by a public communications network or publicly available electronic communications service provider, the default control is erasure or anonymisation when the data is no longer needed to transmit the communication.

The Directive allows narrower processing for subscriber billing and interconnection payments until the bill can no longer lawfully be challenged or payment pursued. It also allows processing for marketing electronic communications services or value-added services only to the extent and duration necessary, and only with the subscriber's or user's prior consent. Article 6(5) restricts who may carry out processing permitted by Article 6; it does not create another purpose for keeping .

Document the transmission need and the point at which that need ends for each traffic-data field.
For billing or interconnection data, record the billing purpose and the lawful challenge or payment-pursuit window without inventing a universal EU retention period.
Give the subscriber or user information about the types of and processing duration for billing or interconnection, and give that information before consent for marketing or value-added services.
For marketing electronic communications services or value-added services, keep proof of prior consent, the data fields covered, the duration, and the withdrawal route.
Restrict access to authorised people handling billing, traffic management, customer enquiries, fraud detection, marketing electronic communications services, or the value-added service.

Sources for this answer

Directive 2002/58/EC (ePrivacy Directive)

Article 6 sets the erasure/anonymisation default, billing exception, consent-based marketing/value-added-service rule, notice duty, and access restrictions for traffic data.

EDPB Guidelines 05/2020 on consent

Explains that GDPR consent conditions apply where ePrivacy rules rely on consent, including free, specific, informed, unambiguous consent and easy withdrawal.

Section 3

Apply Article 9 to location data other than traffic data

Article 9 is the rule for location data other than . It allows processing only when the data is anonymised or when users or subscribers consent, and only to the extent and for the duration necessary for a value-added service.

Consent is not enough by itself. Before obtaining it, the service provider must tell users or subscribers what type of location data will be processed, the purposes and duration, and whether the data will be transmitted to a third party for the value-added service.

Keep the anonymisation assessment separate from pseudonymisation or aggregation claims, and do not treat identifiable precise location as anonymous.
When relying on consent, store the notice text, purpose, duration, recipient or third-party transmission disclosure, consent event, and withdrawal evidence.
Provide a simple, free way to temporarily refuse location-data processing for each network connection or communication after consent has been obtained.
Limit access to persons acting under the authority of the network/service provider or the third-party value-added-service provider, and only as necessary for that service.

Sources for this answer

Directive 2002/58/EC (ePrivacy Directive)

Article 9 provides the anonymisation-or-consent rule, notice content, temporary refusal right, and access restriction for location data other than traffic data.

EDPB Guidelines 05/2020 on consent

Supports consent-quality evidence, including prior consent, demonstrability, purpose specificity, and withdrawal as easily as consent was given.

Section 4

Check confidentiality and Article 5(3) overlap

Metadata and location features often implicate more than one ePrivacy rule. Article 5 protects confidentiality of communications and related ; Article 5(3) adds a separate rule when a service stores information on, or gains access to information already stored in, terminal equipment.

For apps, web SDKs, connected devices, tracking links, pixels, local storage, mobile sensors, or IP-derived identifiers, test whether the location or metadata feature involves terminal-equipment storage or access before treating it only as traffic or location data.

Flag client-side code, SDKs, pixels, local storage, device identifiers, sensor reads, and IoT reporting where terminal equipment is instructed to send information back over a network.
Record whether Article 5(3) applies to storage/access, Article 6 or 9 applies to subsequent communications metadata, and GDPR applies to later personal-data processing not covered by a special ePrivacy rule.
Do not use a generic cookie-banner decision as evidence for traffic or location-data processing unless it names the metadata field, purpose, duration, recipient, and withdrawal control.
Where information stays entirely inside the device, record why no network access or storage instruction brings Article 5(3) into play.

Sources for this answer

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

Explains the technical scope of terminal-equipment storage and access, including pixels, URLs, local processing, identifiers, and IoT reporting.

European Commission ePrivacy factsheet

Commission material provides background on the EU's initiatives concerning online privacy.

Section 5

Handle national-law restrictions without inventing local rules

Article 15 lets Member States restrict certain ePrivacy rights and obligations, including Articles 5, 6, and 9, only through legislative measures that are necessary, appropriate, and proportionate for listed public-interest purposes. That is not a blank cheque for product analytics, marketing, or routine internal retention.

CJEU case-law in the cited source material confirms that general and indiscriminate retention or transmission of traffic and location data is tightly limited. The practical evidence record should therefore identify the specific national law or authority instruction relied on, but this page does not state country-by-country retention rules, interception powers, or penalties.

Escalate any retention, disclosure, interception, law-enforcement, national-security, emergency-service, or nuisance-call use case to local counsel before implementation.
Keep national-law evidence separate from ordinary Article 6 billing, fraud, traffic-management, marketing, or value-added-service evidence.
Do not generalise a lawful national-security or serious-crime retention measure into a broad business retention schedule.
Record the legal source, issuing authority or competent body, data categories, affected service, duration limit, safeguards, and review/expiry trigger when a national-law restriction is relied on.

Sources for this answer

Directive 2002/58/EC (ePrivacy Directive)

Article 15 provides the limited Member State restriction mechanism for specified ePrivacy rights and obligations.

CJEU Press Release No 123/20 on traffic and location data retention

Summarises CJEU limits on general and indiscriminate retention or transmission of traffic and location data and the narrow conditions for serious public-interest measures.

Section 6

Classify public-authority retention and access requests

A public-authority request needs a separate decision from the provider's ordinary billing, fraud, security, or service-retention schedule. The CJEU material in the grounding pack rejects preventive general and indiscriminate retention or transmission of traffic and location data as the default, while identifying narrower routes that depend on the purpose, data class, affected population, duration, safeguards, and independent review.

Do not turn the case-law categories into an internal permission. Each route still needs a valid national legislative measure or competent-authority decision. Record the request as received, preserve its scope, and prevent the operational team from expanding the population, data fields, or period beyond the sourced instruction.

Can a provider retain all traffic and location data because a public authority may need it later?

No general EU permission follows from that possibility. The cited CJEU material rejects preventive general and indiscriminate retention as the default and describes narrower routes with specific purposes, limits, safeguards, and review. The provider needs the applicable national measure or instruction before relying on one of those routes.

Are IP-address and subscriber-identity records treated the same as full traffic and location histories?

No. The cited CJEU material distinguishes source IP addresses and civil-identity data from traffic and location histories and applies different conditions. Keep those data classes separate in the request, retention schedule, access control, and disclosure record.

What should an record prove?

It should identify the applicable national measure and preservation instruction, established or reasonably suspected serious criminal offence or attack on national security, data already held when the instruction arrived, affected account or scope, preservation period, safeguards, review, disclosure, and the final deletion or release step.

Serious national-security threat: record why the threat is described as genuine and present or foreseeable, the time-limited retention period, and the court or independent administrative review.
Targeted retention: record the objective and non-discriminatory person-category or geographic criterion, the serious-crime or public-security purpose, and the strict duration limit.
Source IP addresses or civil-identity data: separate these data classes from traffic and location histories and record the specific national rule, purpose, duration, and access controls.
: preserve only the data already available and covered by the instruction, with the authority, suspected offence or threat, start and end time, review, disclosure, and deletion or release step.
Automated analysis: record the serious national-security threat described as genuine and present or foreseeable, the authorising measure, safeguards, and court or independent administrative review.
Real-time collection: limit the measure to persons validly suspected of involvement in terrorist activities and record the prior court or independent administrative review, or the prompt review used in an urgent case.
Request record: keep the issuing authority, legal instrument, service and account scope, data fields, persons or geography, period, disclosure channel, secrecy restriction, reviewer, challenge or escalation decision, and closure evidence.

Sources for this answer

CJEU Press Release No 123/20 on traffic and location data retention

Distinguishes prohibited general and indiscriminate retention from time-limited national-security measures, targeted retention, source-IP and civil-identity retention, expedited retention, and tightly reviewed real-time collection.

Directive 2002/58/EC (ePrivacy Directive)

Article 15 supplies the national legislative restriction mechanism that must be applied consistently with EU law and the Charter.

Section 7

Evidence checklist for metadata and location-data reviews

A useful review record should prove the classification, legal rule, data minimisation, notice, consent or anonymisation route, access restriction, and national-law boundary for each traffic or location-data use case.

This checklist is relevant when launching telecom services, messaging or call features, connected-device features, location-based services, communications analytics, billing logs, fraud-detection workflows, or marketing based on communications metadata.

Can be kept after a communication ends?

Only on a supported route. Article 6 permits anonymisation, billing or interconnection processing for the lawful challenge or payment period, and prior-consent processing for marketing electronic communications services or providing value-added services to the necessary extent and duration. Article 6(5) limits who may perform permitted processing; it is not a separate retention basis. A specific national legislative restriction under Article 15 may also apply.

Can a location-based service rely only on a privacy policy?

No. For location data other than , Article 9 requires anonymisation or consent, and consent must be preceded by information about the type of location data, purpose, duration, and any third-party transmission for the value-added service.

When does Article 5(3) matter for metadata or location features?

It matters when the feature stores information on, or gains access to information already stored in, the user's or subscriber's terminal equipment, such as through pixels, tracked URLs, local storage, identifiers, app SDKs, sensors, or IoT reporting over a public communications network.

Classification: , location data that is traffic data, location data other than traffic data, terminal-equipment storage/access, and later GDPR personal-data processing are separated.
Necessity: each field has a transmission, billing, interconnection, traffic-management, customer-enquiry, fraud-detection, marketing, or value-added-service purpose.
Retention: erasure, anonymisation, billing challenge/payment window, or national-law duration is documented without a made-up universal retention period.
Consent: consent evidence identifies the user or subscriber group, purpose, data type, duration, third-party transfer, date/time, interface, and withdrawal or temporary-refusal mechanism.
Access: only authorised personnel or value-added-service providers can access the data, and access logs map to the permitted purpose.
Change triggers: new data fields, countries, suppliers, SDKs, device sensors, product purposes, emergency-service uses, public-authority requests, or retention instructions reopen review.

Sources for this answer

Directive 2002/58/EC (ePrivacy Directive)

Primary source for the Article 5, Article 6, Article 9, and Article 15 evidence elements used in this checklist.

EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive

Supports the terminal-equipment storage/access checks for SDKs, pixels, local processing, identifiers, and connected-device reporting.

EDPB Guidelines 05/2020 on consent

Supports evidence for valid consent, demonstrability, prior consent, and easy withdrawal where Articles 6 or 9 rely on consent.

Recommended next step

Classify traffic and location-data processing before launch

Sorena can help convert the rules on this page into traffic-data maps, location-data consent checks, Article 5(3) technical-scope reviews, and evidence requests for your services.

Research workflow

Open Research Copilot for EU ePrivacy Directive

Ask questions tied to cited sources about traffic data, location data, consent, anonymisation, value-added services, and national-law limits using the cited sources on this page.

Explore next step

Talk to Sorena

Talk through implementation

Review your metadata or location-data workflow, source gaps, and evidence plan with Sorena.

Explore next step

Primary sources

References and citations

CJEU Press Release No 123/20 on traffic and location data retention

curia.europa.eu

Referenced sections

Distinguishes prohibited general and indiscriminate retention from time-limited national-security measures, targeted retention, source-IP and civil-identity retention, expedited retention, and tightly reviewed real-time collection.