EU ePrivacy Directive penalties and fines

Article 15a defines the EU-level enforcement structure but does not set a single maximum fine. It requires Member States to lay down penalty rules for national ePrivacy infringements and take the measures needed to implement them. It also requires competent national authorities, and where relevant other national bodies, to have powers to order cessation of infringements and obtain information needed to monitor and enforce national provisions.

Article 15a also says penalties may cover the period of a breach even if the breach was later corrected. Remediation matters, but it does not erase the need to check the national penalty rule. For a real matter, record the alleged breach, affected Member State or States, national implementing law, competent authority route, available remedies, and any parallel GDPR issue.

The most common ePrivacy penalty assessment starts with Article 5(3): storing information on, or gaining access to information already stored in, a user's terminal equipment. EDPB guidance confirms that this is not limited to conventional browser cookies. Tracking pixels, tracked URLs, local storage, SDKs, identifiers, IoT reporting, and client-side code can all need analysis when they store or access terminal-equipment information.

Direct marketing is a separate trigger. Article 13 requires prior consent for automated calling systems, fax, and electronic mail marketing. Its limited existing-customer exception applies where the same natural or legal person obtained electronic contact details in the context of a sale and uses them for its own similar products or services, provided the customer received a clear, distinct, easy, and free objection opportunity when the details were collected and in every message. National law determines some choices for other unsolicited communications, so a cross-border campaign needs a country-level check.

Good evidence does not prove there can be no penalty, but it can make the risk analysis reviewable. Keep a point-in-time record showing what technology ran, why it ran, whether consent was required, which exemption was claimed if any, what the user saw, and whether the implementation matched the record.

For consent-required technologies, the strongest evidence is technical and user-facing: no pre-consent firing, an equal and understandable refusal path, no pre-ticked opt-in boxes, accessible withdrawal after consent, clear purpose descriptions, cookie duration, third-party access information, and logs that show the consent state used by each tag or SDK.

Teams overstate risk when they quote a GDPR maximum as if it were the ePrivacy Directive's own EU-wide fine ceiling. Teams understate risk when they treat cookies, SDKs, local storage, or tracked URLs as harmless because the data is not obviously personal data. Article 5(3) protects terminal-equipment information and can apply regardless of whether the accessed information is personal data.

The GDPR/ePrivacy boundary is also easy to misread. EDPB interplay material explains that Member States have flexibility over the body that enforces national ePrivacy rules, while data protection authorities remain competent for GDPR processing that is not governed by an ePrivacy special rule. Use two tracks: national ePrivacy enforcement for the storage/access or marketing rule, and GDPR analysis for personal-data processing before or after that special rule.

Review this checklist before approving a launch, incident response, customer answer, or regulator response. It keeps the assessment inside what the EU sources support and leaves national penalty amounts to national legal review.

The output should be a short evidence pack, not a country table assembled from memory. For every amount or procedure, capture the national provision, version or effective date, covered actor and conduct, calculation method, competent decision-maker, and review or appeal route. If the file cannot identify that source, leave the claim out.