EU ePrivacy Directive penalties and fines

At EU level, the reliable statement is about the structure of enforcement, not a single maximum fine. Article 15a requires Member States to lay down penalty rules for national ePrivacy infringements and to take measures needed for implementation. It also requires competent national authorities, and where relevant other national bodies, to have powers to order cessation of infringements and obtain information needed to monitor and enforce national provisions.

Do not convert that EU-level rule into a universal fine amount. For a real matter, record the alleged breach, affected Member State or States, national implementing law, competent authority route, available remedies, and any parallel GDPR issue.

The most common ePrivacy penalty assessment starts with Article 5(3): storing information on, or gaining access to information already stored in, a user's terminal equipment. EDPB guidance confirms that this is not limited to conventional browser cookies. Tracking pixels, tracked URLs, local storage, SDKs, identifiers, IoT reporting, and client-side code can all need analysis when they store or access terminal-equipment information.

Direct marketing is a separate trigger. Article 13 requires prior consent for automated calling systems, fax, and electronic mail marketing, with a limited customer-contact exception for a seller's own similar products or services where the customer receives an easy, free objection right at collection and in each message. National law determines some choices for other unsolicited communications, so a cross-border campaign needs a country-level check.

Good evidence does not prove there can be no penalty, but it can make the risk analysis reviewable. Keep a point-in-time record showing what technology ran, why it ran, whether consent was required, which exemption was claimed if any, what the user saw, and whether the implementation matched the record.

For consent-required technologies, the strongest evidence is technical and user-facing: no pre-consent firing, an equal and understandable refusal path, no pre-ticked opt-in boxes, accessible withdrawal after consent, clear purpose descriptions, cookie duration, third-party access information, and logs that show the consent state used by each tag or SDK.

Teams overstate risk when they quote a GDPR maximum as if it were the ePrivacy Directive's own EU-wide fine ceiling. Teams understate risk when they treat cookies, SDKs, local storage, or tracked URLs as harmless because the data is not obviously personal data. Article 5(3) protects terminal-equipment information and can apply regardless of whether the accessed information is personal data.

The GDPR/ePrivacy boundary is also easy to misread. EDPB interplay material explains that Member States have flexibility over the body that enforces national ePrivacy rules, while data protection authorities remain competent for GDPR processing that is not governed by an ePrivacy special rule. The practical result is a two-track analysis: national ePrivacy enforcement for the storage/access or marketing rule, and GDPR analysis for personal-data processing before or after that special rule.

Use this checklist before approving a launch, incident response, customer answer, or regulator response. It keeps the assessment inside what the EU sources support and leaves national penalty amounts to national legal review.

The output should be a short evidence pack, not a country table assembled from memory. If the file cannot identify the national source for a claimed amount or procedure, leave that fact out.