EU GDPR vs ePrivacy Directive

A GDPR assessment asks whether there is processing of personal data and who acts as controller, processor, or joint controller. If personal data is involved, Article 5 accountability and Article 6 lawfulness must still be satisfied even when an ePrivacy rule also applies.

An ePrivacy assessment asks whether the activity falls within electronic communications rules, such as public communications services, communications confidentiality, terminal-equipment storage or access, traffic data, location data, or direct marketing by electronic mail. Article 5(3) uses the broader word information, not personal data. EDPB Guidelines 2/2023 are regulator guidance rather than legislation; they apply the Article 5(3) technical test to cookies, URL and pixel tracking, local processing, some IP-only tracking, connected-device reporting, and unique identifiers. National transposition still controls Member State-specific procedures and penalties.

The ePrivacy Directive does not create one uniform national enforcement code. Before launch, identify every Member State in which the activity reaches subscribers or users and record the transposing law, competent authority, consent or objection rule, and penalty route. Reassess that record when a vendor, tag, SDK, storage method, returned information, purpose, recipient, marketing channel, or target Member State changes.

Under the GDPR, processing is lawful only when one Article 6 basis applies. Consent is one possible basis, but the GDPR also recognizes contract necessity, legal obligation, vital interests, public task, and legitimate interests, subject to the text's conditions.

Under the ePrivacy Directive, some communications-specific activities are framed around consent or specific opt-out rules. Article 5(3) requires consent for storing information or gaining access to information stored in a subscriber's or user's terminal equipment unless the activity is solely for transmitting a communication or strictly necessary to provide an information society service that the subscriber or user expressly requested. The exception is tied to the purpose of the storage or access, not to a label such as essential, functional, or first-party.

Article 13 separately addresses unsolicited communications for direct marketing. Its own-similar-products electronic-mail exception requires contact details obtained from a customer in the context of a sale, marketing of the sender's own similar products or services, and a clear, free, easy opportunity to object when the details are collected and in every message if the customer has not already objected. Member State law still controls the implementation and any rules for other forms of direct marketing.

Parallel compliance does not mean duplicate work. A single data map, cookie inventory, consent log, marketing register, or incident file can serve both workstreams if each evidence item says which GDPR article and which ePrivacy article it supports.

The evidence should be specific enough for product, privacy, marketing, security, and vendor owners to act on it. A statement that a tool complies with privacy law is not enough. Record the processing purpose, communications context, terminal equipment involved, storage or access operation, information written or read, consent or objection mechanism, security control, breach route, responsible owner, approval, and reassessment trigger.

Keep the decision made before deployment and evidence the state actually released. A consent-management screenshot alone cannot show which technologies were blocked, which strictly necessary exception was approved, what downstream processing occurred, or whether withdrawal stopped later access and processing.