WebBuilding

Laws and standards

ePrivacy Directive

Summary

The ePrivacy Directive, formally Directive 2002/58/EC, is the European Union law on privacy in electronic communications. Adopted on July 12, 2002, it protects the confidentiality of communications, limits the use of traffic and location data, requires consent for most marketing email and, since a 2009 amendment that member states had to apply by May 25, 2011, requires consent before a website stores or reads cookies and similar data on a visitor's device unless they are strictly necessary. A 2017 plan to replace it with a regulation was withdrawn in 2025, and as of October 2026 changes proposed in the Digital Omnibus package are still being negotiated.

Web Building Encyclopedia · Laws and standards · Last reviewed October 22, 2026 · 11 min read

What the ePrivacy Directive is

The ePrivacy Directive is the European Union’s law on privacy in electronic communications. Its formal name is Directive 2002/58/EC of the European Parliament and of the Council “concerning the processing of personal data and the protection of privacy in the electronic communications sector,” and its own short title is the Directive on privacy and electronic communications.1

It was adopted on July 12, 2002, and published in the Official Journal on July 31, 2002. It entered into force on the day of publication.1

A directive is a type of EU law that sets goals but does not apply directly to businesses. Each member state has to pass its own national law to put it into effect, a step called transposition. The deadline for this directive was October 31, 2003.1 That is why its rules reach a website through laws with different names in each country, and why details can differ from one country to the next.

Article 1 sets out its purpose: to give an equivalent level of protection of fundamental rights, in particular privacy, when personal data is processed in electronic communications. Its provisions “particularise and complement” the EU’s general data protection law, which in 2002 was Directive 95/46/EC.1 The European Commission describes the ePrivacy Directive and the GDPR as the two main parts of the EU’s data protection framework.2

The directive borrows its idea of consent from the general law. Article 2 says consent under the directive “corresponds to” the data subject’s consent under Directive 95/46/EC.1 The GDPR has since replaced that law, and in its 2019 Planet49 ruling the Court of Justice read cookie consent under both the old definition and the GDPR’s.3

For websites, its best-known rule is Article 5(3), which covers storing information on a visitor’s device or reading it from there. That is the rule that applies to the HTTP cookie.4 The Council of the EU links it directly to cookie banners: in October 2026 it presented new exemptions from consent as a way to reduce how many banners people see.5

From telephone privacy to the internet

The 2002 directive replaced an earlier law, Directive 97/66/EC, which was repealed from October 31, 2003.1 The new text applied to personal data processed in connection with publicly available electronic communications services in public networks in the EU.1 Its definitions were written to cover the internet as well as telephone lines: “electronic mail” means any text, voice, sound or image message sent over a public network that can be stored until the recipient collects it.1

The recitals, the numbered statements of purpose at the start of an EU law, already discussed web technology. Recital 24 warned that spyware, web bugs and hidden identifiers can enter a user’s device without the user knowing. Recital 25 said cookies can be legitimate and useful, for example to analyze how well a website works or to verify identity in online transactions, and that users should be able to refuse them.1

The original Article 5(3) was an opt-out rule. A site could store or read information on a user’s device if the user received clear and comprehensive information about the purposes and was offered the right to refuse. Storage needed only to carry a communication, or strictly necessary to provide a service the user had asked for, was exempt.1 Recital 25 added that access to a site’s content could be made conditional on accepting a cookie used for a legitimate purpose.1

The main rules

The directive covers more than cookies. Its main articles, as amended, are:

ArticleTopicWhat it requires
4SecurityProviders of communications services must take appropriate technical and organizational security measures and warn subscribers of particular network risks.1 Since 2009 they must also report personal data breaches.4
5(1)ConfidentialityMember states must ban listening, tapping, storage or other interception of communications and their traffic data by anyone other than the users, without consent, unless the law allows it under Article 15(1).1
5(3)DevicesStoring or reading information on a user’s device needs consent, with narrow exceptions (see below).4
6 and 9Traffic and location dataTraffic data, the data used to carry or bill a communication, must be erased or made anonymous when no longer needed. Using it for marketing, or using location data for added-value services, needs consent that can be withdrawn at any time.1
12DirectoriesSubscribers must be told, free of charge, before they are listed in a public directory, and decide whether and which details appear.1
13Unsolicited communicationsMarketing by automated calling systems, fax or email needs prior consent, with a limited exception for existing customers.4
15(1)RestrictionsMember states may limit some of these rights where necessary, appropriate and proportionate for national security, defense, public security or fighting crime, including by requiring data to be kept for a limited period.1

Article 13 is the EU’s main rule on marketing email. A business may send email marketing to an individual only with prior consent. The exception, often called the soft opt-in, lets a business that obtained a customer’s email address in the course of a sale market its own similar products or services to that customer, as long as the customer was given a free and easy way to object when the address was collected and in every message.4 Emails that hide the sender’s identity or give no valid address for opting out are banned.4 The consent rules in Article 13(1) and (3) protect individuals, while member states must make sure the legitimate interests of other subscribers, such as companies, are sufficiently protected.4 US rules on marketing email are covered in the CAN-SPAM Act entry.

Directive 2009/136/EC, adopted on November 25, 2009, rewrote several of its articles, in the same act that amended two other EU laws. It was published in the Official Journal on December 18, 2009, entered into force the next day, and gave member states until May 25, 2011, to adopt the changes.4

The central change was to Article 5(3). Storing information on a user’s device, or gaining access to information already stored there, became “only allowed on condition that the subscriber or user concerned has given his or her consent,” after clear and comprehensive information that includes the purposes.4 Two exceptions remain: technical storage or access whose sole purpose is carrying a communication over a network, and storage or access strictly necessary for a service the user explicitly requested.4

Recital 66 of the amending directive said that, where technically possible and effective, consent may be expressed through the settings of a web browser or another application.4 Later court rulings and guidance set out what valid consent looks like.

The amendment also added:

  • Breach notification. A new definition of a personal data breach, and a duty on communications providers to notify the national authority without undue delay, and to tell affected people when a breach is likely to harm their data or privacy.4 A Commission regulation of June 24, 2013, in force from August 25, 2013, set the details: providers must notify the authority within 24 hours of detecting a breach where feasible, and if they need more time to investigate, send a first notice within 24 hours and the rest no later than three days after it.6
  • Penalties. A new Article 15a requires member states to set penalties, including criminal penalties where appropriate, that are effective, proportionate and dissuasive, and to give national authorities the power to order infringements to stop.4 The directive itself sets no fine amounts.
  • A broader scope. The rewritten Article 3 extends coverage to public networks that support data collection and identification devices.4

Which cookies count as strictly necessary? The Article 29 Data Protection Working Party, a body of EU data protection authorities, answered in Opinion 04/2012, adopted on June 7, 2012. It set two tests: a cookie used only to carry a communication, which must be impossible without it, or a cookie strictly necessary for a service the user explicitly asked for, which would not work with cookies turned off.7

Its examples of cookies that can be exempt include shopping cart and multi-page form cookies, login cookies for the length of a session, security cookies that detect login abuse, load-balancing cookies and short-lived interface preferences such as language. Third-party advertising cookies and social plug-in tracking cookies are not exempt. Neither are first-party analytics cookies, though the opinion said they pose limited risk when kept to aggregated statistics, with clear information and an easy way to opt out.7

The Court of Justice of the European Union (CJEU) ruled on the meaning of consent in the Planet49 case on October 1, 2019. The case began with an online lottery that a German company ran in September 2013, where entrants met a pre-ticked box agreeing to cookies for a web analytics service used for interest-based advertising.3 The Grand Chamber ruled that:3

  • consent is not valid when it is given through a pre-ticked checkbox that the user must untick to refuse
  • Article 5(3) applies in the same way whether or not the information stored or read is personal data
  • the information given to users must include how long cookies will operate and whether third parties can access them

The Court based its answer mainly on the 1995 directive and added that the GDPR’s definition of consent, which requires a “clear affirmative action,” leads to the same result even more clearly.3

The European Data Protection Board (EDPB), which brings together the EU’s national data protection authorities, adopted Guidelines 2/2023 on the technical scope of Article 5(3). Version 1.0 was adopted for public consultation on November 14, 2023, and version 2.0 on October 7, 2024.8 The guidelines say the rule is not limited to cookies. They cover:8

  • tracking pixels and tracking through links, where a URL or a small embedded image causes the device to send information
  • local processing, where code runs on the device and sends back results
  • tracking based only on the IP address, in some situations
  • intermittent and mediated reporting by internet-of-things devices
  • unique identifiers

The EDPB stresses that the provision protects any “information” on a device, not only personal data, and that a device counts if it is connected or connectable to a public network. It also says that Article 5(3) applying does not automatically mean consent is needed, since the exemptions must be assessed case by case.8

Enforcement happens country by country, through the authorities and penalties each member state sets in its own law.4 France’s data protection authority, the CNIL, publishes a list of its sanctions, and as of October 2026 it includes many cookie consent cases against ordinary businesses, not only large platforms. In December 2025 it fined a travel agency 2,000 euros and a performing arts company 5,000 euros, each with an order to comply, and in November 2025 it fined a company that issues deferred debit payment cards 1,500,000 euros for failing to obtain cookie consent.9

Attempts to replace it

On January 10, 2017, the European Commission proposed an ePrivacy Regulation to repeal and replace the directive, COM(2017) 10.10 (The EUR-Lex record of the procedure lists the Commission’s adoption under January 11, 2017.11) The Commission chose a regulation, which applies directly in every member state, to keep the rules consistent with the GDPR and avoid different national readings.10 The proposal would have brought internet-based services such as Voice over IP, instant messaging and web-based email within scope, required communications software such as browsers to offer an option that prevents third parties from storing information on a device, exempted web audience measurement carried out by the site the user visited from consent, and allowed fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.10

The proposal never became law. The last event on the EUR-Lex procedure record is a discussion in the Council’s preparatory bodies dated February 10, 2021.11 The Commission gave its reasons for withdrawing the proposal in its 2025 work program, COM(2025) 45 of February 11, 2025, approved the withdrawal on July 16, 2025, and published the notice in the Official Journal on October 6, 2025.12

A new attempt followed. On November 19, 2025, the Commission published its Digital Omnibus proposal, described as “a set of technical amendments to a large corpus of digital legislation.”13 Formally COM(2025) 837, it would amend the GDPR, the ePrivacy Directive and several other laws.14 For cookies, it proposes to:14

  • change Article 5(3) so that storing or reading personal data on a person’s device is governed by the GDPR, through a new Article 88a, while the ePrivacy rule would remain in place for other cases, for example where the subscriber or user is not a natural person
  • list purposes, such as a service the person asked for and some low-risk uses, that would not need consent
  • add a GDPR Article 88b under which websites and apps would have to respect automated, machine-readable signals of a user’s choices, sent for example by a browser, six months after standards for those signals exist, with an exception for media service providers
  • repeal Article 4 of the directive

On October 21, 2026, the Council of the EU, which represents member state governments, agreed its negotiating position. It takes a different route from the Commission on one point: it “maintains the rules on cookies and other kinds of online tracking technologies” under the ePrivacy Directive, while adding clearer purposes that would not need consent, such as providing a service, audience measurement and keeping the user’s device secure, with the stated aim of fewer cookie banners.5 Talks with the European Parliament start once Parliament adopts its own position.5 As of October 22, 2026, none of these changes is law, so the 2009 version of Article 5(3) still applies.5

Timeline

  1. The Council of the EU agrees a position that keeps the cookie rules in the ePrivacy Directive and adds consent exemptions5
  2. The Commission publishes the Digital Omnibus proposal, which would amend Article 5(3)14
  3. The withdrawal of the ePrivacy Regulation proposal is published in the Official Journal12
  4. The Commission approves the withdrawal of the ePrivacy Regulation proposal12
  5. The EDPB adopts version 2.0 of its guidelines on the technical scope of Article 5(3)8
  6. The EU Court of Justice rules in Planet49 that pre-ticked boxes are not valid cookie consent3
  7. The Commission proposes an ePrivacy Regulation to replace the directive10
  8. The Article 29 Working Party sets out which cookies are exempt from consent7
  9. Deadline for member states to apply the 2009 amendment, including cookie consent4
  10. Directive 2009/136/EC rewrites Article 5(3) to require consent4
  11. Deadline for national laws; Directive 97/66/EC is repealed1
  12. The directive is published in the Official Journal and enters into force1
  13. The European Parliament and the Council adopt Directive 2002/58/EC1

What it means for your website

This section is general information, not legal advice. Each EU country applies the directive through its own law and regulator, so check your national authority’s guidance or ask a lawyer about your own site.

  • Do not assume anonymous data is exempt. The Planet49 ruling means the cookie rule applies whether or not the stored or read information is personal data.3
  • List everything that stores or reads data on visitors’ devices. That means cookies, but also tracking pixels, link tracking and identifiers set by analytics, ad tags and embeds.8 On self-hosted WordPress, which we build on every week, most of these come from plugins and tags, not from WordPress itself.
  • Sort them into strictly necessary and the rest. Storage needed to carry a communication, or strictly necessary for something the visitor asked for, is exempt.4 EU regulators give shopping carts, logins for the length of a session and language preferences as examples of exempt cookies.7 Analytics and advertising tags usually need consent first.
  • Collect consent properly. No pre-ticked boxes, and tell visitors how long each cookie lasts and whether third parties can read it.3 Load non-essential tags only after the visitor agrees. These tags are small pieces of JavaScript, so a consent tool has to block them until then.
  • Check your ad and analytics accounts. Google’s EU user consent policy requires sites that use its products to get valid consent for cookies or other local storage where the law requires it, and for personalized ads, from users in the EEA, the UK and Switzerland, and to keep records of that consent.15 Our page on websites and Google Ads covers the tags involved.
  • Get consent for marketing email. Under Article 13, newsletters and promotions to individuals need prior consent, except similar offers to existing customers who were given an easy way to object, and every message needs a working opt-out.4 Our guide to websites and email covers sender setup, and the GDPR sets the standard for valid consent.
  • Watch the Digital Omnibus. The Council’s October 21, 2026, position would add consent exemptions such as audience measurement, but it is not law yet.5

If you also have US visitors, see our guide to website laws in the US and the entry on the CCPA and CPRA.

See also

References

  1. Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). EUR-Lex, Publications Office of the European Union. 2002-07-12. accessed October 22, 2026.
  2. Digital privacy. Shaping Europe's digital future, European Commission. accessed October 22, 2026.
  3. Judgment in Case C-673/17, Bundesverband der Verbraucherzentralen v Planet49 GmbH. Court of Justice of the European Union, via EUR-Lex. 2019-10-01. accessed October 22, 2026.
  4. Directive 2009/136/EC amending Directives 2002/22/EC and 2002/58/EC and Regulation (EC) No 2006/2004. EUR-Lex, Publications Office of the European Union. 2009-11-25. accessed October 22, 2026.
  5. Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules. Council of the European Union. 2026-10-21. accessed October 22, 2026.
  6. Commission Regulation (EU) No 611/2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC. EUR-Lex, Publications Office of the European Union. 2013-06-24. accessed October 22, 2026.
  7. Opinion 04/2012 on Cookie Consent Exemption (WP 194). Article 29 Data Protection Working Party, European Commission. 2012-06-07. accessed October 22, 2026.
  8. Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0. European Data Protection Board. 2024-10-07. accessed October 22, 2026.
  9. Sanctions issued by the CNIL. Commission nationale de l'informatique et des libertés (CNIL). accessed October 22, 2026.
  10. Proposal for a Regulation concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC, COM(2017) 10 final. European Commission, via EUR-Lex. 2017-01-10. accessed October 22, 2026.
  11. Procedure 2017/0003/COD. EUR-Lex, Publications Office of the European Union. accessed October 22, 2026.
  12. Withdrawal of Commission proposals (C/2025/5423). Official Journal of the European Union, C series, via EUR-Lex. 2025-10-06. accessed October 22, 2026.
  13. Digital Omnibus Regulation Proposal. Shaping Europe's digital future, European Commission. 2025-11-19. accessed October 22, 2026.
  14. Proposal for a Regulation amending Regulations (EU) 2016/679 … and Directives 2002/58/EC … (Digital Omnibus), COM(2025) 837 final. European Commission, via EUR-Lex. 2025-11-19. accessed October 22, 2026.
  15. EU user consent policy. Google. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].