ePrivacy
ePrivacy refers to the EU's Directive 2002/58/EC on privacy and electronic communications, the law that requires consent before cookies and similar technologies are stored on or read from a user's device.The ePrivacy Directive protects the confidentiality of electronic communications. Its Article 5(3), rewritten by Directive 2009/136/EC with a transposition deadline of 25 May 2011, says that storing information on or gaining access to information stored in a user's terminal equipment is only allowed with the user's consent, after clear and comprehensive information, unless the storage or access is needed to transmit a communication or is strictly necessary for a service the user explicitly requested. Article 13 regulates unsolicited marketing by email and SMS, also on an opt-in basis.
Because it is a directive, each member state transposes it: Article 82 of the French Data Protection Act, section 25 of the German TDDDG, Article 122 of the Italian Privacy Code, Article 22.2 of the Spanish LSSI, and in the UK, still applying the same rule after Brexit, regulation 6 of PECR. The national authorities enforce it without the GDPR's one-stop shop, which is why the CNIL fines companies headquartered in Ireland for cookies set on French devices.
The term also covers the ePrivacy Regulation, the proposal of January 2017 that was meant to replace the Directive and modernize the cookie rules. After eight years without agreement, the European Commission withdrew it on 11 February 2025, so the Directive, its national laws and the EDPB's guidelines on its technical scope (Guidelines 2/2023) remain the rules for cookies, pixels, local storage and fingerprinting.