ePrivacy Directive (2002/58/EC)

The ePrivacy Directive (Directive 2002/58/EC), as amended by Directive 2009/136/EC, regulates privacy and data protection in the electronic communications sector. Often referred to as the "Cookie Law," it complements the GDPR by providing sector-specific rules for electronic communications services.

The directive's scope covers all providers of publicly available electronic communications services and networks within the EU. Since its 2009 amendment, it has required prior informed consent for the storage of or access to information on a user's terminal equipment — the legal basis for cookie consent banners seen across European websites.

Article 5 establishes the principle of confidentiality of communications, prohibiting the interception, surveillance, or storage of communications and related traffic data without the consent of the users concerned. Member states may adopt legislative measures restricting this right only when necessary, appropriate, and proportionate within a democratic society, in line with Article 15.

Cookie and tracking technology requirements are detailed in Article 5(3): storing information or gaining access to information already stored in terminal equipment is only permitted with clear and comprehensive information and prior consent. Exceptions exist for cookies strictly necessary for providing a service explicitly requested by the user and for the sole purpose of carrying out a communication.

The directive also regulates unsolicited electronic communications (spam). Article 13 requires prior opt-in consent for direct marketing via email, SMS, or automated calling systems. A limited "soft opt-in" exception allows marketing to existing customers about similar products or services if they were given the opportunity to object when their details were collected and in every subsequent message.

Traffic and location data must be erased or anonymised when no longer needed for transmission or billing, unless consent has been obtained for value-added services. Calling line identification (caller ID) must be offered with the option to override on a per-call or per-line basis.

The ePrivacy Directive was intended to be replaced by an ePrivacy Regulation to align with the GDPR. After years of legislative negotiations, the ePrivacy Regulation proposal remains under discussion. Until it is adopted, the directive — as transposed into national law by each member state — continues to apply. National implementations vary, creating a somewhat fragmented landscape for cross-border electronic communications services. Enforcement is carried out by national data protection authorities or telecommunications regulators, depending on the member state.