ePrivacy Directive Guide: Cookies, Confidentiality of Communications and Marketing in the EU

The ePrivacy Directive is the EU law behind every cookie banner, yet most security teams only meet it when a tracking pixel or a telecoms breach lands on their desk. Directive 2002/58/EC, as amended by Directive 2009/136/EC, protects the confidentiality of electronic communications, controls storage of and access to information on users' devices, limits the use of traffic and location data, sets the opt-in rule for electronic marketing, and requires providers of public communications services to secure their services and report personal data breaches. Because it is a directive, it applies through 27 national laws enforced by different authorities. This guide covers scope, the obligations that matter to security and privacy engineering, the status of the withdrawn ePrivacy Regulation and the Digital Omnibus proposal, enforcement, and what the rules mean for AI agents and machine identities. It is for security leaders, privacy engineers, DPOs and telecoms compliance teams.

Key takeaways

• Article 5(3) is about the device, not personal data. Storing or accessing any information on terminal equipment needs consent unless it is for transmission or strictly necessary for a service the user explicitly requested. EDPB Guidelines 2/2023 confirm this reaches pixels, tracking links, IP-based tracking in some cases, IoT telemetry and unique identifiers.
• The Directive is lex specialis to the GDPR. Where it has a specific rule, that rule applies to that step; everything after it, such as profiling the collected data, needs a GDPR legal basis.
• Telecoms breaches run on a 24-hour clock. Commission Regulation (EU) No 611/2013 requires providers of publicly available electronic communications services to notify the national authority no later than 24 hours after detection where feasible, with a full notification within three days.
• The ePrivacy Regulation is gone, the Directive stays. The Commission's withdrawal of proposal COM(2017) 10 was published in the Official Journal on 6 October 2025. The November 2025 Digital Omnibus proposal would move device-access rules for personal data into the GDPR, but it is still being negotiated.
• Enforcement is national and fragmented. Depending on the Member State, the data protection authority, the telecoms regulator or both enforce the national transposition, and the GDPR one-stop-shop does not apply to ePrivacy rules as such.

Scope: who and what is covered

Article 3 applies the Directive to the processing of personal data in connection with publicly available electronic communications services in public communications networks. Several articles, however, are wider than that, and this is the point most often missed.

• Which services: since the European Electronic Communications Code (Directive (EU) 2018/1972) applied from 21 December 2020, "electronic communications service" includes number-independent interpersonal communications services, so messaging and webmail services are generally treated as in scope of the confidentiality rules. Confirm the position in the relevant national law.
• Territorial reach: Article 5(3) is applied by national authorities to services that access devices of users in their territory, regardless of where the provider is established.
• Terminal equipment: the EDPB defines it as any device connected or connectable to a public communications network, whether or not currently connected, which includes phones, browsers on laptops, smart TVs, cars and IoT devices.

Key obligations

Article 5(3): storage and access on the device

Article 5(3) provides that "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information". It permits technical storage or access "for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." Consent takes its meaning from the GDPR, so it must be freely given, specific, informed and unambiguous, and pre-ticked boxes do not count (confirmed by the Court of Justice in Planet49, C-673/17).

EDPB Guidelines 2/2023 (version 2.0 adopted 7 October 2024) set out when Article 5(3) applies. The operation must involve information (personal or not), terminal equipment of a subscriber or user, a public communications network, and either storage of information or gaining access to it. Storage and access can be done by different parties.

The EDPB stresses that Article 5(3) applying does not automatically mean consent is required: the two exemptions must be assessed case by case. Cookie categories, banner design and CMP operations are covered in the Consent Management Guide: Cookies, CMPs and GPC; this guide does not repeat them.

Article 5(1): confidentiality of communications

Member States must ensure the confidentiality of communications and the related traffic data. Listening, tapping, storage, interception or surveillance by anyone other than the users is prohibited without the users' consent unless legally authorised under Article 15(1). Technical storage necessary for conveying a communication is allowed, and recording of communications for evidence of commercial transactions is preserved under Article 5(2). For security teams this frames lawful use of content inspection on provider networks, such as spam filtering and malware scanning, which national laws and authorities treat differently; take advice before deploying content analysis on a public service.

Article 4 and Regulation 611/2013: security and breach notification

Article 4 requires providers to take appropriate technical and organisational measures, having regard to the state of the art and the risk, including ensuring that personal data is accessed only by authorised personnel for legally authorised purposes and implementing a security policy. Providers must warn subscribers of particular risks to network security, with remedies and likely costs. Commission Regulation (EU) No 611/2013, in force since 25 August 2013, fixes the notification mechanics.

A provider that is also a controller under the GDPR follows this regime, not Article 33, for breaches in connection with its public service, and keeps the GDPR route for other processing. For the GDPR clock, see the GDPR Compliance Guide for Security Teams.

Articles 6, 9 and 13: traffic, location and marketing

• Traffic data (Art. 6): erase or anonymise once no longer needed for transmission; keep billing data only until the bill can no longer be challenged; marketing or value-added use needs prior, withdrawable consent; restrict access to authorised personnel.
• Location data (Art. 9): only anonymised or with consent for a value-added service, with information on type, purpose and duration, and a simple free way to refuse temporarily.
• Marketing (Art. 13): prior consent for automated calls, fax and email marketing; a soft opt-in for a business's own similar products where the email address was obtained in a sale and a free objection is offered at collection and in every message; Member States choose opt-in or opt-out for other channels such as live calls. Article 13(4) bans hiding the sender's identity or omitting a valid address for opt-out requests, and Article 13(6) gives harmed parties a right to sue. For US rules, see the CAN-SPAM and TCPA Guide.

Timeline and current status

According to Taylor Wessing's analysis of the Digital Omnibus, proposed Article 88a would limit consent-free access to a closed list of purposes, including aggregated audience measurement for the provider's own service and security, Article 88b would require websites to honour automated, machine-readable signals and browser providers to support them, and a refused consent could not be requested again for the same purpose for six months. Treat all of this as a proposal: the Directive and national laws remain the binding rules, and the proposal's text will change in negotiation.

Enforcement and penalties

Article 15a requires Member States to lay down effective, proportionate and dissuasive penalties and to give competent authorities power to order infringements to stop and adequate investigative powers. Penalty levels therefore vary by country. EDPB Opinion 5/2019 explains the split:

• Which authority: a data protection authority can enforce national ePrivacy rules only where national law gives it that competence; otherwise the authority designated by that law, often the telecoms regulator, is competent.
• No one-stop-shop: the EDPB states that "The GDPR mechanisms do not apply to the enforcement of the provisions contained in the ePrivacy Directive as such." A company with an EU main establishment can therefore face cookie enforcement from several national authorities.
• GDPR fines for what follows: processing after the cookie step, such as profiling, is assessed under the GDPR, and an ePrivacy infringement may be taken into account as a factual finding in a GDPR case, which brings GDPR-level fines into play.
• Private actions: Article 13(6) supports claims by people harmed by unlawful marketing, and national laws add their own remedies.

What it means for AI agents and non-human identities

• Agents that read communications: an AI assistant given access to mailboxes or chat on a public communications service touches content protected by Article 5(1). Base access on the user's own authorisation, scope the agent's tokens to the mailboxes it serves, and log what it reads. The postmark-mcp malicious MCP server showed how an agent tool can silently copy every email to a third party. See the Email Security Guide.
• Agents that browse or run in the client: an agent or SDK that writes identifiers to the device or reads device data for its own purposes triggers Article 5(3). Local inference on the device is outside it until results leave the device, per the EDPB's local processing use case.
• Agents that market: outreach agents sending email or SMS must check the Article 13 basis and suppression list before each send and must never disguise the sender.
• IoT and machine telemetry: devices reporting through gateways are terminal equipment; design telemetry with a clear strictly necessary basis or consent, and separate security telemetry from product analytics.
• Provider machine accounts: in telecoms, service accounts and integrations with access to traffic, location or content data fall under Article 4's authorised-access requirement. The Salt Typhoon telecom intrusions show what stolen credentials and network device secrets can expose. See the Telecoms Identity Security Guide.

Compliance steps

1. Map the national laws. List the Member States whose users you serve, the national transposition and the competent authority in each, and whether you provide a publicly available electronic communications service.
2. Inventory device access. Scan sites, apps, emails and devices for cookies, local storage, SDKs, pixels, tracking links, fingerprinting and telemetry. Test each against the EDPB criteria and record the exemption or the need for consent.
3. Fix the email channel. Tracking pixels and personalised links in marketing email are in scope of Article 5(3): gate them on consent or remove them, and test with a seeded inbox.
4. Separate the GDPR layer. For each tracked purpose, record the GDPR legal basis for the processing after collection, since Article 5(3) consent does not cover it automatically.
5. Build the provider breach pipeline. If you are a provider, define "detection" in the runbook, prepare the Regulation 611/2013 notification fields, rehearse the 24-hour initial and three-day full notice, and confirm keys are managed so the encryption exception can be evidenced.
6. Pilot and roll back. Deploy consent and tag changes to one market first, compare scanner results before and after, and keep the previous configuration to restore if a release breaks consent gating.
7. Track the Digital Omnibus. Assign an owner to watch the negotiation and plan for machine-readable consent signals, but do not relax current consent practice on the strength of a proposal.

Decision guidance

• Strictly necessary or consent: claim the exemption only when the user explicitly requested the service and the storage is needed for it, such as a login session or basket. Analytics shared with a vendor for its own purposes and advertising need consent.
• One configuration or many: organisations serving several Member States usually adopt the strictest common interpretation, because national authorities can act independently. UK traffic can follow the separate rules in the PECR Guide.
• Small versus large: small sites should minimise third-party tags; large organisations need tag governance with change approval, automated scanning per market and evidence retention.

Detection and measurement

• Pre-consent access: percentage of page or app sessions where non-exempt storage or access occurs before consent (target zero).
• Email tracking gating: share of marketing emails sent with tracking pixels to recipients without consent (target zero).
• Unassessed technologies: number of device access technologies without a recorded EDPB assessment.
• Breach timeliness: percentage of provider breaches with an initial notice within 24 hours of detection.
• Traffic data retention: records held beyond the documented retention period.

Framework mapping

Practitioner checklist

• List the national transpositions and competent authorities for every market you serve.
• Assess every device access technology, including email pixels, IP-based tracking and IoT telemetry, against EDPB Guidelines 2/2023.
• Gate non-exempt storage and access on GDPR-standard consent, and record the GDPR basis for later processing.
• Remove or gate tracking pixels and personalised links in marketing email.
• Check the Article 13 basis and suppression status before every marketing send, including sends by agents.
• For providers, rehearse the 24-hour and three-day Regulation 611/2013 notifications and keep the breach inventory current.
• Scope and log machine and agent access to communications content, traffic and location data.
• Assign an owner to track the Digital Omnibus proposal without relaxing current practice.

Standards and references

• EUR-Lex: Directive 2002/58/EC on privacy and electronic communications, consolidated text
• EUR-Lex: Commission Regulation (EU) No 611/2013 on the notification of personal data breaches
• EDPB: Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive
• EDPB: Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR
• EUR-Lex: Withdrawal of Commission proposals, C/2025/5423
• Taylor Wessing: The Digital Omnibus, cookies
• EDRi: The ePrivacy Regulation proposal has been withdrawn

Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · Consent Management Guide: Cookies, CMPs and GPC · PECR Guide · CAN-SPAM and TCPA Guide · Global Privacy Regulatory Map. This guide summarises Directive 2002/58/EC as amended and related EU instruments and is not legal advice.