Most tracking and marketing disputes in the EU turn on one question that teams answer wrongly: does this step fall under the ePrivacy Directive, the GDPR, or both? The two laws overlap but do different jobs. The ePrivacy Directive governs the act of storing or reading information on a device and sending electronic marketing, whether or not personal data is involved; the GDPR governs what you then do with any personal data. Getting the split wrong produces the classic failures: claiming legitimate interest for an analytics cookie, assuming the GDPR one-stop-shop protects you from a cookie investigation, or treating cookie consent as cover for profiling. This guide works through the lex specialis relationship, consent, enforcement and the main tracking and marketing scenarios for privacy engineers, DPOs and security teams who own web, app and email stacks. The ePrivacy Directive itself is covered in the ePrivacy Directive Guide; this page stays on the interplay.
Status checked 14 November 2026: Directive 2002/58/EC (as amended by Directive 2009/136/EC) and Regulation (EU) 2016/679 are both in force. The 2017 ePrivacy Regulation proposal has been withdrawn. The Digital Omnibus proposal, which would move device access rules for personal data into the GDPR, is at committee stage in the European Parliament and is not law.
Key takeaways
- The device step and the processing step are different legal events. Article 5(3) of the ePrivacy Directive governs storing or reading information on a device; the GDPR governs the processing of personal data that follows. Most tracking needs both a valid Article 5(3) basis and a GDPR legal basis.
- Lex specialis applies only as far as the special rule reaches. EDPB Opinion 5/2019 says Article 5(3) takes precedence over Article 6 GDPR for the device activity itself, while later processing must have its own Article 6 basis.
- Legitimate interest cannot cover the cookie. Article 5(3) allows only consent or the two narrow exemptions. The EDPB cookie banner taskforce also concluded that if the Article 5(3) step is unlawful, the subsequent processing cannot be compliant with the GDPR.
- Consent means GDPR consent. The Directive borrows its consent definition from data protection law, now read as the GDPR, and the Court of Justice confirmed in Planet49 that pre-ticked boxes are not consent, whether or not the stored information is personal data.
- Enforcement is not one-stop. National ePrivacy rules are enforced by whichever authority national law designates, and the GDPR cooperation mechanisms do not apply to ePrivacy as such, so a company with an EU lead authority can still face cookie action in several Member States.
The legal relationship: lex specialis and Article 95
The ePrivacy Directive was written as a specialised supplement to EU data protection law. Article 1(2) says its provisions "particularise and complement" Directive 95/46/EC, and GDPR Article 94(2) states that references to the repealed Directive are to be construed as references to the GDPR. The GDPR handles the overlap in Article 95: it "shall not impose additional obligations" on persons in relation to processing in connection with publicly available electronic communications services in public communication networks, for matters where they are subject to specific obligations with the same objective in Directive 2002/58/EC.
EDPB Opinion 5/2019 (12 March 2019) is the authoritative reading. Special provisions prevail over general rules in situations they specifically seek to regulate (paragraph 38), but the facts must be analysed carefully to find how far the derogation extends (paragraph 41), and where there is no special rule the GDPR applies as the general law. Article 95 avoids duplicate burdens; the Opinion's example is breach notification, where a telecoms provider notifying under the ePrivacy regime does not also notify under GDPR Article 33 for the same breach.
| Question | ePrivacy Directive | GDPR |
|---|---|---|
| Legal form | Directive: applies through national laws (for example Germany's TDDDG section 25) | Regulation: directly applicable |
| What triggers it | Storage of or access to information on terminal equipment (Art. 5(3)); confidentiality of communications (Art. 5(1)); electronic marketing (Art. 13); provider obligations | Processing of personal data |
| Personal data needed? | No for Art. 5(3); "information" is broader than personal data | Yes |
| Legal bases | Consent, or the transmission and strictly necessary exemptions in Art. 5(3) | Six bases in Art. 6, including legitimate interest |
| Consent standard | Borrowed from data protection law (Art. 2(f)), now the GDPR standard | Freely given, specific, informed, unambiguous; withdrawable |
| Enforcer | Authority designated by national law (data protection authority, telecoms regulator or both) | Data protection authorities, with lead authority and cooperation mechanisms |
| Penalties | Set nationally; Art. 15a requires effective, proportionate and dissuasive penalties, including criminal sanctions where appropriate | Up to EUR 20 million or 4 percent of worldwide annual turnover for the highest tier (Art. 83(5)) |
Device access versus processing: the two-step test
The single most useful habit is to split every tracking flow into two steps and assess each under its own law.
- Step one, the device: does the operation store information on, or gain access to information already stored on, a user's terminal equipment connected to a public communications network? EDPB Guidelines 2/2023 (version 2.0, adopted 7 October 2024) set the criteria: the operation relates to information (not only personal data), involves terminal equipment and a public network, and amounts to storage or gaining access. If yes, Article 5(3) applies and you need consent unless an exemption fits.
- Step two, the processing: is personal data then processed, by you or a partner? If yes, the GDPR applies to that processing and you need an Article 6 basis, transparency, purpose limitation, retention limits and, for partners, the controller and processor allocation.
The EDPB stresses that Article 5(3) applying "does not systematically mean that consent needs to be collected": the exemptions are assessed case by case. Equally, a valid consent at step one does not automatically cover step two. Opinion 5/2019 paragraph 41 says personal data obtained through device access "must also have a legal basis under article 6 of the GDPR in order to be lawful". In practice, where consent was the step one basis, the step two basis for the same tracking purpose is usually consent too, and the EDPB taskforce considered that an overriding legitimate interest would not normally exist for such processing.
Why legitimate interest fails for cookies
Article 5(3) contains its own closed list: consent, transmission of a communication, or strict necessity for a service the user explicitly requested. Opinion 5/2019 paragraph 40 says controllers cannot rely on the full range of Article 6 legal bases for activities governed by Article 5(3). The cookie banner taskforce report (18 January 2023) put it directly: the legal basis for placing or reading cookies cannot be the controller's legitimate interests, and where Article 5(3) is not complied with, the subsequent processing cannot be compliant with the GDPR. Banners offering a "legitimate interest" toggle for advertising or analytics vendors are therefore built on a category that does not exist at step one. For the GDPR side of the choice, see the Consent vs Legitimate Interest guide.
The consent standard borrowed from the GDPR
Article 2(f) of the Directive says consent "corresponds to the data subject's consent" under data protection law, so through Article 94(2) GDPR the ePrivacy consent bar is the GDPR bar. National transpositions say the same: Germany's section 25 TDDDG requires that information and consent follow Regulation (EU) 2016/679.
| Source | What it established | Practical consequence |
|---|---|---|
| CJEU Planet49, C-673/17 (1 October 2019) | A pre-ticked checkbox the user must deselect is not valid consent; Article 5(3) is interpreted the same whether or not the information is personal data; information must include cookie duration and whether third parties can access the cookies | No pre-ticked toggles; disclose lifetime and third-party access per cookie or category |
| CJEU Fashion ID, C-40/17 (29 July 2019) | A site embedding a third-party plugin can be joint controller for collection and disclosure by transmission; the site operator, not the plugin provider, obtains consent for the operations it controls; each controller needs its own legitimate interest where that basis is used | Embedded tags and plugins are your responsibility at the point of collection; gate them before they fire |
| EDPB cookie banner taskforce (18 January 2023) | No reject option on any layer infringes; pre-ticked boxes invalid; essential classifications often inaccurate; withdrawal must be as easy as giving consent | Reject on the first layer, honest categorisation, persistent withdrawal control |
| EDPB Guidelines 2/2023 v2.0 (7 October 2024) | Article 5(3) reaches email tracking pixels, some IP-based tracking and unique identifiers sent by client-side code | The two-step test applies to email and server-side tracking, not just browser cookies |
Banner mechanics, CMP configuration and signal handling are covered in the Consent Management Guide: Cookies, CMPs and GPC.
Enforcement bodies: who can act
Because the ePrivacy rules live in national law, the competent authority depends on the Member State. Opinion 5/2019 says a data protection authority can enforce Article 5(3) rules only if national law confers that competence on it, and cannot automatically rely on its GDPR tasks and powers for that purpose (paragraphs 66 and 68). Where national law designates it, it enforces directly; elsewhere the telecoms regulator or another body does.
- No one-stop-shop for the device step: paragraph 80 states that "The GDPR mechanisms do not apply to the enforcement of the provisions contained in the ePrivacy Directive as such." A company whose lead GDPR authority sits in one Member State can still be investigated for cookies by authorities in others.
- Full GDPR competence for what follows: data protection authorities remain fully competent to assess the lawfulness of the processing operations that follow device access (paragraph 75), with GDPR cooperation applying to that processing (paragraph 84).
- Cross-over findings: an authority applying the GDPR may take an ePrivacy infringement into consideration as a factual finding, for example under lawfulness or fairness, but the enforcement decision must be justified on the basis of the GDPR unless national law gives wider competence (paragraphs 76 and 89).
- Different penalty ceilings: ePrivacy penalties are national under Article 15a and vary by country, while GDPR fines for the downstream processing follow Article 83.
For organisations with UK users, the parallel regime is PECR alongside the UK GDPR, which has diverged; see the PECR Guide.
Tracking and marketing scenarios
| Scenario | Step one: ePrivacy | Step two: GDPR |
|---|---|---|
| Session cookie for a logged-in account or basket | Strictly necessary for a service the user explicitly requested: no consent | Contract or legitimate interest for account processing |
| Security cookie or device check during login requested by the user | Assess under the strictly necessary exemption case by case; document why it is needed for the requested service | Legitimate interest in security, with a balancing test and minimal retention |
| First-party analytics shared with a vendor that uses data for its own purposes | Consent | Consent for the analytics processing; joint controller or processor terms with the vendor |
| Advertising pixel or third-party tag on a product page | Consent before the tag fires | Consent for profiling and ad targeting; check onward sharing |
| Tracking pixel or personalised link in a marketing email | Consent for the pixel (Guidelines 2/2023) | Basis for open-rate profiling; usually consent where tied to the pixel |
| Marketing email to an existing customer for similar products | Soft opt-in under Art. 13(2) if contact details were obtained in a sale and objection is offered free at collection and in every message | Direct marketing may be a legitimate interest (Recital 47); the right to object to direct marketing is absolute |
| Marketing email to a prospect from a bought list | Prior consent under Art. 13(1) for electronic mail to natural persons | Consent obtained by the list source must name you; otherwise unlawful |
| Server-side tracking with no device storage, using a first-party identifier the browser sends | Applies where client-side code instructs the device to send the identifier or the IP originates from user equipment (Guidelines 2/2023) | Same GDPR analysis as client-side tracking; moving server-side changes the plumbing, not the law |
| Local processing on the device that never leaves it | Not by itself; applies once results are sent off the device | Only if personal data is processed by the controller |
The marketing rows matter for automated outreach: an AI agent or marketing platform sending on your behalf inherits the same Article 13 tests and suppression checks. See the AI Agents in Marketing Guide and, for email measurement, the Email Tracking Pixels Guide.
ePrivacy Regulation and Digital Omnibus status
The Commission's 2017 proposal for an ePrivacy Regulation, COM(2017) 10 (procedure 2017/0003(COD)), appears in the Commission's withdrawal notice dated 6 October 2025, with withdrawal approved at its meeting of 16 July 2025. The Directive and its national transpositions therefore remain the binding rules.
On 19 November 2025 the Commission proposed the Digital Omnibus, COM(2025) 837 (procedure 2025/0360(COD)), which amends both the GDPR and Directive 2002/58/EC. According to its explanatory memorandum, it would insert a new GDPR Article 88a setting a consent requirement for storing or accessing personal data on terminal equipment, with some purposes allowed without consent where low risk or necessary for a requested service, and an Article 88b requiring controllers to respect standardised machine-readable indications of choice after a six-month grace period once standards exist. Integrity rules for terminal equipment would remain in the Directive where non-personal data is processed. As of 14 November 2026 the European Parliament's Legislative Observatory lists the file as awaiting committee decision, with committee referral announced on 19 January 2026. The text will change in negotiation: plan for it, but do not relax current consent practice on the strength of a proposal.
| Date | Event | Status at 14 November 2026 |
|---|---|---|
| 12 March 2019 | EDPB Opinion 5/2019 on the interplay | Current guidance |
| 1 October 2019 | CJEU Planet49 judgment | Binding interpretation |
| 18 January 2023 | EDPB cookie banner taskforce report | Current guidance |
| 7 October 2024 | EDPB Guidelines 2/2023 version 2.0 | Current guidance |
| 6 October 2025 | Withdrawal notice listing the ePrivacy Regulation proposal | Final |
| 19 November 2025 | Digital Omnibus proposal COM(2025) 837 | Awaiting committee decision in Parliament |
How to implement: aligning both regimes
- Inventory device access: crawl sites and apps and seed test inboxes to list every cookie, storage key, SDK, pixel, tracking link and fingerprinting call, before and after consent. The Cookie and Tracking Technology Compliance Guide covers scanning.
- Record the two-step assessment per technology: step one basis (exemption with reasoning, or consent), step two GDPR basis, controller role of each party, retention.
- Remove legitimate interest from the device layer: reconfigure the CMP so no vendor fires on legitimate interest before consent.
- Map authorities per market: list each Member State served, the national transposition and the competent ePrivacy authority, separately from your GDPR lead authority.
- Fix marketing channels: tag each email and SMS list with its Article 13 basis (consent or soft opt-in) and source, and enforce suppression before every send, including automated sends.
- Pilot and roll back: release CMP and tag changes to one market first, compare pre-consent scan results, and keep the previous container version so a broken release can be restored quickly.
- Assign an owner for the Digital Omnibus: track the procedure and budget for machine-readable signal handling, without changing current practice until the law changes.
Decision guidance
- Exemption or consent: claim strict necessity only where the user explicitly asked for the service and it cannot work without the storage; analytics shared with a third party for its own purposes and all advertising need consent.
- One configuration or per-country: because authorities act independently, multinational sites usually apply the strictest common interpretation across EU markets and handle the UK separately under PECR.
- Who owns it: the DPO owns the legal assessment, marketing and web teams own tag changes, and security owns the third-party script controls (Content Security Policy, tag allowlists) that make consent enforceable.
- Small versus large: small sites should cut third-party tags to the minimum, which removes most step one questions. Large organisations need tag governance with change approval, automated scanning per market and an evidence pack for each authority.
Detection and measurement
| Metric | Target |
|---|---|
| Sessions with non-exempt storage or access before consent | Zero |
| Vendors in the CMP relying on legitimate interest for device access | Zero |
| Tracking technologies without a recorded two-step assessment | Zero |
| Marketing sends to contacts without a recorded Article 13 basis | Zero |
| Markets with a named competent ePrivacy authority on file | 100 percent of markets served |
Common failure patterns
- Legitimate interest toggles for vendors: a basis that cannot apply to the device step, which also taints the downstream processing.
- Assuming the lead authority shields you: treating the GDPR one-stop-shop as covering cookie enforcement, then facing parallel national actions.
- Cookie consent as a blank cheque: using the banner consent to justify profiling, data sales or retention that were never disclosed at step two.
- Moving tracking server-side to avoid the banner: identifiers sent by client-side code and device-originated IP addresses can still be within Article 5(3).
- Mislabelled essential cookies: analytics or A/B testing placed in the strictly necessary category, which the EDPB taskforce flagged as a frequent problem.
- Pixels left in marketing email: open tracking sent to everyone regardless of consent.
Framework mapping
| Obligation | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Know which law and authority applies per market | GV.OC-03 | PT-2 | 5.31, 5.34 |
| Consent and notice for device access and processing | GV.OC-03 | PT-4, PT-5 | 5.34 |
| Third-party tags and SDKs as suppliers | GV.SC-07 | SA-9 | 5.19, 5.20 |
| Retention of tracking data | PR.DS-01 | SI-12 | 8.10 |
| Monitoring consent enforcement in production | DE.CM-09 | CA-7 | 8.16 |
Practitioner checklist
- Split every tracking flow into a device step and a processing step and record the basis for each.
- Remove legitimate interest as a basis for any storage or access on user devices.
- Apply GDPR-standard consent: no pre-ticked boxes, reject on the first layer, duration and third-party access disclosed, easy withdrawal.
- Gate embedded plugins and tags before they fire, since the site operator obtains consent for collection.
- Treat email pixels, tracking links and server-side identifiers as within Article 5(3) unless assessed otherwise.
- Record the Article 13 basis and source for every marketing list and honour objections everywhere.
- Maintain a per-market register of national transpositions and competent ePrivacy authorities.
- Track the Digital Omnibus procedure with a named owner and dated status notes.
Standards and references
- EUR-Lex: Directive 2002/58/EC on privacy and electronic communications, consolidated text
- EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation
- EDPB: Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR
- EDPB: Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive
- EDPB: Report of the work undertaken by the Cookie Banner Taskforce
- Court of Justice of the EU: Planet49, Case C-673/17
- Court of Justice of the EU: Fashion ID, Case C-40/17
- European Parliament Legislative Observatory: Digital Omnibus, 2025/0360(COD)
Related NHI Mgmt Group resources: ePrivacy Directive Guide · Cookie and Tracking Technology Compliance Guide · GDPR Compliance Guide for Security Teams · Consent Management Guide: Cookies, CMPs and GPC · PECR Guide. This guide summarises Directive 2002/58/EC, Regulation (EU) 2016/679 and related EU guidance and case law as of November 2026 and is not legal advice.