ePrivacy: What It Means for Your Website Compliance

ePrivacy is the branch of EU law that governs privacy in electronic communications, and it directly affects how every website handles cookies, tracking technologies, and digital marketing. While the GDPR receives the most attention, ePrivacy is the legal framework that specifically mandates cookie consent banners, restricts unsolicited electronic marketing, and protects the confidentiality of online communications.

This guide explains what ePrivacy covers, how it works alongside the GDPR, the current state of the proposed ePrivacy Regulation, and the practical steps your website needs to take. This content is educational and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.

What ePrivacy Means

ePrivacy refers to the set of EU rules that protect privacy specifically in the context of electronic communications. The term covers both the existing ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) and the proposed ePrivacy Regulation that is intended to replace it.

The core principle behind ePrivacy is straightforward: people have a right to confidentiality in their electronic communications, and their devices should not be accessed without their knowledge and consent. This principle translates into concrete rules in four areas:

• Cookies and tracking technologies. Article 5(3) of the directive requires prior consent before any non-essential information is stored on or accessed from a user's device. This is the legal basis for cookie consent requirements across the EU.
• Confidentiality of communications. Articles 5(1) and 5(2) prohibit intercepting, recording, or surveilling electronic communications without the consent of all parties involved.
• Direct marketing. Article 13 requires opt-in consent for electronic marketing messages including email, SMS, and automated calls. A limited exception exists for existing customers under certain conditions.
• Traffic and location data. Articles 6 and 9 restrict how telecommunications providers process metadata such as call duration, connection times, and geographic location.

Unlike the GDPR, which is a regulation that applies identically across all EU member states, the ePrivacy Directive is a directive that each member state must transpose into its own national law. This has created variation in how ePrivacy rules are implemented and enforced from country to country.

How ePrivacy and the GDPR Work Together

Understanding the relationship between ePrivacy and the GDPR is essential for compliance because regulators apply both frameworks simultaneously when investigating violations related to cookies, tracking, and electronic communications.

The lex specialis principle

Article 95 of the GDPR establishes that the ePrivacy Directive takes precedence in areas it specifically covers. In legal terms, ePrivacy is the lex specialis (more specific law) and the GDPR is the lex generalis (general law). This means:

• For cookies and tracking technologies, ePrivacy rules govern when consent is required
• The GDPR's definition of consent (Article 4(11)) and conditions for valid consent (Article 7) define what that consent must look like
• For personal data processing that falls outside the scope of ePrivacy, the GDPR applies exclusively

Practical overlap

In practice, website operators must comply with both laws simultaneously. A single cookie that collects personal data triggers obligations under both frameworks:

1. The ePrivacy Directive requires consent before the cookie is placed (Article 5(3))
2. The GDPR requires a lawful basis for processing the personal data the cookie collects (Article 6)
3. The GDPR requires transparent disclosure about the cookie's purpose and data processing (Articles 13 and 14)
4. Both laws require that consent, where relied upon, is freely given, specific, informed, and unambiguous

Enforcement consequences

Regulators have shown willingness to impose penalties under both frameworks for the same conduct. France's CNIL fined Google 150 million EUR and Facebook 60 million EUR in 2022 for cookie consent failures, citing violations of both the French transposition of the ePrivacy Directive and the GDPR. The combined enforcement approach means that inadequate cookie practices carry dual legal risk.

ePrivacy Rules for Cookies and Tracking

The cookie consent requirement in Article 5(3) of the ePrivacy Directive is the provision that most directly affects website operators. Understanding exactly what it requires and what it exempts is critical for compliance.

What requires consent

Article 5(3) requires prior, informed consent before storing information on a user's device or accessing information already stored. This applies to:

• Analytics cookies (Google Analytics, Matomo, Plausible with cookies)
• Advertising and retargeting cookies
• Social media sharing and tracking pixels
• Third-party cookies of any kind that are not strictly necessary
• Browser fingerprinting and similar identification techniques that access device information

What is exempt from consent

The directive provides a narrow exemption for two categories of cookies:

• Strictly necessary cookies. Those required for the sole purpose of carrying out a transmission over an electronic communications network. Examples include load balancing cookies and session cookies that maintain a secure connection.
• User-requested service cookies. Those strictly necessary to provide a service explicitly requested by the user. Examples include shopping cart cookies, authentication session cookies, and user interface preference cookies (such as language selection).

These exemptions are interpreted strictly. Analytics cookies do not qualify, even if the website operator considers them important for improving the user experience. Cookie consent banners that pre-check non-essential cookies or use dark patterns to steer users toward acceptance violate the consent requirements.

Consent standards

Valid consent under ePrivacy (using the GDPR's definition) must be:

• Freely given. Users must have a genuine choice. Blocking access to the website until cookies are accepted (cookie walls) is prohibited in most member states.
• Specific. Consent must be given for each distinct purpose. Bundling analytics, advertising, and functionality consent into a single "accept all" without alternatives is insufficient.
• Informed. Users must be told what cookies will be placed, what data they collect, who processes the data, and for what purpose.
• Unambiguous. Consent requires a clear affirmative act. Pre-ticked boxes, scrolling, or continued browsing do not constitute valid consent, as confirmed by the Court of Justice of the EU in the Planet49 case (C-673/17).

A properly configured cookie consent banner addresses these requirements. Your cookie policy generator documentation should list every cookie your site uses, its purpose, its provider, and its expiration period.

The Proposed ePrivacy Regulation

The European Commission published a proposal for an ePrivacy Regulation in January 2017, intended to replace the directive with a directly applicable regulation that would align with the GDPR. As of 2026, the regulation remains under negotiation without a confirmed adoption date.

Why a regulation instead of a directive

The directive's model of national transposition has created inconsistent implementation across member states. Germany's TTDSG, France's amendments to the Loi Informatique et Libertes, and Spain's LSSI each implement the same directive differently, creating compliance complexity for businesses operating across multiple EU countries. A regulation would apply identically everywhere, eliminating this fragmentation.

Key changes in the proposed regulation

The draft ePrivacy Regulation, as it has evolved through Council and Parliament negotiations, proposes several significant changes:

• Broader scope. Coverage would extend to over-the-top (OTT) communication services like WhatsApp, Signal, Skype, and Zoom, which are not covered by the current directive
• Metadata protections. Stricter rules for processing communications metadata (who contacted whom, when, and from where), recognizing that metadata can reveal as much as content
• Browser and software-based consent. Users would be able to set consent preferences at the browser or operating system level rather than responding to cookie banners on every website
• Stricter enforcement. Penalties aligned with the GDPR: up to 20 million EUR or 4% of annual global turnover
• Simplified rules for non-privacy-invasive cookies. Potential relaxation of consent requirements for audience measurement cookies that meet specific anonymization criteria

What to do while waiting

The delay in adopting the ePrivacy Regulation does not reduce your current obligations. The existing directive remains in force, and regulators continue to enforce it actively. The practical approach is to comply with the current directive's requirements and design your consent mechanisms so they can adapt to the regulation's changes when it eventually takes effect.

ePrivacy Compliance for Website Operators

Meeting ePrivacy requirements involves concrete technical and organizational measures. Here is what your website needs.

Implement a consent management platform

A cookie consent management platform (CMP) is the primary mechanism for complying with Article 5(3). An effective CMP must:

• Block non-essential cookies until the user provides consent
• Present clear, specific information about each cookie category
• Offer granular controls that allow users to accept or reject individual categories
• Record proof of consent including the timestamp, the version of the consent text, and the choices made
• Allow users to withdraw consent as easily as they gave it, as required by Article 7(3) of the GDPR

The consent banner should load before any third-party scripts execute. If analytics or advertising scripts fire before consent is obtained, the non-essential cookies they set violate Article 5(3) regardless of what the banner says.

Audit your cookies and tracking technologies

Many websites set cookies they do not know about, particularly through third-party scripts and tag managers. Conduct a thorough audit:

• Scan your website for all cookies and similar technologies in use
• Identify the provider, purpose, data collected, and retention period for each
• Classify each as strictly necessary, functional, analytics, or marketing
• Remove any cookies that serve no current purpose
• Document the results and update your privacy policy generator disclosures accordingly

Repeat this audit regularly. New cookies appear whenever you add plugins, update third-party scripts, or integrate new services.

Handle electronic marketing correctly

Article 13 of the ePrivacy Directive requires prior opt-in consent for electronic direct marketing. This includes email newsletters, promotional SMS messages, and automated calling. The requirements differ from general GDPR consent:

• Consent must be obtained before the first marketing message is sent
• The sender's identity must not be disguised or concealed
• A valid opt-out mechanism must be included in every message
• The limited "soft opt-in" exception applies only when a customer's contact details were obtained during a sale, the marketing concerns similar products or services, and the customer was given an opportunity to opt out at the point of collection and in every subsequent message

Disclose your practices transparently

Your privacy policy and cookie policy must accurately describe your use of cookies, tracking technologies, and electronic communications. Include:

• A complete list of cookies, grouped by category, with provider, purpose, and duration
• How users can manage or delete cookies through your CMP and through browser settings
• Your legal basis for each category of processing (consent for non-essential cookies, legitimate interest or necessity for exempt cookies)
• Any cross-border data transfers triggered by third-party cookies

A privacy policy generator can help structure these disclosures, but the content must reflect your actual practices. Generic or template descriptions that do not match what your site actually does create compliance risk.

ePrivacy Enforcement Across EU Member States

Because the ePrivacy Directive requires national transposition, enforcement varies significantly across member states. Understanding the landscape in your key markets helps you calibrate your compliance efforts.

Active enforcement jurisdictions

Several member states have demonstrated particularly rigorous enforcement of ePrivacy rules:

• France (CNIL). The most active enforcer, with major fines against Google (150 million EUR), Facebook (60 million EUR), and Microsoft (60 million EUR) for cookie consent violations. The CNIL publishes detailed guidance on cookie consent requirements and conducts systematic website audits.
• Spain (AEPD). Regular enforcement actions against websites using cookie walls and pre-ticked consent boxes. Spain's LSSI includes specific provisions on information society services.
• Italy (Garante). Issued comprehensive cookie guidelines in 2021 and has fined organizations for analytics cookies placed without consent.
• Germany (DSK/state authorities). Enforcement divided among 16 state data protection authorities. The TTDSG, effective since December 2021, consolidated cookie and telecom privacy rules.

Penalty variation

Because penalties are set by national law, the range varies:

• France can impose GDPR-level fines (up to 20 million EUR or 4% of turnover) for cookie violations when personal data is involved
• Germany's TTDSG provides for fines up to 300,000 EUR for cookie violations specifically, though GDPR fines apply when personal data processing is involved
• Smaller member states typically have lower maximum fines but can still impose penalties that significantly affect small and mid-sized businesses

Preparing for ePrivacy Changes

The regulatory landscape around ePrivacy continues to evolve. Whether the ePrivacy Regulation is adopted or the directive is further amended, website operators should build compliance practices that adapt to change rather than treating compliance as a one-time project.

Build flexible consent architecture

Design your cookie consent implementation to accommodate rule changes without a complete rebuild:

• Use a CMP that supports configuration changes without code deployments
• Maintain a structured cookie inventory that can be updated as new categories emerge
• Implement consent signals (such as the IAB Transparency and Consent Framework) that downstream vendors recognize
• Log consent records with enough detail to satisfy evolving documentation requirements

Monitor regulatory developments

Track the ePrivacy Regulation's legislative progress and your key markets' enforcement trends:

• Subscribe to guidance updates from supervisory authorities in your primary markets
• Monitor European Data Protection Board (EDPB) opinions and guidelines related to electronic communications
• Review enforcement decisions for patterns that signal shifting expectations
• Assess new browser privacy features (such as the deprecation of third-party cookies) for their impact on your tracking and analytics practices

Invest in privacy-preserving alternatives

As ePrivacy rules tighten, consider shifting toward data collection methods that reduce your consent burden:

• Server-side analytics that process aggregated data without device-level tracking
• First-party data strategies that rely on direct user relationships rather than third-party cookies
• Contextual advertising that targets content rather than user behavior
• Privacy-preserving measurement techniques that provide marketing insights without individual-level tracking

These approaches do not eliminate compliance obligations, but they reduce the surface area of personal data processing that triggers the strictest ePrivacy requirements.

Frequently Asked Questions

What does ePrivacy mean?

ePrivacy refers to the body of EU law that protects privacy in electronic communications. It currently consists of the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC), which governs cookies, tracking technologies, unsolicited marketing, and the confidentiality of electronic communications. The term also encompasses the proposed ePrivacy Regulation, which would replace the directive with a directly applicable law across all EU member states.

How is ePrivacy different from the GDPR?

The GDPR is a general law covering all personal data processing, while ePrivacy specifically targets electronic communications. The GDPR defines what valid consent means, but ePrivacy is the law that actually requires consent for cookies and tracking technologies under Article 5(3) of the directive. Where both laws apply to the same situation, ePrivacy takes precedence as the more specific regulation, a principle established in Article 95 of the GDPR.

Does ePrivacy apply to websites outside the EU?

Yes. If your website places cookies on the devices of visitors located in the EU or sends electronic marketing to EU recipients, ePrivacy rules apply regardless of where your business is based. Each EU member state's national transposition of the directive determines enforcement details, but the territorial scope follows the location of the user. This mirrors the GDPR's extraterritorial reach under Article 3.

What happens when the ePrivacy Regulation replaces the directive?

The ePrivacy Regulation would apply directly in all EU member states without requiring national transposition, eliminating the current patchwork of national implementations. It would introduce stricter rules for metadata processing, expand coverage to over-the-top communication services like WhatsApp and Signal, and mandate browser-level consent settings. However, the regulation has been in legislative negotiation since 2017, and no final adoption date has been confirmed.