The ePrivacy Directive is the European Union directive on privacy and electronic communications, formally Directive 2002/58/EC, which protects the confidentiality of communications and, through its Article 5(3), requires prior informed consent before information is stored on or read from a user’s device. In the practice of Cookies & consent, it is the legal rule behind consent banners, cookie policies and consent management platforms, which is why it is widely known as the cookie law.
The directive was substantially amended in 2009 by Directive 2009/136/EC, which replaced an opt-out model with the consent requirement that applies today. Because it is a directive rather than a regulation, it takes effect through national transposition laws, so the same principle appears in slightly different wording and enforcement structures across the member states.
What the ePrivacy Directive regulates
The ePrivacy Directive regulates confidentiality and security in electronic communications, not only cookies. Its scope covers providers of public communications services and, through the terminal equipment rule, any party that accesses a user’s device, including website operators, app publishers and advertising vendors.
The following table summarizes the provisions that matter most in day-to-day privacy work.
| Article | Subject | Practical effect |
|---|---|---|
| Article 4 | Security of services | Providers must secure networks and notify personal data breaches |
| Article 5(1) | Confidentiality of communications | No interception or surveillance without consent or legal basis |
| Article 5(3) | Terminal equipment access | Consent before storing or reading device information |
| Article 6 | Traffic data | Erase or anonymize when no longer needed for transmission or billing |
| Article 9 | Location data | Use for value-added services only with consent |
| Article 13 | Unsolicited communications | Opt-in for marketing email and SMS, with a soft opt-in exception |
Since the European Electronic Communications Code took effect in December 2020, the definition of communications services has also included number-independent messaging and calling services, which brought many over-the-top messaging apps under the confidentiality rules.
How Article 5(3) governs cookies and device access
Article 5(3) makes storing information or gaining access to information already stored in terminal equipment lawful only if the user has given consent after receiving clear and comprehensive information about the purposes. The rule is technology neutral: it applies to HTTP cookies, local storage, SDK identifiers in mobile apps, tracking pixels that read device data and many fingerprinting techniques.
Two narrow exemptions exist. Consent is not needed when the access is solely for carrying out the transmission of a communication, or when it is strictly necessary to provide a service explicitly requested by the user. The table below shows how typical technologies are usually assessed.
| Technology or purpose | Consent needed | Reason |
|---|---|---|
| Session cookie for a shopping cart | No | Strictly necessary for a requested service |
| Load-balancing cookie | No | Needed for transmission or delivery |
| Security cookie against login abuse | Usually no | Necessary for the requested secure service |
| Analytics cookie | Usually yes | Not strictly necessary; some regulators allow narrow exemptions |
| Advertising or third-party tracking cookie | Yes | Serves the publisher or vendor, not the user’s request |
| Device fingerprinting script | Yes in most readings | Reads device information without necessity |
A frequent misunderstanding is that Article 5(3) applies only to personal data. It does not: the Court of Justice confirmed in the Planet49 judgment of 2019 that the rule protects the device whether or not the information is personal data, and that pre-ticked checkboxes do not produce valid consent.
ePrivacy Directive and GDPR compared
The ePrivacy Directive is a lex specialis that particularizes and complements the General Data Protection Regulation for electronic communications. Where both apply, the specific ePrivacy rule takes precedence for the device access itself, while the GDPR governs the later processing of any personal data collected.
| Aspect | ePrivacy Directive | GDPR |
|---|---|---|
| Legal form | Directive transposed into national law | Directly applicable regulation |
| Protected interest | Confidentiality and the integrity of the device | Personal data of individuals |
| Legal basis for tracking | Consent unless an exemption applies | Six bases, including legitimate interests |
| Consent standard | Borrowed from the GDPR definition | Freely given, specific, informed, unambiguous |
| Enforcement | National authority named in each state | Data protection authorities with one-stop-shop |
| Cross-border cooperation | No one-stop-shop mechanism | Lead supervisory authority model |
The practical consequence is that legitimate interests cannot replace consent for non-essential cookies. A controller may rely on legitimate interests for some downstream processing, but the act of setting the tracking cookie still requires consent under the national ePrivacy rule.
National transposition and enforcement
Because each member state transposed the directive separately, the details differ by country: the competent authority, the size of fines and the treatment of analytics exemptions are not uniform. Examples include the Privacy and Electronic Communications Regulations in the United Kingdom, the German TDDDG (formerly TTDSG) and Article 82 of the French data protection act.
Regulatory guidance has steadily tightened expectations. European supervisory authorities expect a reject option as easy as accept, no cookie walls that force acceptance in most contexts, no deceptive design, and consent that can be withdrawn as easily as it was given. Fines imposed by national regulators against large platforms for missing reject buttons have reached tens of millions of euros.
A planned ePrivacy Regulation, proposed in 2017 to replace the directive with a directly applicable law, never reached agreement, and the European Commission announced its withdrawal in 2025. The directive and its national laws therefore remain the governing framework.
Common compliance mistakes
Most violations come from implementation details rather than from missing policies. The table lists recurring failures that regulators and auditors identify.
| Mistake | Why it breaches the rule | Remedy |
|---|---|---|
| Tags fire before consent | Device access precedes consent | Block non-essential scripts until opt-in |
| No reject button on first layer | Refusal harder than acceptance | Offer accept and reject with equal prominence |
| Consent assumed from scrolling | No clear affirmative action | Require an explicit choice |
| Vague purposes | Consent is not informed | Name purposes and vendors specifically |
| Ignoring local storage and SDKs | Article 5(3) is technology neutral | Inventory all device storage and reads |
| No easy withdrawal | Withdrawal must be as easy as consent | Provide a persistent settings link |
A consent management platform helps record choices and block tags, but it does not guarantee compliance on its own. The configuration, the classification of each cookie and regular scans of what the site actually sets remain the operator’s responsibility.
A non-technical view
The ePrivacy Directive treats your phone or computer a little like your home. A website or app may not put things on your device or look at what is stored there unless you agree, or unless it truly needs to in order to give you what you asked for, such as keeping items in a shopping cart.
That is why so many sites show a banner asking about cookies. The banner exists because of this law, and a fair banner lets you say no as easily as yes.
A concrete example
A mid-sized online furniture retailer in Europe audits its website and finds that analytics, advertising and session-replay scripts load on the first page view, before visitors make any choice. The site also uses local storage to keep a marketing identifier, which the team had assumed was outside the cookie rules.
The team installs a consent management platform, places accept all and reject all buttons on the first layer with identical styling, and reconfigures the tag manager so that only the cart, login and load-balancing cookies run by default. The local storage identifier is reclassified as advertising and gated behind consent.
After the change, roughly half of visitors decline tracking, so the analytics team switches to aggregated reporting for the declined share. The result is a site whose device access matches the user’s actual choice, which is the core requirement of Article 5(3).