European Union. ePrivacy / marketing. Directive (EU)
ePrivacy DirectiveDirective 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive)
§1Summary
- Synopsis
Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).
- Key themes
- Unique features
Art 5(3) applies to any information stored on terminal equipment, personal or not, which is why the EU has cookie banners. Each member state enforces it differently.
- SaaS relevance
Any SaaS website or app that sets non-essential cookies or SDKs on EU users' devices, or sends marketing emails, must comply.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Telecoms providers: authority within 24h under Reg 611/2013
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Set by national law
§3Dates
- Key dates
- Adopted
- In force
- Amended by Directive 2006/24/EC (Data Retention, annulled 2014) and Directive 2009/136/EC (cookie consent; transposition 2011-05-25). The proposed ePrivacy Regulation COM(2017) 10 was abandoned: the Commission announced withdrawal in its 2025 work programme (2025-02-11). The Digital Omnibus proposes amending Art 5(3) cookie rules (pending).
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- National telecoms regulators and/or data protection authorities (varies by member state)
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
I did not confirm the Official Journal publication of the formal withdrawal of the ePrivacy Regulation. The Council's Oct 2026 Omnibus draft keeps cookie rules in Art 5(3) with six consent exemptions.