ePrivacy Directive, cookie consent and compliance
The ePrivacy Directive (ePD) is a European data privacy and protection directive that regulates cookie use, data minimization and email marketing. The ePrivacy Directive is informally referred to as the “cookie law” – and that’s where you need to be compliant.
What your business needs to know about the ePrivacy Directive
The ePrivacy Directive is a set of rules that address data privacy and protection in the European Union. Much like GDPR, which also governs data privacy protection for European citizens, the directive requires user consent before cookies can be used.
The GDPR extends this by defining cookies as a way to obtain personal data (which – again – requires explicit, unambiguous and informed consent). Unlike a regulation such as the GDPR, the ePrivacy Directive does not apply directly: it is binding on EU member states, which implement it through their own national laws on data privacy and electronic communications.
What does ePrivacy Directive compliance require?
First of all, the ePrivacy Directive does not apply directly to businesses. It is binding on EU member states, which must transpose it into their own national laws, and it is those national laws that businesses must comply with. An example here is France’s CNIL, the data privacy regulator, which has been aggressive about pursuing and fining violators of data privacy regulations.
Organizations that adhere to GDPR should be on the right side of safeguarding user privacy, but it is important to note that the ePD aims to:
Prevent unlawful data capture and interactions:
Do not intercept, store, monitor, scan or surveil electronic communications unless the users concerned have consented.
Track only with explicit consent:
Only use cookies and similar tracking technologies for non-essential purposes after the user has given explicit, specific consent.
Get consent for data access:
Only access information stored on a user’s device with their consent, unless it is strictly necessary for the service they requested.
Prevent unsolicited communication:
Do not send unsolicited emails, texts, automated calls or other electronic communications (“spam”) to people who have not agreed to receive them.
Avoid unconsented processing of metadata:
Only process metadata from electronic communications, such as location data or recipient data, with the user’s consent or another legal right to do so.
Who needs to comply with the ePrivacy Directive?
The directive is applicable to any organization that processes personal data from EU residents or provides digital communications services. This could include:
Any business (worldwide) that processes personal data of EU residents, engaged in digital marketing, cookie-based tracking, or any other tracking methods to collect personal data of users
Third parties using tracking technologies
Website owners and operators who use tracking technologies
Communications service providers, such as internet companies, telephone operating companies, and so on, which enable personal data collection
Consumer rights under the ePrivacy Directive
The ePrivacy Directive, intersecting as it does with the GDPR, confers a number of similar data privacy rights to consumers, including:
Right to information
Consumers can expect to be informed about what data is collected, why and by whom, typically in the form of cookie banners and privacy notices
Right to consent
Consumers must give informed and explicit consent before any non-essential cookies or similar tracking technologies are used
Right to withdraw consent
Consumers may refuse or withdraw consent at any time
Right to privacy in communications
Consumers are entitled to confidentiality of communications, including protection against interception or surveillance of communication or unauthorized data retention
Right to control device storage and access
Consumers have control over any attempt to store information or access information on their devices, such as cookies, local storage or tracking pixels
Right to protection against unsolicited communication
Consumers have the right not to receive unsolicited marketing communications, such as emails, SMS, etc.
Why cookies as part of ePrivacy Directive compliance
Dubbed the “cookie law”, the ePrivacy Directive is one of the main reasons cookie banners appear on most websites, prompting users to consent to opting in or out of cookie use. The directive requires that websites get user consent before storing cookies in a user’s browser unless for strictly functional cookies that are required for the website to work. This consent-gathering practice also requires that users be informed of the cookies’ purpose(s) before consenting to their use.
Penalties for ePrivacy Directive non-compliance
Penalties for violating parts of the ePD are indirect in that they are imposed by the data protection regulators of each EU member state. Many fines have been issued for cookie consent breaches. The fines issued mirror those of the GDPR, and individuals adversely affected by violations have the right to compensation from the offending organization.
How to comply with the ePrivacy Directive
Review data practices:
Review which cookies, trackers and third-party services your website uses and why, and document the purpose of each
Respect user consent rights to choose and withdraw:
Obtain explicit, prior consent for non-essential cookies and tracking, give users the ability to make granular choices about accepting and rejecting cookies, and let them withdraw consent at any time
Provide accessible information:
Explain what data is being collected, how it will be used and shared, and with whom
Ensure partner and third-party compliance:
Check that third parties and partners are also compliant with the directive
How CookieHub can help with ePrivacy compliance
As a consent management platform that ensures GDPR compliance, CookieHub helps you align with the ePrivacy Directive’s requirements for consent and cookie management. Website owners around the world rely on CookieHub to uncover hidden website cookies and trackers and to ensure compliance.
Frequently Asked Questions
The ePrivacy Directive (also known as the "Cookie Law") governs the processing of personal data and the protection of privacy in electronic communications. It covers areas such as confidentiality, tracking technologies (like cookies), unsolicited communications (spam), and data retention by telecom providers. It applies to businesses offering electronic communication services within the EU.
Personal data refers to any information that can identify an individual, either directly or indirectly. This includes names, email addresses, IP addresses, phone numbers, and even online identifiers that can be traced back to a person.
While the ePD itself doesn't define "sensitive data" explicitly, it complements the General Data Protection Regulation (GDPR), which defines sensitive data as information revealing racial or ethnic origin, political opinions, religious beliefs, health status, sexual orientation, and more. If such data is processed via electronic communications, the ePD’s provisions may also apply.
Each EU member state enforces the ePD through its national Data Protection Authority (DPA). These authorities monitor compliance, handle complaints, and may impose sanctions. The European Data Protection Board (EDPB) provides guidance and coordination across the EU.
Some exceptions apply, such as when cookies are strictly necessary for providing a service explicitly requested by the user (e.g., items in a shopping cart). Law enforcement or national security activities may also be exempt from certain provisions.
You can find official information on the European Commission’s ePrivacy Directive page, or consult your national Data Protection Authority’s website for localized guidance.
Last updated:
Disclaimer: The information provided on this page is for general reference purposes only and is not intended to constitute legal or regulatory advice. Data privacy regulations are complex and subject to frequent updates, interpretations, and jurisdictional variations. While efforts are made to keep the material accurate and up to date, we cannot guarantee its completeness or applicability to your specific circumstances. For guidance on compliance or legal obligations, please consult qualified legal professionals or the appropriate regulatory authorities.
