🇪🇺ePrivacy Directive

← Back to laws in European Union

The ePrivacy Directive protects privacy in electronic communications

The ePrivacy Directive is the EU law that particularises privacy rules for the electronic communications sector. While the GDPR is the general personal data law, the ePrivacy Directive deals with communications-specific issues such as confidentiality of communications, traffic data, location data, terminal equipment, cookies, subscriber directories and unsolicited marketing communications.

The Directive applies to the processing of personal data in connection with publicly available electronic communications services in public communications networks. It also protects the legitimate interests of subscribers that are legal persons, which is important because the electronic communications framework is not limited only to individual consumers.

How it fits with the GDPR

The ePrivacy Directive was originally framed to supplement the earlier Data Protection Directive. In modern compliance practice, it is read alongside the GDPR and national laws that implement the Directive. The practical point is simple: GDPR compliance alone does not answer every question about cookies, communications confidentiality, traffic data, location data or electronic marketing.

Where the ePrivacy Directive contains a more specific rule for electronic communications, that specific rule must be considered. Where it does not regulate a point, the general data protection framework continues to apply. This is why cookie banners, email marketing consent, telecom traffic data, and confidentiality of communications need separate analysis instead of being treated as ordinary privacy notice issues.

Confidentiality of communications

The Directive requires Member States to ensure the confidentiality of communications and related traffic data carried over public communications networks and publicly available electronic communications services. Listening, tapping, storage, interception or surveillance by persons other than users is prohibited unless users have consented or the activity is legally authorised under the permitted restriction framework.

This is the core privacy rule for communications. It protects not only the content of communications but also related traffic data. For service providers, this means that network architecture, monitoring tools, logging practices, fraud controls, call recording and business evidence recording must be assessed against confidentiality requirements, not only general data protection principles.

Security of electronic communications services

Providers of publicly available electronic communications services must take appropriate technical and organisational measures to safeguard the security of their services. Where necessary, this should be done in conjunction with the provider of the public communications network. The required level of security must reflect the state of the art, implementation cost and the risk presented.

Where there is a particular risk of a breach of network security, the provider must inform subscribers about the risk. If the risk lies outside the provider's remedial measures, subscribers should also be informed of possible remedies and likely costs. In practical terms, this creates a duty to combine security controls with clear subscriber communication when the network or service presents a specific risk.

Traffic data

Traffic data is data processed for the purpose of conveying a communication on an electronic communications network or for billing. The Directive requires traffic data relating to subscribers and users to be erased or made anonymous when it is no longer needed for transmission, subject to specific exceptions.

Traffic data necessary for subscriber billing and interconnection payments may be processed only up to the end of the period during which the bill may lawfully be challenged or payment pursued. Traffic data may also be processed for marketing electronic communications services or value added services where the subscriber or user has consented, and that consent must be capable of withdrawal at any time.

Location data

The Directive treats location data other than traffic data with particular care. Such data may be processed only when made anonymous, or with the consent of the users or subscribers, and only to the extent and for the duration necessary for the value added service.

Before consent is obtained, users or subscribers must be informed about the type of location data processed, the purposes and duration of processing, and whether the data will be transmitted to a third party for providing the value added service. Even after giving consent, the user or subscriber must have a simple and free means to temporarily refuse location processing for each connection to the network or each transmission of a communication.

Cookies and terminal equipment

Article 5 is also the source of the famous EU cookie rule. It regulates the use of electronic communications networks to store information, or gain access to information already stored, in the terminal equipment of a subscriber or user. The user must be given clear and comprehensive information about the purposes of the processing and must be offered the right to refuse such processing.

The Directive recognises exceptions for technical storage or access whose sole purpose is carrying out or facilitating the transmission of a communication, or where it is strictly necessary to provide an information society service explicitly requested by the subscriber or user. This is why cookie compliance requires classification. A strictly necessary cookie is not assessed in the same way as an advertising, analytics, tracking, personalisation or third-party profiling technology.

Itemised billing and calling line identification

The Directive gives subscribers the right to receive non-itemised bills. This protects the privacy of calling users and called subscribers by reducing unnecessary visibility of communications behaviour. Member States must reconcile the subscriber's billing rights with the privacy of users and called subscribers, including by encouraging privacy-enhancing payment or communications options.

The Directive also regulates calling and connected line identification. Where calling line identification is offered, users and subscribers must be given simple and free means to restrict presentation of the calling line identification. Called subscribers may also have the ability to reject calls where calling line identification has been prevented. These rules show that communications privacy includes control over identifiers, not merely control over message content.

Emergency and nuisance-call exceptions

The Directive permits specific exceptions for tracing malicious or nuisance calls and enabling emergency services to respond effectively. Member States must ensure transparent procedures governing how providers may override the elimination of calling line identification or the denial of consent for location data in such cases.

These exceptions are narrow and purpose-based. They should not be used as a general basis for broader monitoring or routine disclosure. Providers should have clear internal procedures for when and how such overrides are triggered, documented and limited.

Subscriber directories

Subscribers must be informed, free of charge and before inclusion, about the purpose of public printed or electronic directories and any further usage possibilities based on search functions. Subscribers must be able to decide whether their personal data is included in a public directory, and if so, which data is included, to the extent relevant for the directory's purpose.

Verification, correction and withdrawal from public subscriber directories must be free of charge. Where directory data is used for purposes beyond searching contact details by name and minimum identifiers, Member States may require additional consent.

Unsolicited communications and direct marketing

The Directive sets specific rules for direct marketing through automated calling systems without human intervention, fax and electronic mail. These channels may be used for direct marketing only where subscribers have given prior consent. The Directive also recognises a limited soft opt-in for electronic mail where contact details are obtained from customers in the context of a sale of a product or service, the marketing is for the sender's own similar products or services, and the customer is clearly and distinctly given a free and easy opportunity to object when details are collected and in each subsequent message.

Sending electronic mail for direct marketing while disguising or concealing the sender's identity, or without a valid address for opt-out requests, is prohibited. For businesses, this means marketing compliance must check the channel, the source of contact details, the relationship with the recipient, the content of the message, the opt-out mechanism and the sender identity.

Restrictions for public security and law enforcement

The Directive allows Member States to restrict certain rights and obligations where the restriction is necessary, appropriate and proportionate in a democratic society to safeguard national security, defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or unauthorised use of electronic communication systems.

This restriction power is not a general exemption. Measures must fit the stated public-interest grounds and remain subject to general principles of EU law. For regulated providers, this makes it important to distinguish between ordinary commercial access to communications data and legally authorised access under national law.

Why the ePrivacy Directive still matters

The ePrivacy Directive remains central to day-to-day digital compliance because it governs activities that almost every online and communications business touches: cookies, pixels, location services, electronic marketing, traffic data, subscriber choices and communications confidentiality. These issues often arise before a user even submits personal data through a form.

For website operators, app providers, telecom operators, SaaS platforms, adtech businesses, email marketers and connected-service providers, ePrivacy compliance should be reviewed together with GDPR compliance, consent management, tag governance, marketing operations, security processes and incident response.