Commonly asked questions on ePrivacy compliance.
What is the ePrivacy Directive?
The ePrivacy Directive (Directive 2002/58/EC) is a set of rules established by the European Union regulating electronic communications, data retention, and the use of cookies and tracking technologies. Often referred to as the "cookie law," it mandates that users must give informed consent before non-essential cookies or trackers are placed on their devices. It is currently in the process of being updated into the more comprehensive ePrivacy Regulation.
How does ePrivacy relate to GDPR?
While the GDPR governs the processing of personal data broadly, the ePrivacy Directive is a specific law (lex specialis) that applies to electronic communications and tracking technologies, regardless of whether personal data is involved. To achieve full compliance, an organization must adhere to both; for example, the standard of valid "consent" required by the ePrivacy Directive is defined by the rigorous requirements of the GDPR.
Do cookies require consent under ePrivacy?
Yes. Under the ePrivacy Directive, all non-essential cookies (such as those used for analytics, marketing, retargeting, and social media) require explicit, prior consent from the user before they can be dropped on a device. Only strictly necessary cookies, those essential for the basic functioning of the website, like shopping cart memory or security tokens, are exempt from this consent requirement.
What communications are covered by ePrivacy rules?
The rules cover nearly all forms of direct electronic marketing communications. This includes email marketing, SMS and text messaging, automated calling systems, and direct messaging on social media platforms. Organizations must generally obtain prior opt-in consent from individuals before sending promotional communications, though some exceptions exist for existing customers (often known as the "soft opt-in").
Do non-EU companies need to comply with ePrivacy?
Yes. If your company is located outside the EU but provides electronic communication services to individuals within the EU, or if you operate a website that drops cookies on the devices of EU-based users, you are subject to the ePrivacy Directive. The extraterritorial scope of these laws means that global digital platforms must adhere to European standards when interacting with European audiences.
%20(1).avif)
.svg)
.svg)
