Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Directiva ePrivacy
Directiva sobre privacidad electrónica 2002/58/EC
El origen de las normas de la UE sobre el consentimiento para cookies y el marketing electrónico, junto con el GDPR.
The law in brief
The ePrivacy Directive is the source of the EU's cookie consent rule and its rules on electronic marketing. It protects the confidentiality of communications and the information stored on people's devices, and it sits alongside the GDPR: where both apply, the ePrivacy rule is the more specific one.
Because it is a directive, it works through each member state's national law, so details such as enforcement and the soft opt-in vary by country.
A quién se aplica
- Anyone storing information, or gaining access to information already stored, on a user's device in the EU: cookies, local storage, pixels, fingerprinting, SDKs.
- Anyone sending electronic marketing (email, SMS, automated calls) to people in the EU.
- Providers of publicly available electronic communications services, for confidentiality, traffic and location data rules.
- It applies whether or not the information is personal data.
What it requires
Consent for cookies and device access
Store information or gain access to information on a user's device only with consent given after clear and comprehensive information, unless it is strictly necessary for a service the user explicitly requested or for transmitting a communication.
Consent for electronic marketing
Send electronic marketing to individuals only with prior consent. An existing customer's contact details may be used for similar products and services if they had a chance to object when the details were collected and in every message.
No hidden senders
Do not disguise or conceal the sender's identity in electronic marketing, and give a valid address for opting out.
Traffic and location data
Communications providers must erase or anonymize traffic data when no longer needed, and process location data only when anonymized or with consent.
Derechos de las personas
Users must give consent before non-essential cookies and similar technologies are used, after clear and comprehensive information, and can withdraw it. Recipients of marketing must be able to opt out easily and free of charge in every message.
Enforcement and penalties
La fija la legislación nacional y la aplican las autoridades nacionales de protección de datos o de telecomunicaciones. Varias autoridades han impuesto multas elevadas por fallos en el consentimiento de cookies, como opciones de rechazo más difíciles de usar que las de aceptación.
What's changing
Reform proposed, not adopted. The planned ePrivacy Regulation was withdrawn in 2025. The Commission's Digital Omnibus package, proposed in November 2025, would move the cookie rules for personal data into the GDPR and encourage browser-level consent signals. Until adopted, the directive and national laws apply.
What to do first
- Audit every cookie, pixel, SDK and tag on your sites and apps, and classify each as strictly necessary or not.
- Block non-essential technologies until consent, and make rejecting as easy as accepting.
- Record consent and let users change their choice at any time.
- For email and SMS marketing, get prior consent or rely on the soft opt-in for existing customers where national law allows it.
- Check national variations in each country you target.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
-
noyb ranks EU Parliament MEPs on privacy vs Big Tech in Digital Omnibus reforms
The report highlights how parliamentary amendments could weaken EU privacy law, informing stakeholders of the political forces shaping the Digital Omnibus. noyb analysed over 1,000 amendments to the GDPR and ePrivacy Directive submitted by EU MEPs as part of the Digital Omnibus reform. The analysis shows many MEPs, especially from the EPP, support amendments that would limit privacy protections and create AI data‑use loopholes, while groups like the Greens and S&D push back. The ranking is published on gdpr‑omnibus.eu to help citizens see which representatives defend or undermine privacy rights.
Source: noyb. ePrivacy Directive in the regulations library.
-
noyb ranks EU Parliament members on their stance toward GDPR and ePrivacy amendments
The analysis highlights which EU lawmakers are supporting or undermining current privacy safeguards as the Digital Omnibus reforms progress. noyb analysed over 1,000 amendments to the GDPR and ePrivacy Directive linked to the Digital Omnibus reform, grading each MEP on whether their changes strengthen or weaken privacy protections. The report finds the European People’s Party largely pushes for reduced privacy rights, while S&D, the Greens and the Left tend to defend them.
Source: noyb. ePrivacy Directive in the regulations library.
-
Irish DPC welcomes court conviction of Brown Thomas for ePrivacy breaches
The enforcement action underscores the consequences of non‑compliance with ePrivacy rules for electronic marketing in Ireland. The Dublin Metropolitan District Court convicted Brown Thomas Arnotts Limited on 7 September 2026 for multiple breaches of Regulation 13 of the ePrivacy Regulations. The company pleaded guilty to five sample charges, including failures to provide a valid opt‑out address and sending marketing without valid consent. The court ordered the company to pay €1,000 to a local charity and €1,000 towards DPC legal fees.
Penalty: ordered Brown Thomas Arnotts Limited to pay a charitable donation of €1000 to local charity Little Flower Penny Dinners and €1000 towards the legal fees of the DPC.
Source: Data Protection Commission (Ireland). ePrivacy Directive in the regulations library.
Fuentes
- Directiva 2002/58/EC EUR-Lex · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales