ePrivacy Directive

The ePrivacy Directive is the source of the EU's cookie consent rule and its rules on electronic marketing. It protects the confidentiality of communications and the information stored on people's devices, and it sits alongside the GDPR: where both apply, the ePrivacy rule is the more specific one.

Because it is a directive, it works through each member state's national law, so details such as enforcement and the soft opt-in vary by country.

• Anyone storing information, or gaining access to information already stored, on a user's device in the EU: cookies, local storage, pixels, fingerprinting, SDKs.
• Anyone sending electronic marketing (email, SMS, automated calls) to people in the EU.
• Providers of publicly available electronic communications services, for confidentiality, traffic and location data rules.
• It applies whether or not the information is personal data.

Users must give consent before non-essential cookies and similar technologies are used, after clear and comprehensive information, and can withdraw it. Recipients of marketing must be able to opt out easily and free of charge in every message.

Set by national law and enforced by national data protection or telecoms authorities. Several authorities have imposed large fines for cookie consent failures, such as reject options that are harder to use than accept.

1. Audit every cookie, pixel, SDK and tag on your sites and apps, and classify each as strictly necessary or not.
2. Block non-essential technologies until consent, and make rejecting as easy as accepting.
3. Record consent and let users change their choice at any time.
4. For email and SMS marketing, get prior consent or rely on the soft opt-in for existing customers where national law allows it.
5. Check national variations in each country you target.