ePrivacy requirements
EU rules on confidentiality of electronic communications, cookies and direct marketing, under the ePrivacy Directive as implemented nationally.
Overview
The ePrivacy Directive requires consent for most cookies and similar technologies and for electronic direct marketing, and protects the confidentiality of communications. It works alongside the GDPR and is enforced by national authorities.
As primary legislation it is binding law; regulators fill in and interpret its detail through rules, guidance and supervisory practice. The authorities most closely connected to it are CNIL. It is often read together with GDPR.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Cookie and marketing consent is one of the most enforced areas of EU privacy.
Who it affects
Websites, apps, telecoms providers and marketers.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to ePrivacy requirements. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
ePrivacy consent is mapped to the same consent controls as the GDPR.
Request early access →