ePrivacy Directive.

What the ePrivacy Directive actually governs

The ePrivacy Directive (2002/58/EC, amended by 2009/136/EC) is best known as the "cookie law", but reducing it to cookies misses most of its weight. Its real subject is the confidentiality of electronic communications and the protection of the user's terminal equipment. It says that communications and their associated traffic data are confidential, that interception and surveillance need a legal basis, and that storing or reading information on someone's device, whether that is a cookie, a tracking pixel, a fingerprint, or an SDK, generally requires prior consent. The consent and tracking part is what most teams implement; the confidentiality part is what most teams forget exists.

It is a directive, not a regulation. That distinction is the source of half the confusion in practice. A directive sets the goal and leaves each member state to transpose it into national law, so the exact wording, the consent threshold, and the enforcement style differ from one country to the next. In France the relevant provisions live in the Code des postes et des communications electroniques, and the CNIL publishes its own guidance and recommendations on cookies and trackers. There is no single Union-wide text you can cite the way you cite the GDPR.

ePrivacy next to the GDPR

The two instruments are complementary, not interchangeable. The ePrivacy Directive is lex specialis: where it has a specific rule, that rule prevails over the more general GDPR provision. The clearest example is cookies and device storage. The GDPR governs how you process the personal data you collect; ePrivacy governs the act of accessing or storing information on the device in the first place, and it applies even when no personal data is involved. So a tracker that drops a purely technical identifier still falls under ePrivacy even if you would argue it is not personal data under the GDPR.

Consent under ePrivacy borrows its definition from the GDPR. When ePrivacy requires consent, it must meet the GDPR standard: freely given, specific, informed, unambiguous, and as easy to withdraw as to give. That is why pre-ticked boxes, "by continuing to browse you accept" banners, and cookie walls that offer no real choice keep failing supervisory review. The two texts are read together.

What practitioners actually do

In day-to-day work, ePrivacy compliance is mostly about the consent layer and the inventory behind it. The practical programme looks like this:

• Inventory every cookie, tag, pixel, SDK, and script that reads from or writes to the device, and classify each as strictly necessary or not. Only the strictly necessary ones are exempt from consent.
• Block non-essential trackers until the user has given consent, rather than firing them on page load and asking afterwards. A consent management platform usually enforces this.
• Make refusing as frictionless as accepting, log the consent and its scope, and offer an easy way to withdraw it later.
• Keep the confidentiality obligations in view too: direct marketing by email or SMS generally needs prior opt-in consent, with a narrow exception for existing customers on similar products.

Enforcement is national. Because there is no central EU regulator for ePrivacy, each data protection authority polices its own territory. The CNIL in France, the Garante in Italy, and the AEPD in Spain each issue guidance, run audits, and impose penalties under their national transpositions. That means a pan-European site cannot assume one banner satisfies everyone; the safe approach is to meet the strictest interpretation among the markets you serve and document the choices you made.