ePrivacy Directive

What is the ePrivacy Directive?

The ePrivacy Directive (Directive 2002/58/EC, adopted on 12 July 2002) is the EU law behind cookie banners. It works alongside the GDPR, adding specific rules for electronic communications, and it also protects companies as subscribers, not only individuals.

Two of its rules reach almost every SaaS company:

• Article 5(3), cookies and similar tools: storing information on a user's device, or reading information already there, needs the user's consent after clear and comprehensive information. The exceptions are storage needed only to carry a communication, and storage strictly necessary for a service the user explicitly asked for.
• Article 13, electronic marketing: marketing emails, faxes and automated calls to individuals need prior consent. The exception covers your own customers: you may email them about your own similar products if you got the address in a sale and offered a free, easy way to object then and in every message.

Consent has to be real. In the Planet49 case (C-673/17, 1 October 2019), the EU Court of Justice ruled that a pre-checked box is not valid consent, that the rule applies whether or not the stored information is personal data, and that users must be told how long cookies last and whether third parties can access them. The original 2002 text only gave a right to refuse; Directive 2009/136/EC replaced that with consent.

The rule is not limited to cookies. The EDPB's guidelines on its technical scope, adopted in final form on 7 October 2024, analyze techniques such as tracking pixels, tracking based only on IP address and unique identifiers.

A directive works through each EU country's own law, so details and enforcers vary. France, for example, applies the cookie rule through Article 82 of its Data Protection Act. The UK has its own version, PECR, which sits alongside the UK GDPR. The Data (Use and Access) Act 2025 changed it so that some cookies, such as those for statistics or site functionality, can be set without consent.

Where reform stands

An ePrivacy Regulation meant to replace the directive was proposed in January 2017; the Commission withdrew it in 2025. On 19 November 2025 it proposed a Digital Omnibus that would move the cookie rules for personal data into the GDPR, require a single-click refuse button and drop consent for low-risk uses such as counting visits. On 21 October 2026 the Council of the EU agreed its position, which would keep the cookie rules in the directive and add consent-free purposes such as audience measurement and device security. The European Parliament had not adopted its position as of October 2026, so the directive still applies.

What it looks like in a vendor's terms

Vendors whose scripts run on your website or app often put the consent duty on you. A typical clause reads like this:

Customer is responsible for providing all notices and obtaining all consents required under applicable law, including the ePrivacy Directive and its national implementations, for cookies and similar technologies deployed through the Service on Customer's websites and apps.

• "Customer is responsible": the vendor's code runs on your site, but your banner has to cover it.
• "Similar technologies": pixels and device identifiers, not only cookies.
• "Deployed through the Service": when the vendor adds a cookie, your cookie policy can fall out of date without you changing anything.

A real change we caught

Venpo flagged that Google now says personalized ads may continue after you reject cookies. Cookie policies also change what your choices do.

Why it matters to you

Every tag, pixel or SDK you add to your site or app can trigger the consent rule. Enforcement is national; the GDPR's one-stop-shop, which routes cross-border cases to one lead regulator, does not apply. In September 2025 France's regulator, the CNIL, fined Google 325 million euros over ads inserted between Gmail emails and over advertising cookies set at account creation.

What to check

• Inventory: Every cookie, pixel and SDK on your site and in your app, and which vendor sets it, including third-party cookies.
• Banner: No pre-checked boxes, and it tells users how long cookies last and whether third parties can access them.
• "Strictly necessary" labels: A vendor calling its cookie necessary does not make it so. Test it against the exception.
• Marketing email: Consent, or the existing-customer exception with an opt-out in every message.
• Vendor changes: Re-check your banner when a vendor's cookie policy changes.

How Venpo helps

Venpo watches your vendors' cookie policies, privacy policies and other public legal pages and emails a plain-English alert when one changes. When a vendor adds a tracking cookie or changes what rejecting cookies does, the alert says what changed and why it matters, so you can update your own banner and cookie policy.