ePrivacy Directive (cookie law)
Amended European Union · In force Jul 31, 2002 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Requires prior consent to store or access information on a user's device (cookies, SDKs, fingerprinting), except where strictly necessary. Also covers confidentiality of communications, traffic and location data, and unsolicited direct marketing (opt-in for email/SMS to individuals). Telecom providers must notify personal data breaches. Enforced through national laws.
- Who it applies to
- Any entity storing or accessing information on users' terminal equipment in the EU (websites, apps, ad tech), senders of electronic direct marketing, and providers of publicly available electronic communications services.
- Penalties
- Set by national transposing laws; many Member States let DPAs apply GDPR-level fines. Amounts vary by country.
- Enforced by
- National data protection authorities and/or telecom regulators, depending on the Member State
- Official name
- Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive), as amended by Directive 2009/136/EC
- Citation
- OJ L 201, 31.7.2002, p. 37
- Topics
- privacy, breach-notification
Research notes
The proposed ePrivacy Regulation (2017) was withdrawn by the Commission in 2025. The Digital Omnibus proposal COM(2025) 837 would move consent rules for personal data on terminal equipment into the GDPR (new Art 88a/88b, incl. browser-level preference signals). As of the 1 Aug 2026 Legislative Train update it is still under negotiation, and Council drafts reportedly drop some of the cookie provisions. Status 'amended' reflects the pending amendment.
Related
Questions about ePrivacy Directive (cookie law)
- What are the ePrivacy Directive (cookie law) compliance deadlines?
- Jul 31, 2002: ePrivacy Directive enters into force. Oct 31, 2003: Original transposition deadline. May 25, 2011: Cookie consent amendment transposition deadline.
- When does ePrivacy Directive (cookie law) take effect?
- ePrivacy Directive (cookie law) took effect on Jul 31, 2002.
- Who does ePrivacy Directive (cookie law) apply to?
- Any entity storing or accessing information on users' terminal equipment in the EU (websites, apps, ad tech), senders of electronic direct marketing, and providers of publicly available electronic communications services.
- What are the penalties under ePrivacy Directive (cookie law)?
- Set by national transposing laws; many Member States let DPAs apply GDPR-level fines. Amounts vary by country.