ePrivacy Directive (the EU 'cookie law')

The ePrivacy Directive (Directive 2002/58/EC of 12 July 2002) covers the processing of personal data and the protection of privacy in the electronic communications sector. Its provisions "particularise and complement" the EU's general data-protection rules for that sector.

The cookie rule — Article 5(3). EU countries must ensure that storing information on a user's device, or gaining access to information already stored there, is only allowed if the user has given consent after being given clear and comprehensive information about the purposes. The rule names no specific technology, so it reaches cookies and anything else a site stores in a browser.

The exceptions. Consent is not needed for technical storage or access whose sole purpose is carrying out the transmission of a communication over an electronic communications network, or that is strictly necessary for a service the user has explicitly requested.

The 2009 amendment. Directive 2009/136/EC of 25 November 2009 amended the ePrivacy Directive, including Article 5(3). Before the change, users had an option to opt out of cookie storage; afterwards, consent had to be obtained.

Marketing messages. Article 13 allows automated calling machines, fax and email to be used for direct marketing only to subscribers or users who have given prior consent, with a limited exception for a company's existing customers.

A replacement that did not arrive. In January 2017 the Commission proposed an ePrivacy Regulation that would have repealed this directive. The European Parliament's Legislative Observatory records that proposal as withdrawn by the Commission in October 2025, so the directive remains the rule.