Services

ePrivacy Regulation (EU)

The ePrivacy Regulation is meant to replace the existing ePrivacy Directive (the rules behind cookie consent banners) and sits alongside the GDPR, but focused specifically on electronic communications — the confidentiality of messages, metadata, location data, and the use of cookies and similar tracking technologies. It's had a long and genuinely unfinished legislative history, with the proposed Regulation stalled in negotiation for years, which means the practical compliance picture right now is still largely the older ePrivacy Directive as implemented by each EU member state, not a single finalized Regulation.

That matters for how I'd advise you: rather than treating this as one settled standard, I'd be direct that the relevant rules currently in force depend on your specific member-state implementation, your actual data flows, and where the final Regulation's text currently stands — and I'd check that before giving you anything specific, rather than quoting outdated provisions as settled law.

What's actually at stake

For most organizations, this shows up in cookie consent and tracking technology on websites, in how electronic communications data (not just content, but metadata like who contacted whom and when) is handled, and in direct marketing rules for electronic communications. Getting consent and metadata handling wrong here is one of the more common and visible compliance gaps regulators actually act on.

How I'd help

I'd start with a current-state review of your electronic communications data flows and your cookie/tracking consent mechanisms against the rules actually in force for your jurisdiction today, then build toward whatever the finalized Regulation ultimately requires once it's settled — rather than guessing at a moving target now and redoing the work later.

If you need a clear-eyed read on where your organization actually stands on electronic communications privacy, let's talk.