ePrivacy

Who it applies to

Providers of publicly available electronic communications services, and any website or app operator that stores or reads information on a user's device or sends electronic marketing.

Key requirements

• Prior consent before storing or accessing information on a user's device (cookies and similar technologies), unless strictly necessary for the service requested.
• Confidentiality of communications: no interception or surveillance without consent or legal authority.
• Limits on processing traffic and location data.
• Consent (with some exceptions for existing customers) for unsolicited electronic marketing.
• Security of services and personal data breach notification duties for communications providers.

Breach and incident notification

Providers of publicly available electronic communications services notify the competent national authority of personal data breaches, and subscribers where they are likely to be adversely affected. The timing is set in EU implementing rules and national law.

Penalties

Set by each Member State in its national implementing law.

Go deeper