Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive

What it covers

These guidelines analyse the technical scope of Article 5(3) of the ePrivacy Directive, identifying the three key elements for its applicability - information, terminal equipment, and storage or gaining access - and applying that analysis to specific tracking use cases including URL and pixel tracking, local processing, IP-only tracking, IoT reporting, and unique identifiers.

Why it matters

It updates and extends the WP29's device fingerprinting opinion to modern tracking techniques, helping organisations determine when consent is required under the ePrivacy Directive for technologies that replace or supplement cookies.

Refer to it when

• assessing whether a new tracking technology falls within Article 5(3) ePD
• evaluating consent requirements for pixel or URL tracking
• determining whether IP-only or IoT-based tracking requires consent
• designing cookieless tracking solutions

Questions this document addresses

• What are the three key elements for Article 5(3) ePD to apply?
• Does the notion of 'information' under Article 5(3) require personal data?
• Does IP-only tracking fall within the scope of Article 5(3)?
• How does Article 5(3) apply to unique identifiers and IoT reporting?

Topics

• ePrivacy
• Cookies & tracking
• Consent