← Global Privacy Laws Research Library
Directive 2002/58/EC concerning the processing of personal data and protection of privacy in the electronic communications sector
ePrivacy Directive: Directive 2002/58/EC: European Union
Prepared by Shubhank Suman · Last reviewed
In force
- Legal character
- EU Directive
- Region
- Europe
- Adopted
- 12 July 2002
What it covers
The ePrivacy Directive is the EU's sector-specific privacy framework for electronic communications.
It regulates:
- confidentiality of communications
- traffic data
- location data
- communications security
- caller/connected-line identification
- directories
- unsolicited electronic communications
- access to or storage of information on terminal equipment.
EUR-Lex maintains Directive 2002/58/EC as the relevant ePrivacy Directive (EUR-Lex)
Why it matters
It is frequently misunderstood as a substitute for GDPR.
It is not.
The correct relationship is broadly:
GDPR = general personal-data framework
ePrivacy Directive = specific electronic-communications/privacy layer
This distinction becomes particularly important for cookies and other tracking technologies.
Refer to it when
- Implementing cookies
- evaluating tracking technologies
- analysing terminal-equipment access
- electronic marketing
- telecommunications
- traffic/location data
- communications confidentiality
- electronic communications security.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: High
AI
Low/Moderate.
The Directive is not an AI instrument.
It becomes relevant when AI-enabled communications or tracking technologies involve:
- terminal-device data
- communications metadata
- electronic marketing
- location information.
Cybersecurity
High.
Article 4 is directly focused on electronic-communications security.
Applicability
Implemented through Member-State law and directed at covered electronic communications networks/services and related processing.
Current validity
CURRENT AND IN FORCE.
The EU has considered broader ePrivacy reform, but the proposed ePrivacy Regulation was never adopted; the Directive remains the operative text.
Read first
Article 4 → Article 5 → Article 5(3) → Article 6 → Article 9 → Article 13 → Article 15.
Provisions / sections covered
Article 4: Security
Electronic communications service providers must implement appropriate technical and organisational security measures proportionate to the risk. They must inform subscribers of particular security risks in specified circumstances (EUR-Lex)
Article 5: Confidentiality
Protects the confidentiality of communications and associated traffic data.
Article 5(3) is especially important for websites because it regulates storing information in or accessing information from a user's terminal equipment. It requires clear information and the right to refuse such processing, subject to specified exceptions for technically necessary communications/service functions (EUR-Lex)
Article 6: Traffic data
Traffic data must generally be erased or anonymised when no longer necessary for transmission, subject to specified exceptions (EUR-Lex)
Article 9: Location data
Non-traffic location data may generally be processed only where anonymised or with consent, subject to specified value-added-service conditions (EUR-Lex)
Article 13: Unsolicited communications
Regulates electronic direct marketing, including automated calls, fax and email.
Prior consent is generally required for automated calling systems, fax and email marketing, subject to the existing-customer exception and national implementation details (EUR-Lex)
Article 15: Restrictions
Allows Member States to restrict certain rights/obligations for specified purposes such as national security, defence, public security and criminal-law enforcement, subject to necessity/proportionality conditions (EUR-Lex)
Subject-matter tags
- Consent
- Security
- Cross-border transfers
- Direct marketing
- Cookies and tracking
- Enforcement and penalties
- Anonymisation
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.