Introduction to the ePrivacy Regulation
The ePrivacy Regulation was a proposal for an EU law on privacy and confidentiality in digital communication. The European Commission presented it in January 2017 to replace the ePrivacy Directive of 2002 with one set of rules that would apply directly in every member state. Parliament and Council never agreed on a text, and the Commission withdrew the proposal in 2025. The ePrivacy Regulation therefore never took effect. Its topics are still governed by the ePrivacy Directive 2002/58/EC and the national laws that implement it, alongside the General Data Protection Regulation (GDPR), which provides general rules for handling personal data.
While the GDPR covers all types of personal data, the ePrivacy rules specifically address challenges posed by digital technologies. Their focus includes the use of cookies, tracking technologies, and protection against unsolicited advertising.
Key ePrivacy rules that apply today
The proposal covered three areas that the ePrivacy Directive already regulates. The rules below are the ones that apply today, under the directive and the national laws based on it.
Protection of electronic communication
A central element of the ePrivacy rules is the protection of communication data. This includes both the content and metadata, such as the time, duration, and location of communication. Providers of communication services may process this data only for limited purposes, such as transmitting the communication and billing, or with the users’ consent.
Cookies and tracking
One of the best-known rules concerns cookies and similar tracking technologies. Under Article 5(3) of the ePrivacy Directive, storing information on a user’s device or reading information from it requires the user’s consent. This includes tracking technologies used for personalized advertising. The only exemptions are storage or access that serves solely to transmit a communication, or that is strictly necessary for a service the user explicitly requested, such as storing a shopping cart.
Spam and direct marketing
The rules also protect users from unsolicited messages. Under Article 13 of the directive, marketing by email, SMS, fax or automated calls generally needs the recipient’s prior consent. A business may email its existing customers about similar products if it offers an easy way to opt out with every message. Rules for live phone calls are set by each member state.
How the ePrivacy rules differ from the GDPR
Although both sets of rules protect privacy, they differ in their application:
- Focus: The GDPR governs general data protection, while the ePrivacy rules specifically address electronic communication and the user’s device.
- Consent: The GDPR allows several legal bases for processing personal data, and consent is only one of them. For storing or reading information on a device, the ePrivacy rules require consent unless an exemption applies, even when the information is not personal data.
- Technological impact: The ePrivacy rules apply to any technology that stores or reads information on a device, including tracking tools and captchas. Going cookie-free does not take a tool out of these rules, because reading device data counts too. TrustCaptcha sets no cookies and reads only the device data its security check needs, which is the kind of access the exemption for strictly necessary services is meant for. Whether it covers your setup is a question for your data protection officer.
Impact on businesses and users
The ePrivacy rules affect companies and users in different ways.
Challenges for businesses
Businesses, particularly website operators and digital advertisers, have had to change how they work. Cookie banners and consent management systems are only part of the solution. Tracking based on third-party data needs consent, which complicates personalized advertising.
Security measures like captchas are also under scrutiny. Services like reCAPTCHA and hCaptcha set cookies and may process data outside the EU, which can pose legal risks. Cookie-free alternatives that process data in EU data centers avoid part of that risk.
Benefits for consumers
For consumers, the ePrivacy rules offer greater control over their personal data. They can decide which information to share and are better protected against unsolicited advertising.
Technological and legal requirements
Cookie management and tracking
Under the ePrivacy rules, users have to give clear, informed consent before non-essential cookies are used. That is why many companies use consent management platforms to collect and record consent.
Captchas and data protection
Captchas protect websites against spam and automated attacks. Traditional services like reCAPTCHA have been criticized for transferring data to third parties and using cookies. TrustCaptcha is a GDPR-compliant CAPTCHA that sets no cookies and does no tracking, so there is one less cookie to cover in the consent banner and the privacy policy.
Direct marketing
In direct marketing, the ePrivacy rules generally require prior consent for email and SMS campaigns. Existing customers may be contacted about similar products only with a clear opt-out in every message. Companies ignoring these requirements risk fines under national law.
Status and future developments
The Commission proposed the ePrivacy Regulation in January 2017, but Parliament and Council did not reach an agreement. In its work programme of 11 February 2025, the Commission listed the proposal for withdrawal because no agreement was expected and the text had become outdated. It decided the withdrawal on 16 July 2025, and the withdrawal was published in the Official Journal on 6 October 2025.
What applies today is the ePrivacy Directive 2002/58/EC, as each member state has written it into national law. In Germany, the cookie rule is § 25 TDDDG. In France, it is Article 82 of the French Data Protection Act (Loi Informatique et Libertés), which the CNIL explains in its guidelines on cookies and other trackers. The GDPR applies in addition whenever personal data is processed.
In November 2025, the Commission proposed a “Digital Omnibus” (COM(2025) 837) that would, among other changes, move the cookie rules for personal data into the GDPR. It is a proposal in the legislative procedure and does not change the rules described here until it is adopted. Companies that already use cookie-free tools will have less to change, whatever the final rules look like.
Conclusion
The EU ePrivacy Regulation never took effect: the Commission withdrew the proposal in 2025. Its topics remain governed by the ePrivacy Directive and the national laws based on it, which apply alongside the GDPR. For businesses, the practical questions stay the same: cookies, tracking and direct marketing.
Cookie-free tools such as TrustCaptcha take one item off that list, because spam and bot protection then needs no cookie of its own. This overview of the rules is general and not legal advice; for your own website, ask your data protection officer.
