What is the ePrivacy Directive?
The ePrivacy Directive (Directive 2002/58/EC), also known as the “cookie law” after its 2009 amendment, is the EU’s sectoral privacy law for electronic communications: covering confidentiality of communications, traffic and location data, cookies/tracking, and unsolicited commercial communications. ePrivacy operates as lex specialis to GDPR for electronic communications: where ePrivacy and GDPR overlap, ePrivacy rules govern. The ePrivacy Regulation proposed in 2017 to replace the Directive was withdrawn by the European Commission in 2025 (withdrawal published in the Official Journal on 6 October 2025), so the Directive and national implementing laws remain the applicable framework.
Key ePrivacy obligations
- Article 5(3): cookie consent: any storage of information on user’s terminal equipment (cookies, local storage, fingerprinting) requires prior informed consent: except strictly necessary cookies.
- Article 6-9: traffic and location data: deletion or anonymisation when no longer needed; processing for billing limited.
- Article 13: unsolicited communications: opt-in for email, SMS marketing to individuals; soft opt-in for existing customers.
- National transposition variance: implementation differs across member states (German TDDDG, formerly TTDSG; French Article 82 of the Loi Informatique et Libertés; etc.): pan-EU compliance is fragmented.
Cookie banner enforcement evolution
- 2018-2020: wide non-compliance; cookie walls and pre-ticked boxes common.
- EDPB Guidelines 5/2020: clarified consent must be unambiguous, granular, easy to withdraw.
- 2021-2024: NOYB campaigns, large fines (Google, Facebook in France for €60-150M each).
- Dark pattern crackdown: EDPB Guidelines 3/2022 on dark patterns; equal prominence for “reject all” required.
ePrivacy in the product stack
The ePrivacy Directive is why cookie banners exist, and its logic outlived its age: confidentiality of communications and terminal-equipment rules require consent for storing or reading non-essential identifiers, alongside marketing-communication consent rules. It operates as lex specialis next to GDPR: the cookie consent travels under ePrivacy, the subsequent processing under GDPR. For Turkish companies the same architecture arrives twice: through EU users (Directive-implementing national laws apply territorially) and through the domestic mirror: KVKK’s cookie guidance and the E-Commerce Law/İYS regime for commercial messages reproduce the consent-first structure. Build one consent-management layer satisfying the stricter reading: granular categories, prior consent for tracking, evidence logs, and parity between the banner’s promises and the tags actually firing.
Sources. Regulation (EU) 2016/679 (GDPR).