e-Privacy Directive (2002/58/EC)

Status: Adopted, in force since the 31st of July 2002, with several amendments over time. Applies in all EU Member States.

EUR-Lex-link: The consolidated and most recent version, including other language versions, can be found here.

Full name: Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).

Type: Directive.

Objective and key elements:

• Aims to harmonize the rules on the processing of personal data and ensure privacy in the context of electronic communications within the EU.
• Establishes requirements for confidentiality of communications and the protection of user data in electronic communications networks.
• Introduces rules for the use of cookies and other tracking technologies, requiring user consent before processing data.
• Provides for safeguards against unsolicited communications, such as spam, for direct marketing purposes.
• Ensures security obligations for electronic communication service providers, including data breach notification requirements.
• Sets specific rules for traffic and location data, restricting their use and retention.

Relevant to: Providers of electronic communications services, online service providers, marketers, and organizations involved in the use of cookies or electronic communication technologies within the EU.

(Last updated 28 October 2025)