GDPR may be the regulation that dominates headlines, but it is not the only piece of EU legislation that affects how websites handle cookies and user data. The ePrivacy Regulation: sometimes called the "cookie law": has been working its way through the European legislative process since 2017 and, once adopted, will introduce specific rules for electronic communications, cookies, tracking technologies and direct marketing that go beyond what GDPR covers. For any business that operates a website in the EU, understanding ePrivacy is not optional: it is essential preparation for what many experts consider the next major shift in European digital privacy law. In this article, we explain the history of ePrivacy, how it differs from GDPR, what the current proposals mean for cookie consent, and the practical steps you should take now to be ready when the regulation finally arrives.

The history of ePrivacy: from directive to regulation

The story of ePrivacy legislation in Europe begins long before GDPR. In 2002, the European Union adopted the ePrivacy Directive (Directive 2002/58/EC), also known as the "Privacy and Electronic Communications Directive." This directive established rules for the processing of personal data in the electronic communications sector, covering areas such as the confidentiality of communications, traffic and location data, calling line identification and unsolicited marketing (spam).

In 2009, the directive was amended by the so-called "Cookie Directive" (Directive 2009/136/EC), which introduced the requirement that websites obtain informed consent before storing or accessing information on a user's device: the legal foundation for the cookie banners we see today. However, because it was a directive (not a regulation), each EU member state implemented it differently. Some countries adopted strict opt-in requirements, others allowed implied consent, and enforcement varied dramatically across the bloc.

This patchwork of national implementations created confusion for businesses operating across borders and inconsistent protection for consumers. To address this, the European Commission proposed in January 2017 to replace the directive with a regulation: the ePrivacy Regulation: which would be directly applicable in all member states without the need for national transposition. The original plan was for the ePrivacy Regulation to come into force on 25 May 2018, alongside GDPR, creating a comprehensive and coherent privacy framework.

That did not happen. The proposal became one of the most contentious pieces of legislation in EU history, with fierce lobbying from the advertising industry, telecommunications companies and publishers on one side, and privacy advocates and consumer organisations on the other. As of early 2026, the regulation is still being negotiated, though significant progress has been made in recent Council sessions.

Directive vs. regulation: why the distinction matters

The difference between an EU directive and an EU regulation is not merely bureaucratic: it has profound practical implications:

  • A directive sets out goals that member states must achieve but leaves it to each country to decide how to implement them in national law. This results in 27 different national implementations, each with its own nuances, enforcement mechanisms and penalties.
  • A regulation is directly applicable in all member states from the date it enters into force. There is no national implementation step. The rules are the same in France, Germany, the Czech Republic and every other EU country.

Currently, the ePrivacy Directive means that the rules on cookies and electronic communications differ from country to country. In France, the CNIL has published detailed guidance and actively enforces cookie consent requirements. In Germany, enforcement has been more fragmented due to the federal structure of data protection authorities. In the Czech Republic, the UOOU has taken a somewhat less aggressive stance. Once the ePrivacy Regulation replaces the directive, all of these national differences will be eliminated: creating a single, harmonised set of rules across the entire EU.

How ePrivacy differs from GDPR

GDPR and ePrivacy are complementary instruments, not alternatives. They cover different (but overlapping) ground:

  • GDPR is a general regulation that applies to all processing of personal data, regardless of the medium. It covers data collected through websites, apps, physical forms, CCTV and any other means.
  • ePrivacy is a sector-specific regulation (lex specialis) that applies specifically to electronic communications. It covers the confidentiality of communications content and metadata, the use of cookies and similar tracking technologies, direct marketing via email and messaging, and the processing of traffic and location data by telecom providers.

In the hierarchy of EU law, ePrivacy takes precedence over GDPR for the matters it specifically addresses. This means that when it comes to cookies, the ePrivacy Regulation: not GDPR: will be the primary legal framework. GDPR will continue to apply to the downstream processing of any personal data collected through cookies, but the rules on when and how consent must be obtained for placing cookies will be governed by ePrivacy.

This distinction is particularly important because it means that ePrivacy can set different (potentially stricter or more permissive) rules for cookies than GDPR does for personal data processing in general. For example, ePrivacy could exempt certain categories of cookies from the consent requirement: something GDPR's broad framework does not easily allow.

What the ePrivacy Regulation will change for cookies

While the final text is still being negotiated, the various proposals and Council positions give a clear picture of the key changes to expect:

1. Browser-level consent settings

One of the most significant proposals is the introduction of consent management at the browser level. Instead of encountering a cookie banner on every website they visit, users would be able to set their cookie preferences once in their browser settings. Websites would then read these preferences and act accordingly. This concept: sometimes called "Do Not Track 2.0" or "Advanced Data Protection Control": would dramatically reduce cookie banner fatigue while giving users genuine, persistent control over their privacy preferences.

However, the devil is in the details. There are unresolved questions about which browsers would implement such settings, how granular the preferences could be (all-or-nothing vs. purpose-by-purpose), and what would happen with browsers that do not implement the feature. Some proposals suggest that browser settings would serve as a valid expression of consent, while others argue they should coexist with website-level banners as a fallback.

2. Cookie walls and "pay or consent" models

The current ePrivacy proposals address the controversial practice of "cookie walls": where a website blocks access to content unless the user accepts all cookies. Under GDPR, the legality of cookie walls has been debated, with some DPAs considering them a violation of the requirement that consent be "freely given." The ePrivacy Regulation may clarify the situation by allowing a form of conditional access under specific circumstances.

The "pay or consent" model: where users are offered a choice between accepting advertising cookies or paying a subscription fee: has been partially endorsed by some DPAs (the Austrian DSB and the French CNIL, for example, have issued guidance suggesting it can be acceptable under certain conditions). The ePrivacy Regulation is expected to provide clearer rules on when such models are permissible, likely requiring that the alternative to consent be reasonable, non-excessive and clearly communicated.

3. Exemptions for first-party analytics

Perhaps the most welcome change for website operators is the proposed exemption for certain categories of cookies from the consent requirement. Under the current proposals, the following types of cookies would not require consent:

  • Cookies strictly necessary for the delivery of a service requested by the user (this is already the case under GDPR)
  • First-party analytics cookies used solely to measure the audience of a website, provided the data is not shared with third parties and is not used for profiling
  • Cookies used to remember a user's preferences (language, accessibility settings, etc.) for the duration of a session
  • Cookies used to detect and prevent fraud or security threats

The first-party analytics exemption is particularly significant. If adopted, it would mean that tools like Google Analytics (when configured as a first-party analytics tool without cross-site tracking) or privacy-focused alternatives like Plausible and Matomo could potentially operate without requiring consent. However, the exact conditions for this exemption are still being debated, and it is likely that analytics data used for any form of user profiling or shared with third parties would still require consent.

4. Rules for tracking technologies beyond cookies

The ePrivacy Regulation is expected to expand its scope beyond traditional cookies to cover all forms of tracking technology, including:

  • Browser fingerprinting
  • Tracking pixels and web beacons
  • Local storage (localStorage, sessionStorage, IndexedDB)
  • Device fingerprinting in mobile apps
  • Ultrasonic cross-device tracking

This is a significant expansion from the current directive, which primarily addresses cookies. Under the new regulation, any technology that stores or accesses information on a user's device would be subject to the same consent requirements: closing a loophole that some companies have exploited by switching from cookies to fingerprinting-based tracking.

5. Direct enforcement and fines

Like GDPR, the ePrivacy Regulation will establish a direct enforcement mechanism with significant financial penalties. The proposed fine structure mirrors GDPR's two-tier system:

  • Lower tier: Up to EUR 10 million or 2% of worldwide annual turnover for less serious violations
  • Upper tier: Up to EUR 20 million or 4% of worldwide annual turnover for the most serious violations, including failure to obtain valid consent for cookies and tracking technologies

This is a major change from the current situation, where the penalties for cookie violations vary dramatically across member states. In some countries, the maximum fine for a cookie breach under the national implementation of the ePrivacy Directive is relatively modest. The regulation will harmonise penalties at GDPR-level amounts, giving DPAs significantly more enforcement power.

The ePrivacy Regulation has been in the legislative process since January 2017. Despite years of negotiations, the final text is expected to be adopted within the next 12-18 months, with a transition period of 24 months after adoption.

The current timeline: when will ePrivacy arrive?

Predicting the exact timeline for the ePrivacy Regulation has proven notoriously difficult. The regulation was originally intended to come into force on 25 May 2018, alongside GDPR. That deadline was missed by years. The European Council adopted its negotiating position in February 2021, and trilogue negotiations between the Council, Parliament and Commission have been ongoing since then.

As of early 2026, the most realistic estimates suggest that the final text could be agreed upon by mid-to-late 2026, with the regulation entering into force after a transition period of 24 months: meaning businesses might need to comply by 2028 or 2029. However, these timelines are subject to change depending on political dynamics, particularly given the composition of the current European Parliament elected in June 2024.

Regardless of when the regulation is formally adopted, many of its key principles are already being implemented in practice through DPA guidance, EDPB opinions and court rulings. The CNIL's cookie enforcement actions, the EDPB's guidelines on consent, and the Court of Justice's Planet49 ruling have all established standards that closely align with the expected ePrivacy Regulation. In other words, if you are already fully compliant with current best practices, the transition to the ePrivacy Regulation should be relatively straightforward.

Impact on different industries

The ePrivacy Regulation will affect different sectors in different ways:

  • Publishers and media: The potential first-party analytics exemption is good news, but stricter rules on advertising cookies and tracking could reduce revenue from programmatic advertising. The "pay or consent" model may become more important as an alternative monetisation strategy.
  • E-commerce: Cart abandonment emails and retargeting will require clearer consent mechanisms. The rules on direct marketing via email will be harmonised across the EU, replacing the current patchwork of national rules.
  • Telecommunications: Telecom providers will face new rules on processing traffic and location metadata. The regulation is expected to allow some metadata processing for network management and security purposes, but marketing use will require consent.
  • Ad tech: The advertising technology industry will be most significantly affected. Stricter consent requirements, the expansion to cover fingerprinting and other tracking methods, and the potential for browser-level consent settings could fundamentally reshape how programmatic advertising works in Europe.

How to prepare now

Even though the ePrivacy Regulation has not been adopted yet, there are concrete steps you can take today to prepare:

  • Ensure full GDPR compliance for cookies. The ePrivacy Regulation will build on GDPR principles, not replace them. If your cookie consent mechanism is already fully GDPR-compliant, you are well positioned for ePrivacy.
  • Implement a flexible consent management platform. Choose a CMP that can be quickly updated when the regulation is adopted. Avoid hard-coded cookie banners that would require development work to modify.
  • Audit all tracking technologies. Map not just cookies but also localStorage usage, tracking pixels, fingerprinting scripts and any other technology that accesses information on the user's device. The ePrivacy Regulation will cover all of these.
  • Review your direct marketing practices. Ensure you have clear consent for email marketing and that your unsubscribe mechanisms work reliably. The regulation will harmonise direct marketing rules across the EU.
  • Consider privacy-first analytics. If the first-party analytics exemption is adopted, using a tool like Plausible or Matomo (in first-party mode) could allow you to collect analytics data without consent. Setting this up now gives you a head start.
  • Monitor legislative developments. Follow the EDPB, your national DPA and trusted privacy law blogs for updates on the regulation's progress.

With Consentio, you will always be in compliance with current legislation: and ready for what comes next. Our platform is designed to adapt quickly to regulatory changes, and we actively monitor the ePrivacy Regulation's progress to ensure our customers are prepared. When the regulation is adopted, we will update our consent mechanisms automatically, so you do not have to worry about missing a deadline or misinterpreting new requirements.