ePrivacy Directive (European Union)
What the ePrivacy Directive covers, and what it means for your website analytics
Official name: Directive 2002/58/EC on privacy and electronic communications, known as the ePrivacy Directive or cookie law. Amended in 2009, it sets the EU rules on storing or accessing information such as cookies on a user’s device.
See all privacy lawsAt a glance
The EU's cookie law
The ePrivacy Directive protects the confidentiality of electronic communications. Its best-known rule, Article 5(3), says you need consent to store information on someone's device or read it from there, unless it's strictly necessary for a service they asked for.
As a directive, it works through each country's own law, such as the TDDDG in Germany. A replacement regulation was withdrawn in 2025, and the EU's Digital Omnibus proposals would change parts of the cookie rules.
Who it covers
Any website or app that stores or reads data on the devices of people in the EU
What it means for websites
Cookies, storage and fingerprinting need consent, unless strictly necessary
Who enforces it
National authorities, which differ from country to country
Maximum fines
Set by each country, and cookie fines in France have passed €100 million
Further reading
Everything you need on this law
The ePrivacy Directive
The full text of Directive 2002/58/EC, including Art. 5(3) on cookies and device access.
Read the official textEDPB guidance on device access
The EU regulators’ 2024 guidelines on what Art. 5(3) covers, including tracking pixels and IP-based tracking.
Read the guidelinesEDPB guidelines on consent
What valid consent means, from cookie banners to cookie walls, when ePrivacy requires it.
Read the guidelinesThe GDPR
The EU law that governs what happens to personal data once it’s collected, including through cookies.
Read our GDPR guidePECR
The UK’s version of the ePrivacy cookie rule, still in force after Brexit and updated in 2025.
Read our PECR guideTWIPLA and ePrivacy
No cookie banner, because nothing touches the device
In Maximum Privacy Mode, TWIPLA neither stores nor reads anything on the visitor’s device, so Art. 5(3) consent isn’t needed:
- No cookies, local storage or session storage are set or read
- No fingerprinting: fonts, plugins and other device properties are never queried
- Only data every browser sends with a page request is used: user agent, language, URL and referrer
- Screen size comes from CSS media queries, not JavaScript, and only as a range
- Heatmaps and recordings use mouse movements, which aren't information stored on the device
TWIPLA's three other privacy modes use fingerprinting, so they do need consent. Already running a banner for other tools? Our second tracking code switches visitors who decline it to Maximum Privacy Mode, so they're still counted.
Proof, not promises
How TWIPLA meets the ePrivacy Directive
GDPR & ePrivacy statement
How each TWIPLA privacy mode handles cookies, device access and consent.
Read the statementConsentless analytics, explained
Why Maximum Privacy Mode needs no consent under Art. 5(3) of the ePrivacy Directive.
Read the legal caseCookieless tracking
How all four privacy modes measure your visitors without setting a single cookie.
See how it worksPrivacy questions, answered
Answers on JavaScript and device access, the points data protection officers raise most.
Read the answersTechnical University of Munich
How TUM removed its cookie banner within the ePrivacy rules and now analyzes visitors it couldn’t see before.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
