ePrivacy

What it means

ePrivacy is the EU Directive on privacy and electronic communications which, alongside the GDPR, governs cookies, the confidentiality of communications and unsolicited commercial messages. In Slovakia it is transposed into the Electronic Communications Act and applies to websites, apps and e-mail marketing.

While the GDPR sets general rules for personal data, ePrivacy is a specific regime for electronic communications. For cookies and marketing messages it takes precedence, so consent is required even where legitimate interest would otherwise suffice under the GDPR.

A proposed ePrivacy Regulation, meant to replace the directive and harmonise the rules across the EU, failed to be adopted for years and was withdrawn by the European Commission. The directive and its national implementations, which differ in detail, therefore still apply.

How it works in practice

Storing cookies and similar technologies on a visitor's device requires prior consent, except for those strictly necessary for the site to work, such as a basket or login. Analytics and advertising cookies may only run after consent through a banner that also offers an equally easy refusal.

Commercial e-mails and texts may only be sent with the recipient's consent. The exception is an existing customer, to whom a company may offer similar products if it gave them a chance to opt out at purchase and offers it in every message. For a newsletter, double opt-in helps.

In e-mail marketing, you must be able to prove when and how the recipient consented, and unsubscribing must be simple and free. Purchased e-mail lists breach the rules because the recipients never consented to that particular company.

What to watch out for

Breaching the cookie and spam rules can lead to fines from supervisory authorities and, where personal data are processed, to GDPR sanctions as well. A common problem is cookie banners that assume consent or make refusal difficult.

The rules also cover technologies similar to cookies, such as pixels, fingerprinting or browser local storage. Changing the technology does not get around consent; what matters is whether information on the user's device is accessed.