ePrivacy Directive for Non-EU Companies — Complete Guide

The EU ePrivacy Directive (2002/58/EC), affectionately known as the “Cookie Directive,” regulates electronic communications privacy — covering cookies, direct marketing, and communications confidentiality. For non-EU businesses serving EU users, the ePrivacy Directive applies alongside GDPR, creating a dual compliance framework.

ePrivacy Directive vs GDPR — What’s the Difference?

The ePrivacy Directive is a Directive (transposed into national law by each EU member state), while GDPR is a Regulation (directly applicable). They overlap but are separate legal instruments. Key distinction: ePrivacy covers electronic communications (cookies, email marketing, tracking), while GDPR covers personal data processing broadly. Where both apply, both must be complied with.

Cookie Consent Rules

The ePrivacy Directive requires that websites obtain informed consent before storing or accessing information on a user’s device. This means:

• No cookies before consent: Only strictly necessary cookies (session, authentication, security) are exempt
• Granular consent: Users must be able to accept/reject analytics, marketing, and functional separately
• Prior consent: The cookie wall must appear before any non-essential cookies load
• Easy withdrawal: Withdrawing consent must be as simple as giving it

2025 Digital Omnibus Reforms

In November 2025, the European Commission proposed the Digital Omnibus package, which includes significant changes to the ePrivacy Directive. Key proposals include:

• Simplified cookie consent: Reduced friction for low-risk cookies and analytics
• Replacing the Directive with a Regulation: Creating directly applicable EU-wide ePrivacy rules
• Harmonised enforcement: Aligning ePrivacy enforcement with GDPR’s One-Stop-Shop mechanism
• Updated scope: Covering modern technologies (IoT, messaging apps, tracking pixels)

These reforms are expected to take effect from 2027-2028. In the meantime, the current ePrivacy Directive remains in full force. Cookie consent full guide →

Email Marketing and the ePrivacy Directive

The Directive requires opt-in consent for electronic direct marketing (email, SMS, automated calls) to individuals. The “soft opt-in” exception applies only to existing customers marketing similar products. Non-EU businesses must obtain explicit opt-in consent for marketing emails to EU subscribers. Newsletter marketing guide →

Your Obligations

Installing a Consent Management Platform satisfies ePrivacy requirements but does not satisfy GDPR Article 27’s EU Representative requirement. Both are needed. Get your EU Rep →