ePrivacy Regulation

The ePrivacy Regulation (ePR) is a proposal for a Regulation on Privacy and Electronic Communications. Its full name is "Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)." It would repeal the Privacy and Electronic Communications Directive 2002 (ePrivacy Directive) and is lex specialis to the General Data Protection Regulation. It would particularise and complement the latter on the electronic communications data that qualify as personal data like the requirements for consent to the use of cookies and opt-outs.

The scope of the ePrivacy Regulation would apply to any business that provides any form of online communication service, uses online tracking technologies, or engages in electronic direct marketing.

The penalties for noncompliance are up to €20 million or, in the case of an undertaking, up to 4% of the total worldwide annual turnover, whichever is higher. It was intended to come in effect on 25 May 2018, but now somewhere in 2019.