EDPB Guidelines Clarify Scope of EU “Cookie” Notice and Consent Requirements

The European Data Protection Board (EDPB) has recently published Guidelines 2/2023 to clarify the scope of the EU “cookie” notice and consent requirements. These guidelines aim to provide clarity on what tracking technologies fall within the technical scope of the ePrivacy Directive, beyond just cookies.

Article 5(3) of the ePrivacy Directive is well-known for establishing the cookie notice and consent requirements in the EU. However, it also applies to other tracking technologies. The EDPB’s analysis of the various components of Article 5(3) includes information, terminal equipment, electronic communications network, gaining access, and stored information and storage.

The EDPB clarifies that the notion of information includes both non-personal and personal data, regardless of how it is stored. It also states that the ePrivacy Directive may apply to devices used by multiple users and provides examples of terminal equipment such as smartphones, laptops, connected cars, connected TVs, and smart glasses.

Furthermore, the EDPB emphasizes that the requirement for gaining access is independent of storing information, and both are not necessary for Article 5(3) to be applicable. The guidelines also specify that tracking pixels, tracking links, device fingerprinting techniques, local processing, IoT reporting, and IP tracking are all covered by Article 5(3).

The Guidelines are currently open for public consultation until December 28, 2023. For more information, you can read the Guidelines and the press release on the EDPB’s website. Stay informed on the latest developments in data protection and privacy regulations in the EU.