Amendment 1725· ePrivacy Directive Article 5(3a) (new)

Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a natural person without specific consent, shall be lawful to the extent it is strictly technically and solely necessary for any of the following purpose:

(a)carrying out or facilitating the transmission of an electronic communication over an electronic communications network;

(b)providing an information society service specifically requested by the natural person;

(c)measuring the audience of an information society service explicitly requested by the data subject by creating instantly anonymous aggregated information about the usage of that service, where

(i)it is carried out by the provider of that service, or by a processor acting on behalf of this provider, or by an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083. This provision does not apply to gatekeepers within the meaning of Regulation (EU) 2022/1925;

(ii)it is carried out solely for the provider’s own use and not processed for other purposes;

(iii)the data is not combined with data from other services from the provider service, or from a third party, nor shared with a third party except for third parties referred to in point (i);

(iv)such measurement does not adversely affect the fundamental rights of the natural person; and

(v)the natural person is given a possibility to object;

(d)maintaining or restoring the security, confidentiality, integrity, availability and authenticity of the terminal equipment of the user, by means of updates, for the duration necessary for that purpose of a service provided by the controller and explicitly requested by the user or the terminal equipment used for the provision of such service given that

(i)such interest is not overridden by the interests or fundamental rights and freedoms of the data subject;

(ii)the user is informed about the storing or gaining access and their purpose;

(iii)a genuine choice is given to the user to postpone and decide on the automatic nature of such updates, except in the case of a vulnerability presenting a significant cybersecurity risk; and

(iv)this does not in any way change the functionality of the hardware or software or the privacy settings chosen by the user;

(e)complying with paragraph 4 point c of this Article, without storing personal data including unique identifiers;

5.Member States shall ensure that where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a prominently displayed single-click button;

(b)if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose;

(d)the interface used to request consent shall be presented in a machine-readable format.

6.Member States shall ensure that no user shall be denied access to any information society service or functionality, regardless of whether this service is remunerated or not, on grounds that he or she has not given his or her consent to the processing of personal information and/or the use of processing or storage capabilities of his or her terminal equipment that is not necessary for the provision of that service or functionality.

7.Member States shall ensure that the conditions for giving, refusing or withdrawing consent using automated and machine-readable signals pursuant to Article 88b of Regulation (EU) 2016/679 shall also apply to this Article.

8.This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].