ePrivacy· Article 5
Text
Article 5 ePrivacy as printed in the Council text of 22 October 2026
Confidentiality of the communications
Source Council, 22 October 2026. Article 5: ST 14756/26, page 156 · pp. 156–158 · exact text page
Article 5(3)
Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679.
Storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user without consent, and subsequent processing of personal data for the same purpose, shall be lawful to the extent it is solely related to and strictly necessary for the following purposes:
Article 5(3)(a)
carrying out the transmission of an electronic communication over an electronic communications network;
Article 5(3)(b)
providing a service, including its functionality, explicitly requested by the subscriber or user;
Article 5(3)(c)
Creating anonymous aggregated information about the usage of an online service to measure the audience of that service, provided that it is carried out by the provider of the service requested by the subscriber or user, or by a third party on behalf of that provider, and the data collected for the purpose of aggregating the information are not processed for another purpose, shared with third parties or combined with data from third parties;
Article 5(3)(d)
performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083, provided that personal data are pseudonymised after collection and not processed for another purpose, that the processing of personal data does not involve tracking the activity of the subscriber or user outside of the service or the media content to be measured, and that any information shared with third parties other than those acting either on behalf of or jointly together with that provider does not contain personal data;
Article 5(3)(e)
maintaining or restoring the technical security of the means strictly necessary for the provision of a service requested by the subscriber or user or the technical security of the terminal equipment used for the provision of such service;
Article 5(3)(f)
measuring the display and performance of advertising that is based solely on the immediate content displayed on a subscriber or user’s online interface during an individual visit or on the basis of a single search query and that does not involve the processing of personal data, where such measurement is carried out by the provider of an online service, including jointly with others, or on behalf of that provider. Such measurement shall not involve profiling or processing of data relating to the subscriber or user’s past or future activity, including activity across sites or services. Data collected for such measurement shall be pseudonymised after collection and shall not be processed for another purpose.
Article 5(3), consent cadence
The subscriber or user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means. If the subscriber or user gives consent, the provider shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the subscriber or user. If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least four months.
How the provision changed
Each text against the law in forceEach text against the text before it
| What each text would do to the law in force | |||||||
|---|---|---|---|---|---|---|---|
| Element | Commission19 Nov 2025Art 5 | Council21 May 2026Art 5 | Council10 Jun 2026Art 5 | Council18 Jun 2026Art 5 | Council3 Sep 2026Art 5 | Council2 Oct 2026Art 5 | Council22 Oct 2026Art 5 |
| Compared with | law in force | the proposal | 21 May text | 10 Jun text | 18 Jun text | 3 Sep text | 2 Oct text |
| Rule on storing and accessing information in terminal equipment | 5(3), additional subparagraph Adds Added | 5(3), additional subparagraph Adds, replaced since the proposal Replaced The Commission subparagraph disapplies paragraph 3 where the subscriber or user is a natural person and personal data are processed. From 21 May the Council text sets out the consent rule and the purposes for which consent is not required. | 5(3), additional subparagraph Adds, changed since 21 May Changed | 5(3), additional subparagraph Adds, changed since 10 Jun Changed | 5(3), additional subparagraph Adds, changed since 18 Jun Changed | 5(3) Adds, changed since 3 Sep Changed | 5(3) Adds Unchanged |
Each text against the law in force: +Adds adds a provision the law in force lacks changed from the text before
Each text against the text before it: +Added in this text, not in the text before~Changed wording changed↺Replaced a different mechanism takes its place=Unchanged same as the text before
Council text of 21 May 2026 · ST 9547/26 ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.
Parliament amendments
12 amendments to this article
4 would delete the wording, 7 propose alternative wording and 1 would add wording.
| Type | The Left | S&D | Greens/EFA | EPP | ECR | PfE | NI |
|---|---|---|---|---|---|---|---|
| − Deletion | · | 1 | · | 1 | 1 | 1 | 1 |
| ~ Alternative | 1 | 1 | 1 | 1 | 3 | · | · |
| + Addition | · | · | 1 | · | · | · | · |
By political group
- − Deletion S&D 1 EPP 1 ECR 1 PfE 1 NI 1
- ~ Alternative The Left 1 S&D 1 Greens/EFA 1 EPP 1 ECR 3
- + Addition Greens/EFA 1
Show
Paragraph (3)11 amendments
499 ~Alternative Piotr MüllerECR · IMCO “of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent…”
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the user and improving functionality of the requested service; (c) measuring and displaying advertising which is not selected on the basis of any user profiling; (d) measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, or by an entitled and independent third party performing audience measurement in accordance with Article 24(1) of Regulation (EU) 2024/1083; (e) maintaining, or restoring, or ensuring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service, including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access; Paragraph (3) letters (b), (c) and (d) shall not apply to data controllers designated as gatekeepers under Regulation (EU) 2022/1925 (the Digital Markets Act).- Tabled by
- Piotr Müller
- Group
- ECR
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3
500 ~Alternative David CormandGreens/EFA · IMCO “3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a…”
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for sole the purposes set out in Article 88a(3) of Regulation (EU) 2016/679. of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. This paragraph shall not apply if the information constitutes processing of personal data. .’Justification
Adaptation necessary to cater to changes under GDPR in new Articles 88a and b and to ensure consistency between both legal acts.
- Tabled by
- David Cormand on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC (ePrivacy Directive) / Article 5, paragraph 3
1712 ~Alternative Ondřej KrutílekECR · ITRE–LIBE “or storage of or access to anonymous and necessary information in terminal equipment for the purposes of road safety, transport safety, and accident…”
1a. In Article 5(3), the last sentence is replaced by the following:
3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service, or storage of or access to anonymous and necessary information in terminal equipment for the purposes of road safety, transport safety, and accident prevention, including the operation and maintenance of connected vehicles and mobility systems."
Justification
The narrow exemptions of Article 5 have led to interpretations that effectively reduce the regime to a ‘consent-first’ model, making even low-risk or anonymous data uses unnecessarily complex. It creates significant difficulties for vehicle manufacturers; any time the onboard telematics unit or sensors send data externally, it may qualify as ‘accessing/storing information’ under Article 5(3). A vehicle is rarely used by a single individual; it may be driven by the owner, a family member, an employee, or a short-term renter, with passengers also potentially implicated.
- Tabled by
- Ondřej Krutílek
- Group
- ECR
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 1 a (new) / Directive 2002/58/EC / Article 5 – paragraph 3
1714 −Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the additional subparagraph
2. After Article 5(3), the following subparagraph is added: ‘This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.’- Tabled by
- Sibylle Berg, Martin Sonneborn
- Group
- NI
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Source
- Official text, page 127
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3
1715 −Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the additional subparagraph
2. After Article 5(3), the following subparagraph is added: ‘This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.’- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3
1716 −Deletion Krzysztof Hetman +1EPP · ITRE–LIBE Deletes the additional subparagraph
2. After Article 5(3), the following subparagraph is added: ‘This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.’- Tabled by
- Krzysztof Hetman, Adam Jarubas
- Group
- EPP
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Source
- Official text, page 128
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3
1724 −Deletion Marina Kaljurand +8S&D · ITRE–LIBE Deletes the additional subparagraph
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3 – subparagraph 2 (new)
1727 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “repurposing of said data for profiling, advertising, or other privacy intrusive purposes and is subject to relevant safeguards; (d) measuring the…”
This paragraphArticle 5 is replaced by the following:shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.1. Member States shall ensure that the storing of information, or gaining access to information already stored, in the terminal equipment of a user of a service or a subscriber of a service can only be done based on consent of said user or subscriber, in accordance with Regulation 2016/679. 2. The storing of information, or gaining access to information already stored, in the terminal equipment of a subscriber or user of a specific service and the subsequent processing of personal data for the same purpose shall only be lawful without obtaining consent to the extent that is strictly necessary and solely related for the following purposes: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service requested by the user or subscriber, as well as its full functionality and personalisation; including the storing of or access to data strictly necessary for the provision of content such as personalisation or recommendation of content, the management of a digital subscription, or the maintenance of a user session; (c) measuring the audience of an online service by creating aggregated information about the usage of that online service, also by a third party, provided that the measuring does not involve repurposing of said data for profiling, advertising, or other privacy intrusive purposes and is subject to relevant safeguards; (d) measuring the audience of an online service by a trade association or its mandated measurement entity on behalf of one or more media service providers for joint audience measurement purposes in accordance with Article 24 of Regulation (EU) 2024/1083, subject to appropriate technical and organisational safeguards; or by a third party acting on behalf of the controller of that online service pursuant to a contractual arrangement with that controller, solely for the purpose of measuring the audience of that online service; or by an entity belonging to the same digital ecosystem as the controller of that online service, for the purpose of measuring the audience of services within that digital ecosystem; (e) ensuring the security of the information society service or of the electronic communications network, provided that it is strictly necessary, proportionate, subject to appropriate safeguards, and only limited to information strictly necessary for this purpose and does not involve any general scanning or monitoring of information stored in the terminal equipment of a user or subscriber; (f) preventing fraud directly related to the use of the specific service requested by the user, provided that such processing is strictly necessary, proportionate, subject to appropriate safeguards, limited to the smallest amount of data required for the purpose, and does not involve any general scanning or monitoring of information stored in the terminal equipment of a user or subscriber; (g) provision, displaying and measurement of such advertising that is solely based on the content immediately displayed to the subscriber or user while using said service, no form of profiling or other privacy intrusive technologies shall be used. 3. The subscriber or user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means. If the subscriber or user gives consent, the provider shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the subscriber or user. 4. Nothing in this Article shall prevent a media service provider from conditioning access to its service upon the data subject’s consent to the processing of personal data for one or more specified purposes, or upon the payment of a reasonable fee for an equivalent version of the service that does not involve such processing. The specified purposes may include, but are not limited to, advertising, service improvement, product development, and analytics. Where such a choice is offered, both options must be presented to the data subject with equal prominence, in clear and plain language, and without the use of dark patterns.- Tabled by
- Sebastian Tynkkynen, Diego Solier
- Group
- ECR
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 2 / Regulation 2002/58/EC / Article 5
1728 ~Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “it is exclusively related to and strictly necessary for: a) carrying out the transmission of an electronic communication over an electronic…”
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679. This shall not prevent any technical storage or access and the corresponding processing of personal data if it is exclusively related to and strictly necessary for: a) carrying out the transmission of an electronic communication over an electronic communications network; b) providing a service explicitly requested by the subscriber or user; c) measuring the general audience of an online service requested by a subscriber or user in an immediately anonymised and aggregated form; d) maintaining or restoring the technical security of a service explicitly requested by the subscriber or user through strictly proportionate means; If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least six months. Refusing to give consent should not be more difficult than giving consent. Consent shall by default not be considered to be given in an informed and specific manner when the request for consent involves the disclosure of data to more than 10 controllers in a single action. Member States shall designate the competent supervisory authority under Regulation (EU) 2016/679 for the supervision and enforcement of the rules under this paragraph.- Tabled by
- Pernando Barrena Arza
- Group
- The Left
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3
1729 ~Alternative Alex Agius SalibaS&D · ITRE–LIBE “Member States shall ensure that the storing of information, or gaining of access to information already stored in the terminal equipment of a…”
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Member States shall ensure that the storing of information, or gaining of access to information already stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given their consent, having been provided with clear and comprehensive information, in accordance with Regulation (EU) 2016/679, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the purposes set out in Article 88a(3) of Regulation (EU) 2016/679 of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an online service explicitly requested by the subscriber or user to provide the service. This paragraph shall not apply if the information constitutes processing of personal data.- Tabled by
- Alex Agius Saliba
- Group
- S&D
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Source
- Official text, page 142
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3 – subparagraph 2 (new)
1730 ~Alternative Axel Voss +1EPP · ITRE–LIBE “previously governed by these provisions shall be exclusively subject to Regulation (EU) 2016/679”
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.The processing of personal data previously governed by these provisions shall be exclusively subject to Regulation (EU) 2016/679. (It applies to overall directive.)Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
- Tabled by
- Axel Voss, Oliver Schenk
- Group
- EPP
- Targets
- ePrivacy Directive Article 5(3), additional subparagraph
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3 – subparagraph 2 (new)
New paragraphs1 amendment
1725 +Addition Markéta Gregorová +1Greens/EFA · ITRE–LIBE “Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a…”
In Article 5, the following paragraph is added:
Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a natural person without specific consent, shall be lawful to the extent it is strictly technically and solely necessary for any of the following purpose:
(a)carrying out or facilitating the transmission of an electronic communication over an electronic communications network;
(b)providing an information society service specifically requested by the natural person;
(c)measuring the audience of an information society service explicitly requested by the data subject by creating instantly anonymous aggregated information about the usage of that service, where
(i)it is carried out by the provider of that service, or by a processor acting on behalf of this provider, or by an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083. This provision does not apply to gatekeepers within the meaning of Regulation (EU) 2022/1925;
(ii)it is carried out solely for the provider’s own use and not processed for other purposes;
(iii)the data is not combined with data from other services from the provider service, or from a third party, nor shared with a third party except for third parties referred to in point (i);
(iv)such measurement does not adversely affect the fundamental rights of the natural person; and
(v)the natural person is given a possibility to object;
(d)maintaining or restoring the security, confidentiality, integrity, availability and authenticity of the terminal equipment of the user, by means of updates, for the duration necessary for that purpose of a service provided by the controller and explicitly requested by the user or the terminal equipment used for the provision of such service given that
(i)such interest is not overridden by the interests or fundamental rights and freedoms of the data subject;
(ii)the user is informed about the storing or gaining access and their purpose;
(iii)a genuine choice is given to the user to postpone and decide on the automatic nature of such updates, except in the case of a vulnerability presenting a significant cybersecurity risk; and
(iv)this does not in any way change the functionality of the hardware or software or the privacy settings chosen by the user;
(e)complying with paragraph 4 point c of this Article, without storing personal data including unique identifiers;
5.Member States shall ensure that where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:
(a)the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a prominently displayed single-click button;
(b)if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;
(c)if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose;
(d)the interface used to request consent shall be presented in a machine-readable format.
6.Member States shall ensure that no user shall be denied access to any information society service or functionality, regardless of whether this service is remunerated or not, on grounds that he or she has not given his or her consent to the processing of personal information and/or the use of processing or storage capabilities of his or her terminal equipment that is not necessary for the provision of that service or functionality.
7.Member States shall ensure that the conditions for giving, refusing or withdrawing consent using automated and machine-readable signals pursuant to Article 88b of Regulation (EU) 2016/679 shall also apply to this Article.
8.This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].
Wider passage printed with the amendment
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.
Justification
Article 88a moved back to ePrivacy, in order to avoid that non-personal data is protected better than personal data stored in the terminal equipment.
- Tabled by
- Markéta Gregorová, Damian Boeselager on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- ePrivacy Directive Article 5 – paragraph 3a (new)
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 5 – paragraph 1 – point 2 / Directive 2002/58/EC / Article 5 – paragraph 3a (new)