Article 5a

'Article 5a

Processing of personal data in the terminal equipment of natural persons

1.Storing of personal data, or gaining of access to personal data of the data subject already stored, in the terminal equipment and any subsequent processing for the same purpose, is only allowed when that person has given his or her consent.

2.Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment and subsequent processing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3) of Regulation (EU) 2016/679, to safeguard the objectives referred to in Article 23(1) of that Regulation.

3.Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment without consent, and subsequent processing, shall be lawful only to the extent it is necessary for any of the following purposes:

(a)carrying out the transmission of an electronic communication over an electronic communications network;

(b)providing a service, feature or content, explicitly requested by the data subject, providing that the processing is strictly limited to the specific functionality requested;

(c)Measuring the audience of an online service to create aggregated information about the usage of such a service, where it is carried out by the controller or a processor solely for the use of the online service, that does not contain personal data anymore, or, exceptionally, by a third-party providers of audience measurement to a media service provider, both as defined in Regulation (EU) 2024/1083, provided they comply with the provisions of that Regulation, that such data is restricted to statistical counting, is not cross-using data from separate services, is not utilised for personalised advertising or fingerprinting, and does not involve profiling of data subject. This exception shall not apply to core platform services as defined in Regulation (EU) 2022/1925.

(d)maintaining or restoring overriding interests in the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service limited strictly to what is necessary for that security purpose;

4.Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)the data subject shall be able to refuse and withdraw consent in an easy, user-friendly, straightforward and intelligible manner with a prominently displayed single-click button; it shall be as easy to refuse or withdraw consent as to give it;

(b)if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least one year; processing of personal data for the sole purpose of respecting such refusal shall not rely on tracking or identification beyond what is strictly necessary;

(d)when online interface designs utilize an online choice architecture that includes dark patterns or other deceptive techniques to manipulate a data subject into giving consent, with the aim to distort or impair their free choice, such consent shall be invalidated;

This paragraph also applies to any consent under Regulation (EU) 2026/697 and to any subsequent processing of personal data based on consent.

5.This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].