Article 37 – Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment

Source: ST 10426/26, page 121 Omnibus Article 4 · pp. 121–123

Changes since19 November 2025COM(2025) 837, Art 37

Changes Article 37(4) and drops Article 37(7), (8), (9) and (10). Every change, paragraph by paragraph

Text as printed

New provision · Changes since the Commission proposal

Article 37(2) In every text (Article 37(2))

(2)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

ST 10426/26, pages 121–123

Article 37(3) In every text (Article 37(3))

(3)

Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union law within the meaning of, and subject to the conditions of Article 5, to safeguard the objectives referred to in Article 25(1).

ST 10426/26, pages 121–123

Article 37(4) In every text (Article 37(4))

(4)

Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

(a)

carrying out the transmission of an electronic communication over an electronic communications network;

(b)

providing a service explicitly requested by the data subject and ensuring functionality of the requested service;

(c)

Measuring the audience of an online service in order to create anonymous aggregated information about the usage of that online service, where it is carried out by the controller of that online service, or by a third party acting together with or on behalf of this provider, including where the third party is an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083;

(d)

maintaining or restoring the security of the interface strictly necessary for the provision of an information society service requested by the user or the security of the terminal equipment used for the provision of such service;

(e)

preventing or detecting fraud provided that such measures do not override the fundamental rights and interests of the data subject.

ST 10426/26, pages 121–123

Article 37(5) In every text (Article 37(5))

(5)

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

(a)

the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

(b)

if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

(c)

if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

ST 10426/26, pages 121–123

Article 37(6) In every text (Article 37(6))

(6)

This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] ]

ST 10426/26, pages 121–123

Article 37(7) Dropped In every text (Article 37(7))

This Council draft drops the change the Commission proposed. It deletes nothing from the law in force.

ST 10426/26, page 123

Article 37(8) Dropped In every text (Article 37(8))

ST 10426/26, page 123

Article 37(9) Dropped In every text (Article 37(9))

ST 10426/26, page 123