Article 5 – Confidentiality of the communications
Changes since10 June 2026ST 10426/26, Art 5
Changes Article 5(3), additional subparagraph. Every change, paragraph by paragraph
Text as printed
Changes since 10 June · Changes since the Commission proposal
Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679. Storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user without consent, and subsequent processing of personal data for the same purpose, shall be lawful to the extent it is solely related to and strictly necessary for the following purposes:
carrying out the transmission of an electronic communication over an electronic communications network;
providing a service, including its functionality, explicitly requested by the subscriber or user;
Measuring the audience of an online service by creating anonymous aggregated information about the usage of that online service, where it is carried out by the provider of that online service, including jointly with others, or on behalf of that provider, or by an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083;
maintaining or restoring the technical security of the means strictly necessary for the provision of an information society service requested by the subscriber or user or the technical security of the terminal equipment used for the provision of such service;
The subscriber or user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means. If the subscriber or user gives consent, the provider shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the subscriber or user. If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least six months.
Member States shall designate the competent supervisory authority under Regulation (EU) 2016/679 for the supervision and enforcement of the rules under this paragraph.