Article 5 – Confidentiality of the communications

Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679.

Storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user without consent, and subsequent processing of personal data for the same purpose, shall be lawful to the extent it is solely related to and strictly necessary for the following purposes:

carrying out the transmission of an electronic communication over an electronic communications network;

providing a service, including its functionality, explicitly requested by the subscriber or user;

Creating anonymous aggregated information about the usage of an online service to measure the audience of that service, provided that it is carried out by the provider of the service requested by the subscriber or user, or by a third party on behalf of that provider, and the data collected for the purpose of aggregating the information are not processed for another purpose, shared with third parties or combined with data from third parties;

performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083, provided that personal data are pseudonymised after collection and not processed for another purpose, that the processing of personal data does not involve tracking the activity of the subscriber or user outside of the service or the media content to be measured, and that any information shared with third parties other than those acting either on behalf of or jointly together with that provider does not contain personal data;

maintaining or restoring the technical security of the means strictly necessary for the provision of a service requested by the subscriber or user or the technical security of the terminal equipment used for the provision of such service;

measuring the display and performance of advertising that is based solely on the immediate content displayed on a subscriber or user’s online interface during an individual visit or on the basis of a single search query and that does not involve the processing of personal data, where such measurement is carried out by the provider of an online service, including jointly with others, or on behalf of that provider. Such measurement shall not involve profiling or processing of data relating to the subscriber or user’s past or future activity, including activity across sites or services. Data collected for such measurement shall be pseudonymised after collection and shall not be processed for another purpose.

The subscriber or user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means. If the subscriber or user gives consent, the provider shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the subscriber or user. If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least four months.