In conjunction with the May 25, 2018, implementation of the General Data Protection Regulation, or GDPR, the European Commission is seeking to adopt a regulation adapting the ePrivacy Directive "privacy and electronic communication" (2002/58/EC). Since 2002, technology and commercial communications have evolved considerably, and the draft regulation includes more general provisions on electronic communications as well as Internet tracking, including direct digital marketing and cookies. The ePrivacy Regulation aims to strengthen the protection of users of terminal systems, including users of computers, phones, smartphones or tablets. In addition, this new regulation must not only protect the privacy of natural persons, as in the case of the GDPR, but its provisions must also apply to legal persons.

This text was made public by the Commission on January 10, 2017 and is currently the subject of numerous debates within the Council, under the Austrian Presidency until December 2018. It should be noted that at this stage, this presidency only envisages a progress report in December and not a vote.

Scope of application

This draft ePrivacy regulation will apply to electronic communications data (voice, text, video, image and audio) related to the provision or use of associated services (online messaging, email, voice over IP, machine to machine, WiFi, etc.) and to information contained in end-user terminal equipment. Metadata are also concerned; they are data that allow to date, to qualify the duration of a communication, its type, or to establish its origin or its destination.

The provisions of the regulation will apply to natural persons, but also to legal persons.

Contributions of the regulation

First of all, it is about simplifying, for each Internet user, the procedure for deciding on privacy settings. Thus, the choices should be made at the first connection, via the browser, and no longer as currently, site by site. The practical consequence will be the disappearance of repetitive pop-up windows at each change of site.

Concerning cookies, consent will not be necessary for those linked to configuration requirements, i.e. strictly technical (e.g. to memorize a purchase in progress on the site). On the other hand, for cookies used to track a person when he or she navigates on the site concerned, consent will be mandatory and must be given beforehand. The European legislator considers that this tracking, which aims to profile people for advertising or commercial purposes, represents particular risks in terms of personal data and the privacy of the people concerned.

The draft regulation also provides for the elimination of "cookie walls," the current practice of sites denying access to users who do not wish to be tracked via cookies. This provision is related to the general principle of free consent, which the European legislator presumes to be forced when it is linked to accessing or not accessing a site. Thus, it would not be accepted a situation where the Internet user would be denied free access without consent, but accept paid access, still without consent. The service will still have to be offered even if the person concerned does not give consent. This regulation therefore represents a major challenge for companies whose business model is based on behavioral advertising.

The fines provided for are of the same amount as those provided for the RGPD: maximum of 20 million euros or 4% of the turnover (worldwide).

Pressure from marketers and privacy advocates on industry is causing considerable delay. Three bodies must agree: the European Parliament, the European Commission and the European Council.

The text has been under debate in the EU Council since December 4, 2017. The debates continue, with multiple new versions of the regulation coming out of the discussions in the Council. The latest of these, from October 19, 2018, can be found here.

"Festina lente

In its current version, the text provides for the application of its provisions within 24 months of its entry into force (which will take place within 20 days of its promulgation in the Official Journal of the EU). Given the slow pace of the legislative process, the final text will enter into force in the first quarter of 2021 at best.