ISMS CopilotePrivacy Directive Copilot
A general AI answer on ePrivacy can stop at cookie banners and GDPR consent. It can miss that the rule binds through national law, that it does not depend on personal data, and that telecoms providers carry separate duties. This assistant works from the Directive itself and flags where national law decides the answer.
As of early November 2026, the Digital Omnibus has not changed the Directive, which still applies through national law. Check your cookies and marketing against the current rules.
What the ePrivacy Directive Copilot Can Do
Article 5(3) screen: whether a cookie, pixel, SDK or similar technique stores or reads information on a user's device, and whether one of the two consent exemptions applies
Review of the cookie and tag inventory you bring, sorted into likely exempt, consent-required and needs a closer look, so you can run it again when a new tag goes live
Direct marketing under Article 13: prior consent for email, SMS and automated calls to individuals, the existing-customer exception for electronic mail in Article 13(2), and the choices left to member states
Provider duties for publicly available electronic communications services: confidentiality (Article 5(1)), traffic data (Article 6) and location data (Article 9)
Breach notification for those providers under Article 4(3) and Regulation 611/2013: 24 hours to the national authority where feasible, and when subscribers must be told
Where ePrivacy stops and GDPR starts: the consent standard, later processing of what was collected, Article 95 GDPR, and which authority enforces which rule
About ePrivacy Directive Copilot
ePrivacy assistant for the Directive: cookies and trackers under Article 5(3), email and SMS marketing under Article 13, telecoms confidentiality and breach duties.
Devices (Article 5(3))
Storing or reading information on a device needs consent, given after clear and comprehensive information, unless an exemption applies
Two exemptions: technical steps whose only job is to carry a communication, and steps that an online service the user asked for strictly needs
The rule does not depend on personal data (Planet49, C-673/17). EDPB Guidelines 2/2023 examine URL and pixel tracking, IP-based tracking, IoT reporting and unique identifiers; the outcome depends on the facts
Marketing (Article 13)
Direct marketing by email (including SMS), automated calling or fax needs prior consent from the subscriber or user; this protection is set for natural persons
Existing-customer exception, for electronic mail only: marketing your own similar offers to contacts you got through a sale, with a free, simple opt-out when you collect the address and in each message
National law decides opt-in or opt-out for other channels, such as live calls, and how legal-person subscribers are protected
Providers (Articles 4, 5(1), 6 and 9)
Security measures and notice to subscribers of a particular risk of a network security breach
Personal data breaches tied to the service go to the national authority, within 24 hours of detection where feasible under Regulation 611/2013. People are told too if the breach is likely to harm their data or privacy, unless the data was rendered unintelligible and the authority accepts that. A breach outside this regime, such as in HR records, falls under the GDPR rules instead
Traffic data has to go or lose its link to the person once transmission is over, apart from set cases such as billing. Other location data must be anonymous, or used with consent and only as far as a value added service needs
Where GDPR comes in
Consent under Article 5(3) follows the GDPR standard, and a pre-ticked box is not valid (Planet49)
Article 5(3) governs the storing and reading; what you do with the data afterwards generally falls under GDPR, including its lawful bases
Enforcement is national (Article 15a) and the authority varies. EDPB Opinion 5/2019 says the GDPR cooperation mechanism does not extend to enforcing national ePrivacy rules
Cross-framework mappings
Working across ePrivacy Directive and another standard? ISMS Mappings is a free public directory of control maps (ISO 27001, SOC 2, NIST, GDPR, and more). A Better ISMS tool, separate from the chat assistant.
Browse free mappingsFrequently Asked Questions
What is the ePrivacy Directive?
Directive 2002/58/EC, last amended by Directive 2009/136/EC, sets EU privacy rules for the electronic communications sector, and its cookie and direct marketing rules reach well beyond telecoms. As a directive, it binds organisations through national law: in Germany, for example, the cookie rule sits in section 25 of the TDDDG. So the wording, the marketing choices, the penalties and the regulator can differ by country. The Commission withdrew its 2017 proposal for a replacement regulation in 2025, which leaves the Directive and the national laws in force.
Who has to comply?
Outside telecoms, it reaches organisations through two rules. Article 5(3) covers storing or reading information on a subscriber's or user's device, which catches website and app operators that do this. Article 13 covers organisations that market directly by email or SMS, automated calling or fax. The security, breach, traffic data and location data rules are aimed at providers of publicly available electronic communications services and, for some duties, public networks. Since 21 December 2020 those services include number-independent ones, such as VoIP, messaging and web-based email, because the European Electronic Communications Code widened the definition. Whether a given service qualifies depends on its features and how it is remunerated, which can be indirect.
Has the Digital Omnibus changed the cookie rules?
Not yet. As of early November 2026 it is still a proposal (procedure 2025/0360(COD)). The Commission proposed in November 2025 to move the cookie consent rules into the GDPR. The Council's mandate of 21 October 2026 instead keeps them in the ePrivacy framework and adds purposes that need no consent, such as audience measurement. Parliament's committees have not finished their work on the file, and negotiations between the two have not started. Until an amendment is adopted and applies, the current Directive and national laws are what you assess against.
How does the ePrivacy Directive Copilot help?
Bring your cookie list, tag inventory, consent wording or marketing flow, and it works through them article by article, says which exemption or condition it relied on, and flags where the answer turns on national law or regulator guidance. You check that national point and you make the decision. The review is general compliance support, not legal advice or a finding that your site complies.
Ask it from your AI.
Connect ISMS Copilot to the assistant you already use and send it your ePrivacy questions: cookie and tag reviews, email marketing, provider duties, national differences.