EdLaw
ePrivacy Directive (Directive 2002/58/EC)
The EU's confidentiality-of-communications law — the legal root of every cookie banner — published in the Official Journal on 31 July 2002 (OJ L 201, 31.7.2002, p. 37) and materially rewritten by Directive 2009/136/EC (the "Cookie Directive"). This folder reproduces the consolidated text 02002L0058-20091219. It is lex specialis to the GDPR for electronic communications: where it applies, its rules displace the GDPR's lawful-basis analysis, while "consent" takes the GDPR meaning.
Being a directive, it acts through national implementations that differ meaningfully — PECR in the UK, Prawo komunikacji elektronicznej in Poland, and so on. The national instruments are indexed under jurisdiction/nat/; this folder is the common root they transpose.
Applicability to EdTech
- Article 5(3) is the operative rule for cookies, SDKs and device storage: "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information" (Art. 5(3)) — with the strictly-necessary and transmission exemptions in the same paragraph. It is technology-neutral: localStorage, device fingerprinting, telemetry reads from a headset or portal all count. Note the consent-or-necessity analysis is per purpose, not per cookie.
- It protects legal persons too (Art. 1(2)) — schools as subscribers, not only individual users.
- Marketing email/SMS to teachers and parents: prior consent, or the soft opt-in for existing customers of a product/service, with an opt-out in every message (Art. 13). B2B nuances are national-law choices under Art. 13(5).
- Traffic and location data rules (Art. 6, Art. 9) bind providers of electronic communications services/networks — mostly relevant where a product embeds communications functionality rather than merely uses connectivity.
Contents
| Document | Covers |
|---|---|
| SCOPE-AND-DEFINITIONS.md | Arts. 1–3 — scope and definitions |
| SECURITY-AND-CONFIDENTIALITY.md | Arts. 4–5 — security/breach notification, confidentiality, the Art. 5(3) cookie rule |
| TRAFFIC-AND-LOCATION-DATA.md | Arts. 6, 9 — traffic data, location data |
| UNSOLICITED-COMMUNICATIONS.md | Art. 13 — direct-marketing opt-in and soft opt-in |
Scope note: itemised billing through directories (Arts. 7–8, 10–12), the Art. 15 restrictions/data-retention hook and the remedies/committee machinery can be added with the same tooling when needed. The proposed ePrivacy Regulation that would have replaced this Directive was withdrawn by the Commission in 2025 — the Directive remains the law; re-verify status when this matters.
Key obligations at a glance
- Consent before storing or accessing information on terminal equipment, unless strictly necessary for a service the user requested or for transmission (Art. 5(3)).
- Confidentiality of communications and related traffic data — no listening, tapping, storage or surveillance without consent or legal authority (Art. 5(1)).
- Service providers: appropriate security measures, subscriber risk information, and personal-data-breach notification to the competent authority and, for likely-adverse breaches, the subscriber (Art. 4).
- Direct marketing by automated means only with prior consent, save the soft opt-in (Art. 13(1)–(2)).
Enforcement
National — each Member State's implementation designates the enforcer (data-protection authority or communications regulator; in the UK, the ICO under PECR). There is no EU-level fine regime; national penalties and GDPR-style enforcement apply through the transpositions.
Licence
The corpus reproduces the EUR-Lex consolidated text of Directive 2002/58/EC (CELEX 02002L0058-20091219).
The EUR-Lex legal notice (eur-lex.europa.eu/content/legal-notice/legal-notice.html, read 2026-10-01 in the Internet Archive copy captured that day, because EUR-Lex refuses non-browser clients) says: "© European Union, 1998-2026 The Commission’s document reuse policy is based on Decision 2011/833/EU. Unless otherwise specified, you can re-use the legal documents published in EUR-Lex for commercial or non-commercial purposes." For consolidated texts it adds: "The copyright for the editorial content of this website, the summaries of EU legislation and the consolidated texts, which is owned by the EU, is licensed under the Creative Commons Attribution 4.0 International licence. This means that you can re-use the content provided you acknowledge the source and indicate any changes you have made."
Commission Decision 2011/833/EU on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39, read in the Publications Office Cellar copy on 2026-10-01) provides in Article 4 that "All documents shall be available for reuse: (a) for commercial or non-commercial purposes under the conditions laid down in Article 6", and Article 6(2) lists the conditions that may be attached: "(a) the obligation for the reuser to acknowledge the source of the documents; (b) the obligation not to distort the original meaning or message of the documents; (c) the non-liability of the Commission for any consequence stemming from the reuse."
Conditions, and how this corpus meets them:
- Acknowledge the source: each extracted provision carries a
{.meta}provenance line naming EUR-Lex and the CELEX number, and Sources links the EUR-Lex text. - Indicate changes (CC BY 4.0, for the consolidated text): the provision text is unchanged; the changes are the selection of provisions, the Markdown layout and the added anchors, all described in Meta.
- Do not distort the meaning: the text is reproduced verbatim and checked mechanically against the source (see Meta).
- No endorsement or liability: the corpus does not claim that the EU or the Publications Office endorses it, and only the Official Journal text is authentic.
EDPB Guidelines 2/2023, listed in Sources, are cited, not reproduced.
Related
- EU GDPR — general regime; ePrivacy is lex specialis and borrows its consent standard
- National transpositions — e.g. PKE (Poland), Lei 41/2004 (Portugal); all are indexed under jurisdiction/nat/