TL;DR
The ePrivacy Regulation is a European text that has been under negotiation since 2017, intended to replace the 2002 ePrivacy Directive (the one that made cookie banners mandatory). Once adopted, it will harmonise cookie consent rules across the EU, remove diverging national transpositions and align the legal framework with the GDPR. For website publishers, this means clearer rules, but potentially stricter ones too, on placing cookies and online tracking.
What is the ePrivacy Regulation?
The ePrivacy Regulation is a proposed European regulation that is set to replace Directive 2002/58/EC (the ePrivacy Directive), amended in 2009. That directive is the text behind the consent requirement for cookies. The regulation aims to modernise this framework to reflect how the web works today.
Unlike a directive, which each Member State must transpose (creating differences between countries), a regulation applies directly and uniformly across the EU. It follows the same logic as the GDPR: a single text, applied consistently.
It is not the only European text that affects cookies: the Digital Markets Act and its consent rules have applied to gatekeeper platforms since March 2024.
The text has been under negotiation in the Council of the EU since 2017. Several versions have circulated, but the Member States and the European Parliament have not yet reached a final agreement. Despite the delay, the main thrust of the text is known, which makes it possible to anticipate the coming changes.
Why is the current ePrivacy Directive a problem?
The 2002 ePrivacy Directive was drafted before the explosion of online tracking. It requires consent for placing cookies, but leaves each country to transpose the rules in its own way. The result: rules vary from one country to another, which complicates life for publishers of international websites.
Diverging national transpositions
In France, the CNIL has adopted strict guidelines (explicit consent, refusing as easy as accepting). In Germany, the regional authorities apply similar rules, but with nuances. In Spain, the AEPD takes a different approach on certain points. For a website operating across Europe, this patchwork of rules is a headache.
The CNIL enforces these rules through fines, as shown by these real cases of CNIL cookie sanctions.
A text unsuited to new technologies
The 2002 directive talks about "cookies" but does not explicitly cover fingerprinting, tracking via mobile advertising identifiers, or cookieless tracking technologies such as cookieless tracking methods. The ePrivacy Regulation aims to close these gaps by broadening the definition of the trackers covered.
What will the ePrivacy Regulation change for cookies?
Even though the text is not finalised, several major changes are agreed across the successive versions of the draft. Here are the main expected impacts for website publishers.
A broader definition of trackers
The ePrivacy Regulation will no longer be limited to cookies. It will cover any technique for storing or accessing information on the user's device. This includes fingerprinting (browser fingerprints), tracking pixels, local storage (localStorage, IndexedDB), advertising identifiers and potentially certain server-side tracking methods.
Consent through browser settings
One of the most debated proposals in the ePrivacy Regulation is allowing users to manage their consent directly from their browser settings, rather than through a cookie banner on every website. If this provision is adopted, it could reduce the number of banners shown to users.
This idea responds to a real problem, analysed in our article on consent fatigue and why visitors ignore cookie banners.
In practice, browsers would offer a standard interface for setting default consent preferences (accept, reject, manage by category). Websites would have to respect these preferences without displaying an additional banner, unless specific purposes require separate consent.
To understand the categories banners rely on today, see our guide to the 4 GDPR cookie categories.
Uniform rules across the EU
No more diverging national transpositions. The regulation will apply directly in all 27 Member States, like the GDPR. Publishers of international websites will no longer have to deal with rule variations between France, Germany, Spain or the Netherlands.
Processing of communications metadata
The ePrivacy Regulation also extends its scope to electronic communications metadata (location, timestamps, recipients). This part mainly concerns telecoms operators and messaging services, but it may affect analytics tools that use location or session data.
What is the timeline for the ePrivacy Regulation?
The draft ePrivacy Regulation was presented by the European Commission in January 2017. The European Parliament adopted its position in October 2017. Since then, negotiations in the Council have stalled due to disagreements between Member States, notably on browser-based consent management and exemptions for analytics cookies.
In 2021, the Portuguese Presidency of the Council proposed a compromise, but it did not succeed. To date (2026), the text has still not been adopted. Several experts believe adoption could happen between 2027 and 2028, with a 24-month transition period before it actually applies.
In the meantime, the 2002 ePrivacy Directive (amended in 2009) remains the text in force, supplemented by national guidelines (CNIL, BfDI, AEPD, etc.) and by the GDPR framework for cookies.
Common mistakes about the ePrivacy Regulation
Waiting for the regulation before becoming compliant. The GDPR and national guidelines (CNIL, etc.) already apply. The ePrivacy Regulation will not "create" a consent requirement; it will clarify and standardise rules that already exist. Do not put off configuring your CMP.
Believing that cookie banners will disappear. Even if the regulation provides for consent management through the browser, this provision is still under debate and its technical implementation will take time. Cookie banners will remain necessary for several years at least.
Confusing ePrivacy with the GDPR. The GDPR governs the processing of personal data. The ePrivacy Directive (and the future regulation) specifically governs access to the user's device (cookies, fingerprinting, etc.). The two texts complement each other: the GDPR sets out the general principles, ePrivacy provides the specific rules for trackers.
The conditions a valid consent must meet under the GDPR are detailed in our article on the 7 requirements for GDPR consent validity.
Thinking that fingerprinting escapes regulation. The ePrivacy Regulation explicitly aims to cover fingerprinting and cookieless tracking techniques. Websites that have dropped cookies in favour of fingerprinting will need to obtain equivalent consent.
Ignoring the exemptions for analytics cookies. Some versions of the draft provide for a consent exemption for first-party analytics cookies that are not shared with third parties. This is already the case in practice in several countries (France, with the CNIL, for Matomo in an exempt configuration). The regulation could make this exemption official at European level.
Checklist to prepare for the ePrivacy Regulation
- Carry out a full inventory of all trackers on your website (cookies, localStorage, fingerprinting, pixels)
- Check that your CMP covers trackers beyond HTTP cookies alone
- Document the purposes of each tracker and the third parties receiving the data
- Configure your CMP to block scripts before consent, including fingerprinting
- Follow the progress of the ePrivacy text through European Commission publications and the opinions of your national authority
- Prepare your cookie policy to include the new definitions (trackers, metadata)
- Test how your website behaves when the browser signals a global refusal of tracking
- Document your current compliance to ease the transition to the future regulation
Conclusion
The ePrivacy Regulation has not yet been adopted, but its main direction is clear: broaden the definition of trackers, standardise rules across Europe and potentially build consent into browsers. Website publishers who already comply with the GDPR and the CNIL guidelines are well placed to adapt to the future regulation.
The starting point: carry out a full audit of your trackers (not just HTTP cookies) to identify the technologies that will be covered by the future regulation. Scan your website for free with FlowConsent to get a complete inventory.