Definition
It sits alongside the GDPR and covers communications specifically: confidentiality of messages, traffic and location data held by telecoms providers, unsolicited marketing, and storing or reading information on a user's device. A 2009 amendment introduced the consent requirement behind cookie banners.
How it works
Article 5(3) says a site needs your consent before storing or accessing non-essential information on your device, such as tracking cookies or similar identifiers. National laws implement the directive, so details differ by country. A planned ePrivacy Regulation to replace it stalled for years and was put forward for withdrawal by the European Commission in 2025.
Why it matters
A VPN changes your IP but does nothing about cookies or device identifiers, which are governed by ePrivacy rules and consent banners. Rejecting non-essential cookies is as important as hiding your IP.