ePrivacy Directive vs GDPR: Key Differences and What Changed in 2026

Your cookie banner answers to 2 EU laws: the ePrivacy Directive and the GDPR.

They overlap. They also differ on scope, legal basis, and enforcement. And for 8 years, everyone expected a third law, the ePrivacy Regulation, to replace one of them.

That isn’t happening. The European Commission withdrew the ePrivacy Regulation proposal in February 2025.

Here’s the tl;dr:

• ePrivacy Directive (2002/58/EC): covers cookies, trackers, email and SMS marketing, and the confidentiality of electronic communications. Each EU country turns it into its own national law.
• GDPR: covers any processing of personal data. It applies directly in every EU country.
• ePrivacy Regulation: proposed in 2017, withdrawn in 2025. It won’t replace the Directive.
• Digital Omnibus: a 2025 proposal to change the cookie rules. It isn’t law yet, so today’s rules still apply.
• Your site: the ePrivacy Directive applies to any non-essential cookie you set on EU visitors’ devices, personal data or not. The GDPR applies when that cookie, or anything else on your site, collects personal data. Most analytics and ad cookies do, so most sites follow both.

What is the ePrivacy Directive?

The ePrivacy Directive (Directive 2002/58/EC) is the EU law on privacy in electronic communications. People also call it the “Cookie Law” or the “Cookie Directive”.

Its job is to protect the privacy of people who use phones, email, messaging, and the internet. That includes what happens on their devices, like the cookies a website stores in a browser.

Most of its rules are for telecoms and messaging providers. 2 of them apply to every website owner: the cookie rule (Article 5(3)) and the email and SMS marketing rule (Article 13). That’s why it matters for a WordPress site.

It’s a directive, so it doesn’t apply on its own. Each EU country writes it into national law. Germany uses Section 25 of the TDDDG, for example. The UK still applies its own version, PECR, after Brexit.

That’s why cookie rules differ a little from country to country.

Background: 2002, 2009, and consent fatigue

The EU adopted the Directive in 2002. In 2009, an amendment (Directive 2009/136/EC) made consent the rule before a website stores or reads cookies on a user’s device. Before that, an opt-out was enough in most cases.

Enforcement has been uneven since then. Each country interprets the rules its own way, and regulators enforce them at different levels.

The result for users: a consent banner on almost every site. Many people click “Accept” without reading. That’s consent fatigue, and it’s one reason the EU keeps trying to change the cookie rules.

What the ePrivacy Directive covers

• Cookies and similar trackers (Article 5(3)): you need consent before you store or read information on a user’s device. Strictly necessary cookies are exempt, such as a login session or a shopping cart. The rule also covers pixels, local storage, and device fingerprinting. It applies whether or not the data is personal. The EDPB set out which technologies the rule covers in its Guidelines 2/2023 on the technical scope of Article 5(3), final version adopted in October 2024.
• Email and SMS marketing (Article 13): you need prior consent to send marketing messages. There’s a narrow exception for existing customers and similar products, but every message needs an opt-out.
• Confidentiality of communications: providers can’t listen to, store, or intercept messages and calls without consent.
• Traffic and location data: providers must delete or anonymize this data when they no longer need it, unless the user consents to other uses.

What is the GDPR?

The General Data Protection Regulation (Regulation (EU) 2016/679) is the EU’s main data protection law. It has applied since 25 May 2018.

It’s a regulation, so it applies directly in every EU country. No national version is needed.

It also reaches outside the EU. If you offer goods or services to people in the EU, or monitor their behavior, the GDPR applies to you (Article 3). That’s true even if your business is in the US or India.

The 7 GDPR principles

1. Lawfulness, fairness, and transparency: have a legal reason to process data, and tell people what you do with it.
2. Purpose limitation: collect data for a clear purpose. Don’t reuse it for something unrelated.
3. Data minimization: collect only what you need for that purpose.
4. Accuracy: keep data correct and up to date.
5. Storage limitation: delete data when you no longer need it.
6. Integrity and confidentiality: protect data against loss, theft, and unauthorized access.
7. Accountability: be able to show that you follow the rules, with records and policies.

The 6 lawful bases for processing

You need at least 1 of these to process personal data:

1. Consent: the person agreed, freely and clearly.
2. Contract: you need the data to deliver what they bought or signed up for.
3. Legal obligation: a law requires you to process it, for example tax records.
4. Vital interests: you need it to protect someone’s life.
5. Public task: you carry out a task in the public interest or under official authority.
6. Legitimate interests: you have a real business reason, and it doesn’t override the person’s rights.

Individual rights under the GDPR

• Right to be informed about how their data is used
• Right of access to the data you hold on them
• Right to correct wrong data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing, including direct marketing
• Rights related to decisions made only by automated processing

Fines go up to €20 million or 4% of global annual turnover, whichever is higher.

For the full breakdown, see our GDPR compliance checklist.

ePrivacy Directive vs GDPR: key differences

How the ePrivacy Directive and GDPR work together

The ePrivacy Directive is the specific law. The GDPR is the general one. Where both apply, the ePrivacy rule takes priority for the part it covers. The EDPB explains this in its Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR.

On a website, that gives you 2 steps:

1. The ePrivacy Directive decides if you need consent to place a cookie or run a tracker.
2. The GDPR controls what you do with the personal data that cookie collects: how long you keep it, who you share it with, and which rights users have.

The 2 laws use the same definition of consent. Consent under the ePrivacy Directive must meet the GDPR standard: freely given, specific, informed, and unambiguous.

The EU Court of Justice confirmed this in the Planet49 case (C-673/17) in 2019. A pre-ticked checkbox isn’t valid consent for cookies.

So a banner with pre-ticked boxes, or one that loads trackers before the user clicks, fails the consent test under both laws.

How both laws apply to common WordPress tools

What this means for your business

Websites and apps

• Most sites run analytics, ad pixels, or embedded videos. Each one sets cookies or reads device data. Each one needs consent under the ePrivacy Directive, unless it’s strictly necessary.

• You also need a privacy policy and a cookie policy that list what you collect and why. That’s a GDPR transparency rule.

• Security matters too. The GDPR requires you to protect the data you collect, and to report most data breaches to your regulator within 72 hours.

Marketing and advertising

• No consent means no tracking cookies. That means fewer users in your retargeting audiences and gaps in your analytics.

• Email and SMS marketing need opt-in consent under the ePrivacy Directive. The GDPR then sets how long you keep that contact data, and how people can unsubscribe or ask you to delete it.

Selling across EU countries

• The GDPR is the same everywhere in the EU. The ePrivacy Directive isn’t. National rules differ on details, such as consent for analytics cookies and how regulators enforce the rules.

• If you sell in several EU countries, check the national cookie rules in your main markets.

France is a good example. The CNIL lets sites use analytics cookies without consent, but only under strict conditions: the data is used only for audience measurement, it isn’t combined with other data, the last byte of the IP address is removed, and the cookie lasts 13 months at most. Users must still be told, and they must be able to opt out. The CNIL also says most large analytics tools don’t qualify. (CNIL)

Other EU countries don’t all allow this exemption. So an analytics setup that works without consent in France can need consent in another country.

What happened to the ePrivacy Regulation?

Short answer: it’s dead. The ePrivacy Directive stays.

The European Commission proposed the ePrivacy Regulation in January 2017. The plan was to replace the Directive with a regulation that applied the same way in every EU country, like the GDPR. It would also have covered messaging apps such as WhatsApp and Skype, and metadata.

EU countries agreed their negotiating position in February 2021. Talks with the European Parliament then stalled.

On 11 February 2025, the Commission’s 2025 work programme listed the proposal for withdrawal. The reasons it gave: “no foreseeable agreement”, and the text was outdated after newer EU tech laws such as the Digital Markets Act.

The Commission formally approved the withdrawal on 16 July 2025. The notice was published in the Official Journal of the EU on 6 October 2025 (C/2025/5423). It lists the proposal (COM(2017) 10) and refers to Annex IV of the work programme (COM(2025) 45) for the reasons.

What this means for you:

• The ePrivacy Directive and each country’s cookie law are still in force.
• The GDPR still applies alongside them.
• Anything you read about Regulation-era rules, such as new ePrivacy fines of €20 million or 4% of turnover, describes a proposal that never became law.

The Digital Omnibus: the cookie change to watch in 2026

The EU is now changing the cookie rules through a different law. On 19 November 2025, the Commission proposed the Digital Omnibus, a package that amends the GDPR, the ePrivacy Directive, and other digital laws.

The Commission’s draft would:

• Move cookie rules for personal data into the GDPR (a new Article 88a)
• Let users refuse cookies with 1 click
• Make sites wait 6 months before they ask again after a refusal
• Drop the consent rule for aggregated audience measurement and for security
• Make sites respect consent choices set in the browser (a new Article 88b)

EU countries changed a lot of this. The Council adopted its position on 21 October 2026. Its version:

• Keeps the cookie rules in Article 5(3) of the ePrivacy Directive
• Drops the browser-signal rule
• Cuts the wait after a refusal to 4 months
• Adds exemptions, including for contextual ad measurement

The European Parliament hasn’t agreed its position yet. Its civil liberties (LIBE) and industry (ITRE) committees share the file, and MEPs have tabled more than 1,000 amendments. No vote date is set.

So nothing changes on your site today. Comply with the current Directive and the GDPR, and watch the Omnibus.

How to comply with the ePrivacy Directive today

These steps cover the ePrivacy Directive and the GDPR consent rules together.

1. Audit your cookies and trackers. Scan your site. List every cookie and script, its owner (first or third party), its purpose, and how long it lasts.
2. Block non-essential scripts until consent. Analytics, ad pixels, and embedded videos load only after the user agrees. A banner that shows a notice while tracking runs anyway doesn’t meet the rule.
3. Make “Reject” as easy as “Accept”. No pre-ticked boxes or other dark patterns. Let users choose by category.
4. Log every consent decision. The GDPR requires you to show that a user consented. Keep a record of what they agreed to, and when.
5. Let users change their mind. Withdrawing consent must be as easy as giving it. Add a link or button that reopens the banner.
6. Update your cookie policy and privacy policy. List the cookies you use, why, and for how long. Link both from the banner.
7. Check your email and SMS opt-ins. Marketing messages need prior consent, plus an unsubscribe link in every message.
8. Watch the Digital Omnibus. When the final text passes, update your banner rules, re-prompt timing, and exemptions.

Pro tip: check your banner from the visitor’s side. Open your site in a private window, open your browser’s developer tools, and see which cookies load before you click anything. If you see analytics or ad cookies, your blocking isn’t working.

FAQs

What’s the difference between the ePrivacy Directive and the GDPR?

The ePrivacy Directive covers electronic communications: cookies, trackers, and email and SMS marketing. The GDPR covers any processing of personal data. A website that uses tracking cookies usually has to follow both.

Do I need separate consents for the GDPR and the ePrivacy Directive?

• You don’t need 2 banners. 1 consent request can cover both, if it meets the GDPR consent standard and names each purpose.
• Email marketing works differently. Cookie consent doesn’t cover marketing emails, so you need a separate opt-in for those.

Who enforces the ePrivacy Directive and the GDPR?

National regulators. Each EU country enforces its own ePrivacy law. Depending on the country, that’s the data protection authority or a telecoms regulator. National data protection authorities enforce the GDPR and coordinate cross-border cases at EU level.

Will the ePrivacy Regulation replace the Cookie Directive?

No. The proposal was withdrawn, so the ePrivacy Directive and each country’s cookie law stay in force. The EU is now changing the cookie rules through the Digital Omnibus, which isn’t law yet.

Do I need to comply with both the GDPR and the ePrivacy Directive?

In most cases, yes. The ePrivacy Directive applies to non-essential cookies and trackers on EU visitors’ devices, even if they don’t collect personal data. The GDPR applies whenever you collect personal data from people in the EU, through cookies or anything else, such as forms and orders. The ePrivacy Directive decides when you need consent for cookies. The GDPR covers how you handle the data after that.

Conclusion

2 laws apply to your cookies today: the ePrivacy Directive and the GDPR. The ePrivacy Regulation won’t replace either of them.

Start with the basics: scan your site, block trackers until consent, log every choice, and keep your cookie policy current.

Then keep an eye on the Digital Omnibus. When it passes, the re-prompt timing and consent exemptions will change. If your setup already works, that update will be small.

Need help with cookie consent on WordPress?

Cookie compliance under the ePrivacy Directive and the GDPR comes down to 4 jobs: know what you set, ask before you set it, prove the answer, and let people change their mind. WPLP Cookie Consent handles each one.

• Know what you set. The cookie scanner finds the cookies and scripts on your site and sorts them into categories. That’s the audit from step 1, done for you.
• Ask before you set it. The banner blocks scripts and embeds, like analytics, ad pixels, and YouTube videos, until the visitor consents. Scripts you need to run the site can be whitelisted, so login and cart cookies keep working.
• Prove the answer. Every consent decision is logged in your own WordPress database, not on a third-party server. If a regulator or a visitor asks, you have the record.
• Let people change their mind. Visitors can withdraw consent at any time. You can also set the plugin to ask for consent again on a schedule.

It also has an ePrivacy banner. With auto-detect law, the plugin reads each visitor’s location and shows the banner for the law that applies there. An EU visitor and a California visitor see different banners, from the same site, with no manual switching.

The banner shows in the visitor’s browser language (50+ languages), so people understand what they agree to. Google Consent Mode v2 is built in, so your Google tags follow each visitor’s choice.

WPLP Legal Pages creates the cookie policy and privacy policy your banner links to.

Related reading

• Cookie consent best practices
• How to make your WordPress site cookie compliant
• How to add a cookie banner in WordPress
• GDPR compliance checklist