ePrivacy Directive

Directive 2002/58/EC, as amended · transposed in Portugal by Law 41/2004

01What it is

The ePrivacy Directive governs confidentiality of electronic communications, the storing of and access to information on a user's terminal equipment, traffic and location data, and unsolicited direct marketing.

It is the instrument that actually governs cookies — not the GDPR, which is where the confusion usually starts.

The Directive, not the Regulation. The proposed ePrivacy Regulation was negotiated for years and never adopted. What is in force is the Directive, as amended, and its national transposition. Practitioners routinely conflate the two.

02Who it applies to

Providers of publicly available electronic communications services, and — for the rules on terminal equipment and direct marketing — anyone operating a website, app or marketing programme reaching users in Portugal.

National transpositions diverge, particularly on the soft opt-in for existing customers and on marketing to business contacts. A group framework designed elsewhere frequently gets Portugal wrong.

03Core obligations

Consent before storing information on, or accessing information in, a user's terminal equipment, subject to the strictly-necessary and communication-transmission exemptions
Confidentiality of communications and of traffic data
Rules on location data beyond what is needed to convey the communication
Prior consent for unsolicited direct marketing by electronic means, subject to the soft opt-in
Identification of the sender and a working opt-out in every marketing communication
Security of the service and notification duties for providers of electronic communications services

04Timeline

31 October 2003Transposition deadline.
2009Amended by Directive 2009/136/EC, introducing the consent requirement for cookies in its current form.
OngoingCJEU case law (Planet49, Orange România) and CNPD practice continue to define what valid consent looks like.

05Where it meets the other regimes

ePrivacy ↔ GDPR — order of operations

The Directive requires consent for the storing of, or access to, information on the device. The GDPR then governs what you do with what you collected, and defines what consent must mean. The order matters: legitimate interests cannot rescue a cookie placed without consent, because the ePrivacy requirement is engaged before the lawful-basis question arises.

ePrivacy ↔ AI Act

Where tracking data feeds profiling or an AI system, the analysis runs across all three regimes — consent for the collection, lawful basis and transparency for the processing, and classification and obligations for the system itself.

06What we are instructed on

ePrivacy and cookie compliance, consent mechanisms, AdTech arrangements, direct marketing programmes, and CNPD proceedings arising from them.

The practice →

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.