On November 16, 2023, the European Data Protection Board (“EDPB”) issued draft Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive (“Guidelines”).
Article 5(3) is the provision that requires consent before storing or accessing information on an end user’s device.
In these Guidelines, the EDPB addresses the applicability of Article 5(3) of the ePrivacy Directive to
different technical solutions.
These Guidelines expand upon the Opinion 9/2014 of the Article 29 Working Party on the application of ePrivacy Directive to device fingerprinting and aim to provide a clear understanding of the technical operations covered by Article 5(3) of the ePrivacy Directive.
The emergence of new tracking methods to both replace existing tracking tools (for example, cookies,
due to discontinued support for third-party cookies) and create new business models has become a
critical data protection concern.
While the applicability of Article 5(3) of the ePrivacy Directive is well established and implemented for some tracking technologies such as cookies, there is a need to remove ambiguities related to the application of the said provision to emerging tracking tools.
The Guidelines identify four key elements for the applicability of Article 5(3) of the ePrivacy Directive
(section 2.1), namely ‘information’, ‘terminal equipment of a subscriber or user’, ‘gaining access and
‘stored information and storage’.
The Guidelines further provide a detailed analysis of each element (section 2.2-2.6).
In section 3, that analysis is applied to a non-exhaustive list of use cases representing common
techniques, namely:
– URL and pixel tracking
– Local processing
– Tracking based on IP only
– Intermittent and mediated Internet of Things (IoT) reporting
– Unique Identifier
The Guidelines are open for public consultation until December 28, 2023.
