{"id":118276,"date":"2019-11-05T07:26:01","date_gmt":"2019-11-05T06:26:01","guid":{"rendered":"https:\/\/ceadigilaw.org\/el-reglamento-europeo-de-eprivacy-y-las-cookies-que-necesito-saber\/"},"modified":"2026-07-17T21:34:11","modified_gmt":"2026-07-17T19:34:11","slug":"el-reglamento-europeo-de-eprivacy-y-las-cookies-que-necesito-saber","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/en\/blog\/el-reglamento-europeo-de-eprivacy-y-las-cookies-que-necesito-saber\/","title":{"rendered":"The European ePrivacy Regulation and Cookies \u2014 What Do I Need to Know?"},"content":{"rendered":"<h4>Just after the General Data Protection Regulation (GDPR), another EU law on personal privacy is in the process of being approved. ePrivacy regulation, which was initially due to have been finalized by the date of entry into force of the GDPR, 25 May 2018, should now be adopted throughout 2019, with a date of entry into force still to be decided.<\/h4>\n<h4>What is the ePrivacy Regulation about? What is its relationship with GDPR and why do we need two sets of laws in this area? What are the requirements of the ePrivacy Regulation? What will it entail for the use of cookies on your website and how can you prepare them? Find the answers below.<\/h4>\n<h2>What is the ePrivacy Regulation? I Definition<\/h2>\n<hr \/>\n<p>The Bill for the\u00a0<strong>Privacy and Electronic Communications Regulations<\/strong>, also known as the\u00a0<strong>ePrivacy Regulations<\/strong>, is a law in the process of being approved by the European Commission.<\/p>\n<p>The purpose of this law is to ensure \u201crespect for privacy, confidentiality of communication and protection of personal data in the field of electronic communications\u201d in the EU.<\/p>\n<p>Once in operation, the ePrivacy Regulation will replace the\u00a0<strong>ePrivacy Directive<\/strong>\u00a0The Commission has been asked to take a decision on the application of the Directive to the public sector.\u00a0<strong>\u201cThe Cookie Act\u201d<\/strong>\u00a0(one of its most visible impacts has been the consent pop-ups of cookies, which make their appearance on most of the web home pages).<\/p>\n<p>Once the ePrivacy Directive is replaced by the ePrivacy Regulation, the legislation will automatically be extended in all EU countries.<\/p>\n<p>That is, in fact, the main difference between a regulation and a regulation. Directive: while regulations automatically become legally binding throughout the EU from the date of their entry into force, directives must be incorporated into the laws of the Member States themselves.<\/p>\n<p>With a directive, countries are required to reach a result, but are free to choose how to do so. However, the regulation is not simply a stricter version of the directive.<\/p>\n<p>The proposed law is based on a thorough evaluation of the directive, and addresses, on the one hand, the deficiencies of the directive and, on the other, the digital and legislative advances (such as GDPR) that have occurred since its last revision in 2009.<\/p>\n<p>To date twodrafts: one of the\u00a0<a href=\"https:\/\/ec.europa.eu\/digital-single-market\/en\/news\/proposal-regulation-privacy-and-electronic-communications\" target=\"_blank\" rel=\"noopener noreferrer\">European Commission<\/a>\u00a0and another of\u00a0<a href=\"http:\/\/www.europarl.europa.eu\/sides\/getDoc.do?type=REPORT&amp;mode=XML&amp;reference=A8-2017-0324&amp;language=ES\" target=\"_blank\" rel=\"noopener noreferrer\">Community Parliament<\/a>.<\/p>\n<p>National governments in all 28 Member States, including the United Kingdom, have had the opportunity to appeal the proposal for a regulation.<\/p>\n<p>The EU Commission, the Community Parliament and the Council are currently in discussions, the so-called \u201ctrigger negotiations\u201d, which will result in the official text of the Regulation. The ePrivacy Regulation, originally planned to be adopted simultaneously with the entry into force of the GDPR, will probably be finalized throughout 2019.<\/p>\n<p>A from there, will follow a period of adaptation before it becomes operational as a law of the EU.<\/p>\n<p>As well as the GDPR, which was approved on 14 April 2016 and entered into force two years later, on 25 May 20162018.<\/p>\n<h3>What does the ePrivacy Regulation entail for my use of cookies?<\/h3>\n<p>Cookies are an important issue and controversial matter in the negotiations regarding the final drafting of the ePrivacy Regulation.<\/p>\n<p>The proposed law seeks to address the \u201cfatigue of consent\u201d caused by the Cookie Act.<\/p>\n<p>The problem with consent in the ePrivacy directive is that it has been interpreted in most countries as a requirement by aconsent banner as follows:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.cookiebot.com\/media\/1037\/screen-shot-2017-12-20-at-091947.png?width=303&amp;height=173\" alt=\"\" data-udi=\"umb:\/\/media\/293bee483b884f4fac85c66899997bbd\" \/><\/p>\n<p>This has proven highly ineffective because:<\/p>\n<ol>\n<li>Most people don&#8217;t know what they&#8217;re giving their consent to when they click the box.<\/li>\n<li>Too many consent requests bother and burden users, who end up ignoring requests or accepting them without thinking.<\/li>\n<li>The absence of a response is interpreted as consent.<\/li>\n<\/ol>\n<p>The regulation is therefore trying to make changes in the way that the crawlers can request the consent of the establishment of cookies and to follow up users.<\/p>\n<p>The assessment of the directive concludes that the current consent rule is both too inclusive and not exhaustive:<\/p>\n<ul>\n<li><strong>In excess inclusive<\/strong> because it also covers non-private intrusive practices, and<\/li>\n<li><strong>Little exhaustive<\/strong>, because it does not clearly cover with some tracking techniques (e.g., device footprints) that may not involve access\/storage on the device.<\/li>\n<\/ul>\n<h2>Cookies Requirements: How can I prepare for the ePrivacy Regulation?<\/h2>\n<hr \/>\n<p>As mentioned above, the last word about the direct implications of the ePrivacy Regulation and its use of cookies still has to be said.<\/p>\n<p>However, here is a list of requirements for cookies and online tracking of the latest draft.<\/p>\n<p>AReaders familiar with GDPR requirements will notice redundancy. In fact, many of the rules in the ePrivacy Regulation are similar to those described by GDPR.<\/p>\n<p> Thus, as we describe below in this article, the ePrivacy Regulation will complement (and invalidate) once in force the GDPR in cases of the electronic communications field.<\/p>\n<ul>\n<li><strong>Prior Consent<\/strong>. Consent must be obtained prior to the establishment of cookies, except strictly necessary.<\/li>\n<li>The\u00a0<strong>consent should be freely granted, as a free and unequivocal action<\/strong>. Consent to the use of cookies through clear and affirmative action. Banners simply reporting the use of cookies or inducing \u201caccept cookies\u201d will not be valid from now on.<\/li>\n<li><strong>Clear and understandable language<\/strong>. Like GDPR, the ePrivacy Regulation requires that information about cookies and what consent is being given should be communicated in simple and understandable language, without legalism.<\/li>\n<li>The\u00a0<strong>browser footprint should be subject to such requirements<\/strong> Cookies rules should also be applied to the browser&#8217;s footprint, a process that seeks to identify users unequivocally using your browser settings (without currently setting a cookie in that browser).<\/li>\n<li>The\u00a0<strong>cookies for purely analytical purposes shall be exempt from that rule<\/strong> Recognizing that they are not interfering in personal privacy, the regulation proposes that cookies for web analysis should be exempt from the consent requirement. However, the proposal only covers own cookies. It is not yet clear whether external services such as Google Analytics would benefit from that exception.<\/li>\n<li><strong>New requirements for browsers<\/strong> Browsers should contain control of cookies and users should choose those established as part of the installation process. In theory, these settings could demonstrate consent to certain cookies, although it seems that there is little desire on the part of legislators to accept browser settings as sufficient.<\/li>\n<\/ul>\n<h3>When will the ePrivacy regulation come into force?<\/h3>\n<p>The ePrivacy regulation originally aspired to be approved in the EU together with the implementation of GDPR on May 25, 2018.<\/p>\n<p>However, it was soon found that this programme was too ambitious.<\/p>\n<p>In the last notice, the regulation will be finalized throughout 2019.<\/p>\n<p>Then, it will continue a period of adaptation, before the regulation isKEALITERAL0003TOKENIf we dare to take the GDPR process as an example, one may assume that the ePrivacy Regulation will enter into force in 2021.<\/p>\n<p>However, there are indications that the ePrivacy Regulation will be even broader and more restrictive than the GDPR when it comes to preventing online monitoring and the protection of personal data on the internet.<\/p>\n<p>both, it has met with the opposition of critics for counteracting the internet economy and paralyzing entire sectors, such as publishers and digital media.<\/p>\n<h2>Timeline and Update: What is the status of the ePrivacy Regulations?<\/h2>\n<hr \/>\n<p><strong>10 January 2017: First draft submitted by the EU Commission<\/strong><\/p>\n<p>The first formal draft of the new ePrivacy Regulation is presented by the EU Commission. The proposed Regulation should replace the ePrivacy Directive (Directive 2009\/136\/EC) and clarify and supplement the GDPR, with regard to personal data from electronic communications.<\/p>\n<p><strong>19 October 2017: Draft adopted in European Parliament<\/strong><\/p>\n<p>After lengthy negotiations, the LIBE committee (Civil Freedom, Justice and Home Affairs) responsible for the ePrivacy Regulation in the Community Parliament voted on the draft. Faced with the surprise of the online industry, the virtually unchanged draft was adopted by the EU Parliament a week later. At the same time, the European Council also discussed the draft in a working group. Member states are invited to present their opinions until August 14.<\/p>\n<p><strong>2018: Triangular dialogue between the Commission, Parliament and the Council<\/strong><\/p>\n<p>With the adoption of the draft by the European Parliament, the order is given for the next stage of the process &#8211; the European Parliament&#8217;s negotiations with the European Council.<\/p>\n<p>In 2018, so-called trilateral negotiations between the Commission, Parliament and the Council are still to be concluded.<\/p>\n<p><strong>2019: Implementation<\/strong><\/p>\n<p>The Commission has announced that it maintains its goal of May 25, 2018, and experts expect its implementation in 2019.<\/p>\n<h3>Text: Where can I find the latest draft of the ePrivacy Regulation?<\/h3>\n<p>The official draft of the ePrivacy Regulation and its annexes can be found on the Europa Commission page.<\/p>\n<p>On this page of the ongoing work of the regulation you can find:<\/p>\n<ul>\n<li>The latest draft of the current proposal<\/li>\n<li>the assessment of the ePrivacy Directive<\/li>\n<li>the impact assessment documents; and<\/li>\n<li>translations into EU languages.<\/li>\n<\/ul>\n<h2>What is the difference between the ePrivacy Regulation and GDPR?<\/h2>\n<hr \/>\n<p>The ePrivacy Regulation is a regulatory specialty (lex specialis) of the General Data Protection Regulation, which means that it complements GDPR with specific rules, which are specifically applied in the electronic communications sector.<\/p>\n<p>As lex specialis invalidates GDPR in the specific areas it covers.<\/p>\n<p>There are two laws because they derive from two laws.rights other than the Europe Charter of Human Rights:<\/p>\n<p>The GDPR covers the right to protection of personal data, while the ePrivacy Regulation covers the right of the person to a private life, including confidentiality.<\/p>\n<h3>What is the scope of the ePrivacy vs GDPR Regulation?<\/h3>\n<p>GDPR focuses on the definition and protection of personal data, e.g. health data, whether electronic or paper. ePrivacy Regulation, on the other hand, specialises GDPR by electronic communications and focuses on devices, processing techniques, storage, browsers, etc.<\/p>\n<h2>Sources<\/h2>\n<hr \/>\n<p><a href=\"https:\/\/ec.europa.eu\/digital-single-market\/en\/news\/proposal-regulation-privacy-and-electronic-communications\" target=\"_blank\" rel=\"noopener noreferrer\">European Commission: Proposal for a Regulation on Privacy and Electronic Communications<\/a><\/p>\n<p><a href=\"https:\/\/iapp.org\/media\/pdf\/resource_center\/Cullen-Intl-epriv-reg-infographic.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Nice infographic illustration of the Trialogue Negotiations of the ePrivacy Regulation<\/a><\/p>\n<p><a href=\"https:\/\/www.eprivacy.eu\/en\/about-us\/news-press\/news-detail\/article\/what-does-the-eprivacy-regulation-mean-for-the-online-industry\/\" target=\"_blank\" rel=\"noopener noreferrer\">ePrivacy.eu: Timeline info<\/a><\/p>\n<p><a href=\"https:\/\/www.i-scoop.eu\/gdpr\/eu-eprivacy-regulation\/\" target=\"_blank\" rel=\"noopener noreferrer\">i-SCOOP: The new EU ePrivacy Regulation: what you need to know<\/a><\/p>\n<p><a href=\"https:\/\/digiday.com\/media\/winners-losers-eus-new-eprivacy-law\/\" target=\"_blank\" rel=\"noopener noreferrer\">Digiday.com: On the consequences of the ePrivacy Regulation for advertisers, websites, browsers, etc.<\/a><\/p>\n<p><a href=\"https:\/\/www.privacytrust.com\/guidance\/gdpr-vs-eprivacy-regulation.html\" target=\"_blank\" rel=\"noopener noreferrer\">Privacytrust.com: Simple explanation of the difference between GDPR and ePrivacy<\/a><\/p>\n<p><a href=\"https:\/\/martechtoday.com\/right-behind-gdpr-theres-eprivacy-regulation-208717\" target=\"_blank\" rel=\"noopener noreferrer\">Martechtoday: On the differences between the GDPR and the ePr<\/a><\/p>\n<p><a href=\"https:\/\/www.marketingweek.com\/2018\/02\/08\/eprivacy-cookies-data-laws\/\" target=\"_blank\" rel=\"noopener noreferrer\">Marketingweek: About ePrivacy<\/a><\/p>\n<p><a href=\"https:\/\/medium.com\/mydata\/consent-lost-gdpr-and-found-eprivacy-e85cf881ffb\" target=\"_blank\" rel=\"noopener noreferrer\">Medium.com: Good article about consent<\/a><\/p>\n<p><a href=\"http:\/\/www.likeabadmovie.eu\/\" target=\"_blank\" rel=\"noopener noreferrer\">Publishers&#8217; joint campaign against the ePrivacy Regulation<\/a><\/p>\n<p><a href=\"https:\/\/iapp.org\/news\/a\/what-happens-to-eprivacy-under-the-romanian-presidency\/?mkt_tok=eyJpIjoiWVRjME1HUTBZelV4WlRVeCIsInQiOiJxZjNqcmRKbFwvZEpiYitmUDdqMVNOdTNCcEgyTlVmdkxGUmlLamlzZkdhUmVFNVRUcUhvVUs4UyszRkhQQjN5Y1VTTStcL1ZZSHZnZnhsM1VIVXh3bFNCTU1OSlhCZkZsM1c4THRxNzdJdXdiYVBmc0JpVnhlVDQ1bDQycjZSZVRGIn0%3D\" target=\"_blank\" rel=\"noopener noreferrer\">IAPP: What happenings to ePrivacy under the Romanian presidency?\u00a0<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Just after the General Data Protection Regulation (GDPR), another EU law on personal privacy is in the process of being approved. ePrivacy regulation, which was initially due to have been finalized by the date of entry into force of the GDPR, 25 May 2018, should now be adopted throughout 2019, with a date of entry [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":5895,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1107],"tags":[],"cea_women":[],"class_list":["post-118276","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection-privacy"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/comments?post=118276"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118276\/revisions"}],"predecessor-version":[{"id":119332,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118276\/revisions\/119332"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media\/5895"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media?parent=118276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/categories?post=118276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/tags?post=118276"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/cea_women?post=118276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}