New Development: EDPB provides clarification on tracking techniques covered by the ePrivacy Directive

On 14 November 2023, the European Data Protection Board (EDPB) adopted a set of new guidelines (the Guidelines) on the technical scope of Article 5(3) of the ePrivacy Directive (the ePD). The Guidelines seek to elucidate the scope of the ePD and its applicability to emerging tracking tools. While the effective use of Article 5(3) is widely recognised and applied to certain tracking technologies like cookies, further clarity was needed regarding the application of this provision to new tracking methods, in order to remove ambiguity for data controllers and individuals.

The Guidelines clarify that the scope of Article 5(3) of the ePD extends beyond cookies and will also apply to emerging tracking methods. In doing so, the EDPB identified four key elements for the applicability of Article 5(3), offering a detailed analysis of each: “information”, “terminal equipment of a subscriber or user”, “gaining access” and “stored information and storage”. Further, the Guidelines also examine a number of specific use cases, including URL and pixel tracking, local processing, tracking based on IP, intermittent and mediated Internet of Things reporting and unique identifier collection.

In the UK, the Privacy and Electronic Communications Regulations (PECR) implement the ePD, with Article 5(3) of the ePD being reflected as Section 6 of the PECR. PECR complements the general data protection regime, (under the Data Protection Act 2018 and the UK GDPR) and stipulates specific privacy rights on electronic communications. Whilst the new Guidelines are not directly applicable to PECR, given that the UK has left the EU, they may offer further guidance into newly emerging tracking tools. For further information on Section 6 of PECR, the ICO has published guidance on the use of cookies and tracking technologies

Winter 2023