Skip to main content
Audact
See the offer

ePrivacy

ePrivacy governs the sending. GDPR governs what happens next.

In force · transposed per Member State

Last reviewed: 6 October 2026

The ePrivacy Directive is lex specialis for electronic communication: it decides whether a marketing message may be sent at all, and it is technology-neutral, so an AI composing the message changes nothing. Article 13 requires prior opt-in consent for automated calling systems, email, SMS and any electronic messaging. A GDPR consent captured for a different purpose does not satisfy it, and the rules take their operative form in national law rather than in the Directive itself.

What the law requires

Prior opt-in consent is required for direct marketing by automated calling systems, email, SMS, or any electronic messaging. The rule is written around the act of sending, not around who or what composed the message.
Directive 2002/58/EC, Art. 13(1)
A narrow exception exists for existing customers: the contact details were obtained in the context of a sale, the marketing concerns similar products or services, and an easy opt-out is offered at collection and in every message.
Directive 2002/58/EC, Art. 13(2)
Every message must identify the sender on whose behalf it is sent and provide a valid address for withdrawing consent.
Directive 2002/58/EC, Art. 13(4)
Consent is required before storing information on, or reading information from, a person's terminal equipment. That reaches cookies, local storage and SDKs, but not the conversation itself.
Directive 2002/58/EC, Art. 5(3)
It is a directive, so the operative rule is the national transposition: TDDDG in Germany, the Telecommunicatiewet in the Netherlands, PECR in the United Kingdom.
Directive 2002/58/EC, Art. 17
Germany requires prior express consent for advertising email even between businesses, with very narrow exceptions.
§ 7 UWG
In Germany, certain violations carry an administrative fine of up to €300,000.
§ 28 TDDDG
The standalone ePrivacy Regulation was formally withdrawn by the Commission on 11 February 2025. The Directive remains in force.
Commission work programme 2025, withdrawal of pending proposals

What Audact does about it

Consent is checked before the message goes out, not sampled afterwards. No recorded opt-in, no send.
In development
The rule that applies is resolved per country, per channel and per message type. A single global business-to-business flag is not a setting the policy engine offers, because it is not a position any national law supports.
In development
Consent is captured and held by you; the receipt does not establish that it was validly obtained. Before dialling, the platform checks the calling hours for the call's jurisdiction today.
In development
Germany is checked by a person against the national text and § 7 UWG; the Dutch layer is being built to the same standard.
Germany: active · Netherlands in progress

Lex specialis

Why a GDPR consent does not carry across.

The two regimes divide the work. ePrivacy governs the act: sending the communication, or reaching into the device. GDPR governs the processing of the personal data that follows. Where ePrivacy has a specific rule, it takes precedence, and where it demands consent it demands its own.

The practical consequence is unglamorous and expensive to get wrong: a consent collected for account administration, or under a legitimate-interest assessment, does not become a marketing opt-in because the message is useful. The basis has to be captured for the purpose it will be used for, and it has to be recorded in a way that survives a question about a specific message eighteen months later.

Business to business

The most fragmented part of the Directive, and the one most often assumed away.

The Directive lets Member States permit direct marketing to legal persons on an opt-out basis, but does not require them to. The result is a patchwork. The United Kingdom exempts corporate subscribers from the strict opt-in for live calls and faxes, though not for SMS or email to a named employee. France allows opt-out marketing to professional addresses where the message relates to the recipient's job. Germany goes the other way and requires prior express consent even for business email.

For an outbound system, that means the recipient's country, the channel and the nature of the message have to be resolved before each send, and the decision recorded. A single global exemption flag is not a shortcut, it is a defect that produces confident non-compliance at scale.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

Does ePrivacy apply to AI-generated messages?
Yes. The Directive is technology-neutral: an AI sending a marketing email, SMS or WhatsApp message is treated exactly as a person sending one. What matters is the sending, not the authorship.
Does a GDPR consent satisfy ePrivacy?
No. ePrivacy is lex specialis and requires its own prior opt-in for the communication. The two are assessed separately and a consent captured for one does not carry to the other.
What about business-to-business outbound?
It depends on the country. Business-to-consumer always requires opt-in. For business addresses, some Member States allow an opt-out basis for certain channels while Germany requires prior express consent under § 7 UWG. Resolve it per recipient, not per campaign.
Is the ePrivacy Regulation still coming?
The standalone Regulation was formally withdrawn by the Commission on 11 February 2025 after years of deadlock. The 2002 Directive, as transposed in each Member State, remains the operative law.

The check runs before the send, not after

Control shows where the consent gate sits in the flow, how the country and channel are resolved, and what the record of that decision looks like afterwards.

How Control works

Related