A side-by-side comparison of the draft versus final ePrivacy guidelines

So, here’s the comparison between the EDPB’s new ePrivacy Guidelines and the version that was up for public consultation end of 2023. As you can see, not much has changed. The fundamental issues that affected the previous version (competence, overbroad interpretation that doesn’t match the actual meaning of words or the intention of the legislator, etc.) continue to affect this one. The EDPB received a serious amount of feedback saying “don’t interpret ‘gaining access’ or ‘storage’ this way”, but doesn’t even address that feedback – even the feedback from Traficom (the Finnish ePrivacy regulator) on this point seems to have been disregarded.
In other words, *pretty much every single computer interaction* is now subject to the ePrivacy “cookie” rule according to the EDPB, with all the consequences that this entails.
This was the EDPB’s chance to show that consultations mean something, and if you ask me, they missed the mark by a mile.

What does it all mean?

First, it means that *the ePrivacy regulators who are in fact EDPB members will start to apply the Guidelines*. This is significant.

Second, most of the arguments I raised in my own critique remain relevant:
– Part I (competence): https://lnkd.in/egwqt-mf
– Part II (content): https://lnkd.in/ehdihkSM
Read also some of the feedback on the previous guidelines:
– Submission on behalf of certain clients: https://lnkd.in/eiCDEr9p
– IAB Europe submission: https://lnkd.in/eWPwzwFQ
– Submission by Traficom: https://lnkd.in/eDrz7y97

Third, it means that if you ever wanted to challenge EDPB guidelines, well, now might be the time.
Reach out if you need a hand.

Edit: see my comment below for input on what footnote 28 means – and the underlying arbitrary distinction: https://lnkd.in/eqqTBWvN

data protection GDPR