The European Data Protection Board released Guidelines 2/2023 on the technical scope of article 5(3) of ePrivacy Directive and welcomes comments until 28th December 2023.

Article 5(3) traditionally applies to cookies to limit the right for service providers to use electronic communications networks to store or to gain access to information stored in terminal equipment of endusers. Such storage or access to information is subject to (i) a clear and comprehensive information and (ii) the right to refuse such processing.

The emergence of new tracking methods to replace cookies is considered by the EDPB as a critical data protection concern and the Guidelines 2/2023 aim to remove ambiguities related to the application of article 5(3) to these new tracking tools.

After clarifying the key elements for the applicability of article 5(3), the Guidelines provide a list of use cases, including tracking pixels or tracked URLs, local processing, tracking based on IP adresses, intermittent and mediated Internet of Things (IoT) reporting and unique identifier.