ePrivacy Directive vs. GDPR: Which Rules Apply to Your Email Communications?

If you are responsible for email compliance at a European organisation, you are operating under not one but two separate EU legal frameworks simultaneously. The GDPR gets most of the attention, but the ePrivacy Directive 2002/58/EC governs specific aspects of electronic communications (including email marketing) independently of the GDPR, and with its own set of rules that can be stricter in practice.

A November 2025 ruling from the Court of Justice of the European Union (CJEU) has clarified how these two frameworks interact. The decision has practical consequences for marketing teams, data protection officers, and legal counsel who assumed that a valid GDPR lawful basis was sufficient to justify sending commercial email.

This article explains the two frameworks, what the CJEU decided, where each set of rules applies, and what it means for your email archiving obligations.

The Two Frameworks and Why They Both Apply

The GDPR is a general regulation governing all personal data processing across the EU. It applies whenever personal data is collected, stored, used, or transmitted - and email almost always involves personal data in the form of names, addresses, and message content.

The ePrivacy Directive is a sector-specific instrument that governs electronic communications networks and services. It predates the GDPR, having first been adopted in 2002 and updated in 2009. Article 5 addresses the confidentiality of communications. Article 13 specifically governs unsolicited commercial communications, including email marketing.

These two instruments do not operate in parallel as equals. The relationship between them is governed by the principle of lex specialis: where a specific rule exists for a particular situation, that specific rule takes precedence over a more general one. The CJEU's November 2025 ruling confirmed that for email marketing, the ePrivacy Directive is the lex specialis - meaning its rules govern, and GDPR consent requirements do not substitute for or supplement the ePrivacy requirements.

CJEU Inteligo Media: What the Court Actually Decided

The case of Inteligo Media SA v ANSPDCP (C-654/23, 13 November 2025) arose from an enforcement action by the Romanian data protection authority against Inteligo Media, a company that provided a freemium news service and sent commercial newsletters to users.

The central questions before the Court were whether newsletter distribution constituted "direct marketing" under Article 13 of the ePrivacy Directive, and whether a freemium arrangement - where users access content at no monetary cost in exchange for receiving commercial communications - amounted to a "sale" triggering the soft opt-in provision in Article 13(2).

The Court held:

Newsletters are direct marketing. The distribution of commercial newsletters falls within the definition of "direct marketing" under Article 13 of the ePrivacy Directive, regardless of the format or editorial framing. This is significant because some operators had argued that editorially curated newsletters were not purely promotional and therefore fell outside Article 13.

Freemium is a sale. A transaction in which a user receives content without monetary payment but agrees to receive commercial email in return constitutes a "sale of a product or service" for the purposes of Article 13(2). The exchange of attention or data for access to content is treated as equivalent to a commercial transaction.

ePrivacy is lex specialis for email marketing. The Court confirmed that the ePrivacy Directive's rules on commercial email take precedence over GDPR consent requirements in this specific context. Operators cannot rely on a GDPR lawful basis alone - such as legitimate interest under Article 6(1)(f) - to justify sending commercial email. The ePrivacy Directive sets the applicable standard, and it must be satisfied independently.

The practical consequence of this ruling is that any organisation sending commercial email to individuals in the EU must comply with Article 13 of the ePrivacy Directive, not simply with the GDPR. The GDPR remains relevant for everything else the organisation does with the recipient's personal data, but the act of sending the commercial email is governed by ePrivacy.

Article 13(2) ePrivacy: The Soft Opt-In Rule

Article 13(2) of the ePrivacy Directive creates an exception to the general requirement for prior consent. It allows organisations to send commercial email to existing customers without fresh consent, subject to four conditions:

The organisation collected the email address directly from the customer in the context of the sale of a product or service.
The commercial email relates to the organisation's own similar products or services.
The customer was given a clear and distinct opportunity to object to such use of their address at the time of collection, free of charge.
The customer is given the opportunity to opt out with each subsequent message.

This is the soft opt-in. It is often misunderstood in two directions: some organisations treat it as a blanket permission to market to anyone who has ever bought anything, while others assume it does not apply and require fresh explicit consent for every communication.

The "similar products or services" condition is the one that generates most disputes. A customer who purchased accounting software can expect to receive emails about upgrades or add-ons to that software. They may not reasonably expect emails about an unrelated HR platform the vendor has acquired. The similarity must be genuine, not stretched to cover any product the vendor sells.

The Inteligo Media ruling's confirmation that freemium arrangements qualify as a "sale" expands the scope of situations where the soft opt-in can apply - but only where all four conditions are satisfied.

The ePrivacy lex specialis principle applies specifically to the act of sending commercial email. The GDPR remains the governing framework in a range of other scenarios involving email.

B2B cold outreach to business addresses. Article 13 of the ePrivacy Directive applies to "natural persons." Business email addresses associated with a legal entity rather than an identifiable individual fall outside its scope in many Member States' implementations. Cold outreach to a generic address such as [email protected] is therefore not governed by ePrivacy Article 13. However, where a B2B address is associated with an identifiable individual - such as [email protected] - national implementations vary, and some Member States extend ePrivacy protections to all email addresses regardless of whether they are personal or professional. Controllers operating across the EU must check the implementation in each Member State where they send B2B cold email.

For B2B outreach where ePrivacy does not apply, the GDPR's legitimate interest ground under Article 6(1)(f) becomes relevant. The controller must conduct and document a legitimate interest assessment (LIA) demonstrating that the interest in sending the communication is not overridden by the data subject's fundamental rights.

Employee email monitoring. Monitoring the content or metadata of employee email communications is governed primarily by the GDPR, supplemented by national employment law. The ePrivacy Directive's confidentiality provisions in Article 5 are relevant where the employer accesses the content of communications rather than merely metadata, but the lawful basis for processing is determined under GDPR. Relevant lawful bases include Article 6(1)(c) (legal obligation, for example under anti-money-laundering rules), Article 6(1)(f) (legitimate interest, subject to the balancing test), or - in some jurisdictions - collective agreements that provide a specific legal basis.

Data retention and archiving of email communications. The decision to archive email, the retention period applied, and the conditions under which archived emails may be accessed are all governed by the GDPR in conjunction with national retention law. The ePrivacy Directive does not set email retention obligations. A controller retaining commercial correspondence under national commercial or tax law does so under Article 6(1)(c) GDPR, not under ePrivacy. The distinction matters because GDPR's Article 17(3)(b) erasure exception applies to lawful retention under Article 6(1)(c) - there is no corresponding ePrivacy mechanism for handling erasure requests.

The Proposed ePrivacy Regulation: Nine Years and Counting

The current ePrivacy Directive is a 2002 instrument, updated in 2009, designed for a different communications environment. The European Commission proposed a new ePrivacy Regulation to replace it in January 2017 - intended to be adopted alongside the GDPR in May 2018. That timeline has long since passed.

As of early 2026, no ePrivacy Regulation has been adopted. The proposal has been subject to repeated revisions in Council and Parliament, with persistent disagreements over cookie consent rules, metadata retention, and the treatment of over-the-top communication services such as messaging apps.

The practical effect of this delay is that organisations continue to operate under a patchwork of national implementations of a directive that is nearly a quarter-century old, supplemented by guidance from national DPAs and, increasingly, CJEU case law such as Inteligo Media.

The proposed Regulation, when eventually adopted, will directly apply across all Member States without national transposition, removing the current variation in implementation. It will also extend to over-the-top services not currently covered by the Directive. However, until it is adopted, the 2002 Directive as nationally implemented remains the operative instrument.

Digital Omnibus: A Proposed Simplification on the Horizon

In November 2025, the European Commission published the Digital Omnibus Regulation proposal (COM(2025) 837), a package intended to reduce regulatory burden on businesses by simplifying certain provisions of both the GDPR and the ePrivacy framework.

The Digital Omnibus proposes, among other measures, a simplified consent framework for lower-risk processing activities and adjustments to the interaction between GDPR and ePrivacy consent requirements. The Commission's stated aim is to reduce friction for SMEs while maintaining substantive protections for data subjects.

The proposal is at an early stage of the legislative process. It must pass through the European Parliament and Council before becoming law, a process that typically takes two to four years for contested legislative proposals. Organisations should not adjust their compliance posture in anticipation of the Digital Omnibus until it is adopted and its transitional provisions are clear.

What the proposal does signal is that the Commission acknowledges the complexity created by overlapping frameworks and the burden this places on controllers. The Inteligo Media ruling, the stalled ePrivacy Regulation, and the Digital Omnibus proposal all reflect the same underlying tension: the current framework is fragmented, and the interaction between instruments is not always predictable without litigation reaching the CJEU.

The interaction between ePrivacy, GDPR, and email archiving generates a set of specific compliance obligations that marketing teams frequently overlook until they face an enforcement action or a data subject complaint.

Proving consent. Where consent is required under Article 13(1) ePrivacy - that is, for any commercial email not falling within the soft opt-in exception - the controller must be able to demonstrate that valid consent was obtained. Under GDPR Article 7(1), the burden of proof lies with the controller. This means you must retain evidence of consent: the timestamp of the consent event, the consent text presented to the user at the time, and the mechanism by which consent was given.

This evidence is ideally captured and retained in a dedicated consent management platform, but email archives can also serve as supporting evidence where consent was communicated via email. An email archive that preserves the original confirmation email sent to a subscriber provides contemporaneous evidence of when the subscription was activated and under what terms.

Documenting opt-out. Both Article 13(1) and Article 13(2) require that recipients be given the opportunity to object or opt out. When a recipient exercises that right, the controller must stop sending commercial email and must document that the opt-out was received and acted upon. Email archives that capture inbound opt-out requests - whether submitted via reply email or a web form confirmation email - provide evidence that opt-outs were received on a specific date.

This is particularly important in enforcement contexts. A DPA investigating a complaint about continued sending after an opt-out request will look for evidence of when the request was received. An archived copy of the opt-out email, with its original timestamp and headers intact, is direct evidence. The absence of that archive makes it harder to demonstrate compliance.

Retention of marketing lists and consent records. Marketing lists themselves - the data records associating an email address with a consent status, opt-in date, and opt-out date - are personal data subject to GDPR retention principles. They should be retained for as long as they are needed to demonstrate compliance, but not indefinitely. A consent record should be retained for the duration of the marketing relationship plus a reasonable period thereafter to respond to complaints or enforcement actions - typically the relevant limitation period under national law, which is often three to five years.

The archiving of email communications that were sent under a particular consent or soft opt-in basis creates a corroborating record: the emails were sent, they reached recipients, they contained opt-out mechanisms. This chain of evidence becomes relevant if a recipient later claims they never consented or never received an opt-out opportunity.

Interaction with the right to erasure. Where a data subject requests erasure of their data, including their email address and associated consent record, the controller must comply unless a legal basis for retention exists. A commercial email archive does not in itself provide a legal basis for retaining a contact's personal data indefinitely after they have opted out and requested erasure. Once the soft opt-in relationship ends and no other legal basis applies, the contact's personal data should be deleted - including from the archive.

The practical solution is to maintain marketing contact records separately from the email archive, with their own retention schedule, and to ensure that erasure requests trigger deletion from both systems. An email archive that makes per-message or per-contact deletion difficult to implement will create compliance gaps when erasure requests arrive.

What This Means for Compliance Teams

The Inteligo Media ruling is not an abstract development for academic commentary. It has direct operational consequences:

Marketing teams relying on GDPR legitimate interest as the basis for commercial email campaigns to consumers need to revisit their legal basis. Legitimate interest under GDPR Article 6(1)(f) does not satisfy the ePrivacy Directive's consent requirement. If the ePrivacy soft opt-in conditions are not met, prior consent is required.

DPOs reviewing records of processing activities should confirm that commercial email activities are documented under the correct legal framework - ePrivacy Article 13 for the sending of commercial email, GDPR Article 6 for the underlying personal data processing - and that the two are not conflated in the ROPA.

Legal teams advising on B2B cold outreach should map each target jurisdiction's national implementation of the ePrivacy Directive to determine whether the business address exception applies, and should document legitimate interest assessments for jurisdictions where ePrivacy does not apply but GDPR does.

Archive operators and IT teams should confirm that inbound opt-out emails are captured by the archive, that consent confirmation emails are retained, and that per-contact deletion procedures work correctly across both the marketing platform and the email archive.

EasyMailArchive is built to support the evidentiary requirements that ePrivacy and GDPR compliance generates:

Tamper-proof message storage preserves consent confirmation emails, opt-out requests, and marketing communications with original timestamps and headers intact, providing auditable evidence for regulatory investigations
Immutable audit logs record every access to archived messages, supporting the purpose limitation principle and demonstrating that archive access is restricted to authorised compliance and legal purposes
Configurable retention policies allow marketing contact archives and consent records to be managed with separate retention schedules from operational email, so that erasure of marketing data does not require deletion of legally mandated business correspondence
Per-message deletion supports targeted erasure in response to data subject requests, enabling compliance with GDPR Article 17 without requiring bulk deletion or archive reconstruction
EU-hosted infrastructure ensures all archived data remains within EU jurisdiction, simplifying cross-border data transfer analysis under GDPR Chapter V