### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content or make that data anonymous after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a third party entrusted by them to record , store or otherwise process such data , in accordance with regulation 2016 / 679 . ### without prejudice to point of article 6 and points , and of article 6 , the provider of the electronic communications service shall erase electronic communications content or make that data anonymous after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a party , which could be the provider of the electronic communication service , specifically entrusted by the end - user to record , store or otherwise process such data . the end - user may further process the content in accordance with regulation 2016 / 679 , if applicable .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in clear and easily understandable language , provided separately from the terms and conditions of the provider , the user or users concerned have given their specific consent to the processing of their communications metadata for one or more specified purposes , including for the provision of specific services to such users , provided that the purpose or purposes concerned could not be fulfilled without the processing of such metadata .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of processing and storage capabilities of terminal equipment and the collection of information from users ' terminal equipment , or making information available through the terminal equipment , including information about or generated by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### infringements of the principle of confidentiality of communications , permitted processing of electronic communications data , time limits for erasure pursuant to articles 5 , 6 , and 7 shall , in accordance with paragraph 1 of this article , be subject to administrative fines up to 20 000 000 eur , or in the case of an undertaking , up to 4 % of the total worldwide annual turnover of the preceding financial year , whichever is higher . ### infringements of the following provisions of this regulation shall , in accordance with paragraph 1 , be subject to administrative fines up to 20 000 000 eur , or in the case of an undertaking , up to 4 % of the total worldwide annual turnover of the preceding financial year , whichever is higher :


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of hardware or software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers and activates as default the option to prevent the cross - domain tracking and storing information on the terminal equipment by other parties ; this is often presented as ‘ reject third party trackers and cookies’ . such privacy settings should be presented in an easily visible and intelligible manner . information provided should not dissuade users from selecting higher privacy settings and should include relevant information about the risks associated to allowing cross - domain trackers , including the compilation of long - term records of individuals’ browsing histories and the use of such records to send targeted advertising or sharing with more third parties . in case of no active choice , or action from the user , the settings shall be set by default in a manner that rejects and blocks trackers , including cookies , that are not strictly necessary in order to provide an information society service specifically requested by the user .


### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content or make that data anonymous after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a third party entrusted by them to record , store or otherwise process such data , in accordance with regulation 2016 / 679 . ### without prejudice to points and of article 6 , the provider of the electronic communications service shall erase electronic communications content after receipt by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a party , which could be the provider of the electronic communication service , specifically entrusted by the subscriber to record , store or otherwise process such data . the subscriber may further process the data in accordance with regulation 2016 / 679 , if applicable .


### protection of electronic communications of natural and legal persons and of information stored in their terminal equipment ### protection of electronic communications of natural and legal persons and of information processed by and related to their terminal equipment


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to users , for example when they enter stores , with personalised offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . in addition , such providers should either obtain the user ' s consent or anonymise the data immediately while limiting the purpose to mere statistical counting within a limited time and space and offering effective opt - out possibilities .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wi - fi access points situated at different places within a city , for example department stores , shopping malls and hospitals , as well as airports , hotels and restaurants . those wi - fi access points might require a login or provide a password and might be provided also by public administrations . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in addition , this regulation should apply to closed social media profiles and groups that the user has restricted or defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate intranet networks , access to which is limited to members of an organisation .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier may be necessary to link the positions of individuals at certain time intervals . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where processing of electronic communications metadata is envisaged , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users’ consent . ### any processing of electronic communications data or any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , by persons other than the end - users , should be prohibited . when the processing is allowed under any exception to the prohibitions under the this regulation , any other processing of the electronic communications data on the basis of article 6 of the regulation 2016 / 679 shall be considered as prohibited , including processing for another purpose on the basis of article 6 of that regulation . this would not prevent controllers from asking for additional consent for new processing operations . the prohibition of interception of communications data should apply also during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee and any temporary files in the network after receipt . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , and analysis of end users’ electronic communications metadata , including browsing habits without the end - users’ consent .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any processing of electronic communications data , including any interference with electronic communications data such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance of electronic communications data , by persons other than the users , shall be prohibited , except when permitted by this regulation . this includes electronic communications data that is stored after the transmission has been completed .


### ‘ electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting , distributing or exchanging electronic communications content ; including data used to trace and identify the source and destination of a communication , data on the location of the device generated in the context of providing electronic communications services , and the date , time , duration and the type of communication ; ### ' electronic communications metadata ' means all data processed for the purposes of transmitting , distributing or exchanging electronic communications content ; including data used to trace and identify the source and destination of a communication , electronic identifiers and any other data broadcasted or emitted by the terminal equipment , data on the location of the terminal equipment processed in the context of providing electronic communications services , and the date , time , duration and the type of communication ; where metadata of other electronic communications services or protocols are transmitted , distributed or exchanged by using the respective service , they shall be considered electronic communications content for the respective service ;


### end - users may consent to the processing of their metadata to receive specific services such as protection services against fraudulent activities . in the digital economy , services are often supplied against counter - performance other than money , for instance by end - users being exposed to advertisements . for the purposes of this regulation , consent of an end - user , regardless of whether the latter is a natural or a legal person , should have the same meaning and be subject to the same conditions as the data subject’s consent under regulation 2016 / 679 . basic broadband internet access and voice communications services are to be considered as essential services for individuals to be able to communicate and participate to the benefits of the digital economy . consent for processing data from internet or voice communication usage will not be valid if the data subject has no genuine and free choice , or is unable to refuse or withdraw consent without detriment . ### users may consent to the processing of their electronic communications data to receive specific services requested by them , such as protection services against malware , unsolicited communication , or fraudulent activities . consent for processing electronic communications data will not be valid if the data subject has no genuine and free choice , or is unable to refuse or withdraw consent without detriment . without prejudice to article 7 of regulation 2016 / 679 , consent should not be considered as freely given if it is required to access any service or obtained through insisting and repetitive requests . in order to prevent such abusive requests , users should be able to order service providers to remember their choice not to consent and to adhere to technical specifications signalling not to consent , withdrawal of consent , or an objection .


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such electronic communications metadata may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should only be permitted to process such electronic communications metadata based on the consent of the users concerned .


### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 . ### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any processing of content data of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of electronic communications data , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always carry out an impact assessment as provided for in regulation 2016 / 679 and if necessary under that regulation , consult the supervisory authority prior to the processing . after electronic communications content has been sent by the user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by another party entrusted by them to record or store such data , which could be the electronic communications provider . any processing of such stored communications data where the data is stored on behalf of the end - user must comply with this regulation . the end - user may further process the data , and if it contains personal data , must comply with regulation 2016 / 679 .


### when the processing of electronic communications data by providers of electronic communications services falls within its scope , this regulation should provide for the possibility for the union or member states under specific conditions to restrict by law certain obligations and rights when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests , including national security , defence , public security and the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including the safeguarding against and the prevention of threats to public security and other important objectives of general public interest of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , or a monitoring , inspection or regulatory function connected to the exercise of official authority for such interests . therefore , this regulation should not affect the ability of member states to carry out lawful interception of electronic communications or take other measures , if necessary and proportionate to safeguard the public interests mentioned above , in accordance with the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms , as interpreted by the court of justice of the european union and of the european court of human rights . providers of electronic communications services should provide for appropriate procedures to facilitate legitimate requests of competent authorities , where relevant also taking into account the role of the representative designated pursuant to article 3 . ### when the processing of electronic communications data by providers of electronic communications services falls within its scope , this regulation should provide for the possibility for the union or member states under specific conditions to temporarily restrict by law certain obligations and rights when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests , including national security , defence , public security and the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties . therefore , this regulation should not prohibit member states from carrying out lawful interception of electronic communications or take other measures , if necessary and proportionate to safeguard the public interests mentioned above , in accordance with the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms , as interpreted by the court of justice of the european union and of the european court of human rights . providers of electronic communications services should not be obliged by union or member states competent authorities to weaken any measures that ensure the integrity and confidentiality of electronic communications .


### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall offer the option to prevent third parties from storing information on the terminal equipment of an end - user or processing information already stored on that equipment . ### hardware and software&#160 ; that enable the access to and use of electronic communications services or the access to , and use of , information society services shall be able to prevent other parties from using input , output , processing and storage capabilities of terminal equipment and the processing of information related to , or processed by , a user ' s terminal equipment , or making information available through the terminal equipment , including information about , and processed by , its software and hardware .


### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 . ### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always carry out an impact assessment as provided for in regulation 2016 / 679 and if necessary under that regulation , consult the supervisory authority prior to the processing . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 .


### protection of information stored in and related to end - users’ terminal equipment ### protection of information stored in , related to , and processed by users ' terminal equipment


### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . in order to ensure an effective and equal protection of end - users when using functionally equivalent services , this regulation uses the definition of electronic communications services set forth in the [ directive of the european parliament and of the council establishing the european electronic communications code24 ] . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service ; therefore , such type of services also having a communication functionality should be covered by this regulation . _________________ 24 commission proposal for a directive of the european parliament and of the council establishing the european electronic communications code ) . ### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . this regulation should ensure an effective and equal protection of the confidentiality of communications of end - users , and their privacy , when using functionally equivalent services . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service , such as internal messaging , newsfeeds , closed groups , timelines and similar functions in online services where messages are exchanged with other users within or outside that service ; therefore , such type of services also having a communication functionality should be covered by this regulation .


### for the sole purpose of the provision of a specific service to an end - user , if the end - user or end - users concerned have given their consent to the processing of his or her electronic communications content and the provision of that service cannot be fulfilled without the processing of such content ; or ### the user concerned has given his or her consent to the processing of his or her electronic communications content for the sole purpose of the provision of a specific service explicitly requested by the user , for the duration necessary for that purpose , , provided that the provision of that specific service cannot be fulfilled without the processing of such content by the provider , and the consent has not been a condition to access or use a service ; or


### infringements of the principle of confidentiality of communications , permitted processing of electronic communications data , time limits for erasure pursuant to articles 5 , 6 , and 7 shall , in accordance with paragraph 1 of this article , be subject to administrative fines up to 20 000 000 eur , or in the case of an undertaking , up to 4 % of the total worldwide annual turnover of the preceding financial year , whichever is higher . ### infringements of the following provisions of this regulation shall , in accordance with paragraph 1 , be subject to administrative fines up to 20 000 000 eur , or in the case of an undertaking , up to 4 % of the total worldwide annual turnover of the preceding financial year , whichever is higher :


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in a clear and easily understandable language , provided separately from the terms and conditions of the provider , the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to all end - users , or which are provided in order to deliver a specific functionality to the end - user concerned , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . consent may be provided to the provider of the communication service or to the provider of the specific service , but if it is provided to the latter , the latter must be able to prove to the provider of the communication service that such consent has been given .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users’ consent . ### electronic communications data should be treated as confidential . this means that any processing of electronic communications data or any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of the user requesting a specific service or of all the communicating parties should be prohibited . when the processing is allowed under this regulation , any other processing on the basis of article 6 of regulation 2016 / 679 should be considered as prohibited , including processing for another purpose on the basis of article 6 of that regulation . the prohibition of processing of communications data should apply during their conveyance and when they are stored afterwards , in order to reflect the growing trend that subscribers do not store all communications data on their own terminal equipment , but use cloud - based storage space of the communications provider or other parties . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , and analysis of customers’ traffic data , including browsing habits without the users’ consent .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ‘ hotspots’ situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wireless internet access points . the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . this regulation should also apply to closed social media profiles and groups that the users have defined as private . in contrast , this regulation should not apply to closed groups of users such as corporate networks , access to which is limited to members of an organisation .


### this regulation should apply to electronic communications data processed in connection with the provision and use of electronic communications services in the union , regardless of whether or not the processing takes place in the union . moreover , in order not to deprive end - users in the union of effective protection , this regulation should also apply to electronic communications data processed in connection with the provision of electronic communications services from outside the union to end - users in the union . ### this regulation should apply to electronic communications data processed in connection with the provision and use of electronic communications services in the union , regardless of whether or not the processing takes place in the union . moreover , in order not to deprive end - users in the union of effective protection , this regulation should also apply to electronic communications data processed in connection with the provision of electronic communications services from outside the union to end - users in the union . this regulation shall apply to electronic communications data processed in connection with the provision and use of electronic communications services , both paid and free of charge .


### electronic communications data should be defined in a sufficiently broad and technology neutral way so as to encompass any information concerning the content transmitted or exchanged and the information concerning an end - user of electronic communications services processed for the purposes of transmitting , distributing or enabling the exchange of electronic communications content ; including data to trace and identify the source and destination of a communication , geographical location and the date , time , duration and the type of communication . whether such signals and the related data are conveyed by wire , radio , optical or electromagnetic means , including satellite networks , cable networks , fixed and mobile terrestrial networks , electricity cable systems , the data related to such signals should be considered as electronic communications metadata and therefore be subject to the provisions of this regulation . electronic communications metadata may include information that is part of the subscription to the service when such information is processed for the purposes of transmitting , distributing or exchanging electronic communications content . ### electronic communications data should be defined in a sufficiently broad and technology neutral way so as to encompass any information concerning the content transmitted or exchanged and the information concerning an end - user of electronic communications services processed for the purposes of transmitting , distributing or enabling the exchange of electronic communications content ; including data to trace and identify the source and destination of a communication , geographical location and the date , time , duration and the type of communication . it should also include location data , such as the location of the terminal equipment from or to which a phone call or an internet connection has been made or the wireless access points that a device is connected to . it should also include data necessary to identify users’ terminal equipment and data emitted by terminal equipment when searching for access points or other equipment . whether such signals and the related data are conveyed by wire , radio , optical or electromagnetic means , including satellite networks , cable networks , fixed and mobile terrestrial networks , electricity cable systems , the data related to such signals should be considered as electronic communications metadata and therefore be subject to the provisions of this regulation . electronic communications metadata may include information that is part of the subscription to the service when such information is processed for the purposes of transmitting , distributing or exchanging electronic communications content . the exclusion of services providing “content transmitted using electronic communications networks” from the definition of “electronic communications service” in article 4 of this regulation does not mean that service providers who offer both electronic communications services and content services are outside the scope of the provisions of the regulation which applies to the providers of electronic communications services .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users’ consent . ### any processing of electronic communications data or any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , by persons other than the end - users , should be prohibited . when the processing is allowed under any exception to the prohibitions under the this regulation , any other processing of the electronic communications data on the basis of article 6 of the regulation 2016 / 679 shall be considered as prohibited , including processing for another purpose on the basis of article 6 of that regulation . this would not prevent controllers from asking for additional consent for new processing operations . the prohibition of interception of communications data should apply also during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee and any temporary files in the network after receipt . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , and analysis of end users’ electronic communications metadata , including browsing habits without the end - users’ consent .


### ‘ electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting , distributing or exchanging electronic communications content ; including data used to trace and identify the source and destination of a communication , data on the location of the device generated in the context of providing electronic communications services , and the date , time , duration and the type of communication ; ### ' electronic communications metadata ' means all data processed for the purposes of transmitting , distributing or exchanging electronic communications content ; including data used to trace and identify the source and destination of a communication , electronic identifiers and any other data broadcasted or emitted by the terminal equipment , data on the location of the terminal equipment processed in the context of providing electronic communications services , and the date , time , duration and the type of communication ; where metadata of other electronic communications services or protocols are transmitted , distributed or exchanged by using the respective service , they shall be considered electronic communications content for the respective service ;


### article 7 of the charter of fundamental rights of the european union protects the fundamental right of everyone to the respect for his or her private and family life , home and communications . respect for the privacy of one ' s communications is an essential dimension of this right . confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication , including when the information has been sent , from where , to whom , is not to be revealed to anyone other than to the parties involved in a communication . the principle of confidentiality should apply to current and future means of communication , including calls , internet access , instant messaging applications , e - mail , internet phone calls and personal messaging provided through social media . ### article 7 of the charter of fundamental rights of the european union protects the fundamental right of everyone to the respect for his or her private and family life , home and communications . respect for the privacy of one ' s communications is an essential dimension of this right . confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication , including information regarding when the information has been sent , from where , to whom , is not to be revealed to anyone other than to the communicating parties . the principle of confidentiality should apply to current and future means of communication , including calls , internet access , instant messaging applications , e - mail , internet phone calls and inter - personal messaging provided through social media . it should also apply when the confidentiality of electronic communications and the privacy of the physical environment converge , i . e . where terminal devices for electronic communication can also listen into their physical environment or use other input channels such as bluetooth signalling or movement sensors .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user ' s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website by the person or legal person in charge of the website .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of input , output , processing and storage capabilities of terminal equipment and the processing of information from users ' terminal equipment , or making information available through the terminal equipment , including information about and processed by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### for the sole purpose of the provision of a specific service to an end - user , if the end - user or end - users concerned have given their consent to the processing of his or her electronic communications content and the provision of that service cannot be fulfilled without the processing of such content ; or ### for the sole purpose of the provision of a specific service requested by the user , if the users concerned have given their specific consent to the processing of their electronic communications content and the provision of that specific service cannot be fulfilled without the processing of such content ; or


### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall offer the option to prevent third parties from storing information on the terminal equipment of an end - user or processing information already stored on that equipment . ### hardware and software&#160 ; that enable the access to and use of electronic communications services or the access to , and use of , information society services shall be able to prevent other parties from using input , output , processing and storage capabilities of terminal equipment and the processing of information related to , or processed by , a user ' s terminal equipment , or making information available through the terminal equipment , including information about , and processed by , its software and hardware .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier may be necessary to link the positions of individuals at certain time intervals . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where processing of electronic communications data is foreseen , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users ' consent . ### electronic communications should be treated as confidential . this means that any interference with the transmission of electronic communications , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . when the processing is allowed under any exception to the prohibitions under this regulation , any other processing on the basis of article 6 of regulation 2016 / 679 should be considered as prohibited , including processing for another purpose on the basis of article 6 of that regulation . this should not prevent requesting additional consent for new processing operations . the prohibition of interception of communications should apply also during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee , and to any temporary files in the network after receipt . interception of electronic communications may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when other parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , and analysis of customers ' traffic data , including browsing habits without the users ' consent .


### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content or make that data anonymous after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a third party entrusted by them to record , store or otherwise process such data , in accordance with regulation 2016 / 679 . ### without prejudice to points and of article 6 , the provider of the electronic communications service shall erase electronic communications content after receipt by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a party , which could be the provider of the electronic communication service , specifically entrusted by the subscriber to record , store or otherwise process such data . the subscriber may further process the data in accordance with regulation 2016 / 679 , if applicable .


### article 7 of the charter of fundamental rights of the european union protects the fundamental right of everyone to the respect for his or her private and family life , home and communications . respect for the privacy of one ' s communications is an essential dimension of this right . confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication , including when the information has been sent , from where , to whom , is not to be revealed to anyone other than to the parties involved in a communication . the principle of confidentiality should apply to current and future means of communication , including calls , internet access , instant messaging applications , e - mail , internet phone calls and personal messaging provided through social media . ### article 7 of the charter of fundamental rights of the european union protects the fundamental right of everyone to the respect for his or her private and family life , home and communications . respect for the privacy of one ' s communications is an essential dimension of this right . confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communications , including information regarding when the information has been sent , from where , to whom , is not to be revealed to anyone other than to the communication parties . the principle of confidentiality should apply to current and future means of communication , including calls , internet access , instant messaging applications , in - platform messages between users of a social network , e - mail , internet phone calls and personal messaging provided through social media .


### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express consent by using the appropriate settings of a browser or other application . the choices made by end - users when establishing its general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the end - user to control the flow of information to and from the terminal equipment . more particularly web browsers may be used as gatekeepers , thus helping end - users to prevent information from their terminal equipment from being accessed or stored . ### the methods used for providing information and obtaining end - user ' s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should prevent the use of so - called ' cookie walls ' and ' cookie banners ' that do not help users to maintain control over their personal information and privacy or become informed about their rights . this regulation should provide for the possibility to express consent by technical specifications , for instance by using the appropriate settings of a browser or other application . those settings should include choices concerning the storage of information on the user ' s terminal equipment as well as a signal sent by the browser or other application indicating the user ' s preferences to other parties . the choices made by users when establishing the general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the user and the website . from this perspective , they are in a privileged position to play an active role to help the user to control the flow of information to and from the terminal equipment . more particularly , web browsers , applications or mobile operating systems may be used as the executor of a user ' s choices , thus helping users to prevent information from their terminal equipment from being accessed or stored .


### the methods used for providing information and obtaining end - user’s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express consent by using the appropriate settings of a browser or other application . the choices made by end - users when establishing its general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the end - user to control the flow of information to and from the terminal equipment . more particularly web browsers may be used as gatekeepers , thus helping end - users to prevent information from their terminal equipment from being accessed or stored . ### the methods used for providing information and obtaining user’s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , users are overloaded with requests to provide consent . this regulation should prevent the use of so - called “cookie walls” and “cookie banners” that do not help users to maintain control over their personal information and privacy or become informed about their rights . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express or withdraw consent and to object by technical specifications using automated means , such as the appropriate settings of a hardware or software permitting the retrieval and presentation of information on the internet . those settings should include choices concerning the use of processing and storage capabilities of the user’s terminal equipment as well as a signal sent by the hardware or software indicating the user’s preferences to other parties . the choices made by users when establishing its general privacy settings should be binding on , and enforceable against , any third parties . web browsers , applications or mobile operating systems may be used as a user’s personal privacy assistant communicating the user’s choices , thus helping users to prevent information related to or processed by their terminal equipment from being accessed , processed or stored .


### the methods used for providing information and obtaining end - user’s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , end - users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , end - users are overloaded with requests to provide consent . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express consent by using the appropriate settings of a browser or other application . the choices made by end - users when establishing its general privacy settings of a browser or other application should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . web browsers mediate much of what occurs between the end - user and the website . from this perspective , they are in a privileged position to play an active role to help the end - user to control the flow of information to and from the terminal equipment . more particularly web browsers may be used as gatekeepers , thus helping end - users to prevent information from their terminal equipment from being accessed or stored . ### the methods used for providing information and obtaining user’s consent should be as user - friendly as possible . given the ubiquitous use of tracking cookies and other tracking techniques , users are increasingly requested to provide consent to store such tracking cookies in their terminal equipment . as a result , users are overloaded with requests to provide consent . this regulation should prevent the use of so - called “cookie walls” and “cookie banners” that do not help users to maintain control over their personal information and privacy or become informed about their rights . the use of technical means to provide consent , for example , through transparent and user - friendly settings , may address this problem . therefore , this regulation should provide for the possibility to express or withdraw consent and to object by technical specifications using automated means , such as the appropriate settings of a hardware or software permitting the retrieval and presentation of information on the internet . those settings should include choices concerning the use of processing and storage capabilities of the user’s terminal equipment as well as a signal sent by the hardware or software indicating the user’s preferences to other parties . the choices made by users when establishing its general privacy settings of a hardware of software should be binding on , and enforceable against , any third parties . web browsers are a type of software application that permits the retrieval and presentation of information on the internet . other types of applications , such as the ones that permit calling and messaging or provide route guidance , have also the same capabilities . more particularly web browsers , applications or mobile operating systems may be used as a user’s personal privacy assistant communicating the user’s choices , thus helping users to prevent information related to or processed by their terminal equipment from being accessed , processed or stored . they should therefore not abuse their position as gate - keepers and still allow for possibilities for the user to individually give consent with regard to a certain specific service or service provider .


### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . in order to ensure an effective and equal protection of end - users when using functionally equivalent services , this regulation uses the definition of electronic communications services set forth in the [ directive of the european parliament and of the council establishing the european electronic communications code24 ] . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service ; therefore , such type of services also having a communication functionality should be covered by this regulation . _________________ 24 commission proposal for a directive of the european parliament and of the council establishing the european electronic communications code ) . ### the services used for communications purposes , and the technical means of their delivery , have evolved considerably . end - users increasingly replace traditional voice telephony , text messages and electronic mail conveyance services in favour of functionally equivalent online services such as voice over ip , messaging services and web - based e - mail services . this regulation should ensure an effective and equal protection of the confidentiality of communications of end - users , and their privacy , when using functionally equivalent services . that definition encompasses not only internet access services and services consisting wholly or partly in the conveyance of signals but also interpersonal communications services , which may or may not be number - based , such as for example , voice over ip , messaging services and web - based e - mail services . the protection of confidentiality of communications is crucial also as regards interpersonal communications services that are ancillary to another service , such as internal messaging , newsfeeds , closed groups , timelines and similar functions in online services where messages are exchanged with other users within or outside that service ; therefore , such type of services also having a communication functionality should be covered by this regulation .


### the commission shall review the national forestry accounting plans and technical corrections and assess the extent to which the proposed new or corrected forest reference levels have been determined in accordance with the principles and requirements set out in paragraphs and as well as article 5 . to the extent that this is required in order to ensure compliance with the principles and requirements set out in paragraphs and as well as article 5 , the commission may recalculate the proposed new or corrected forest reference levels . ### a review team consisting of selected experts from the commission and member states shall review the national forestry accounting plans and technical corrections and assess the extent to which the proposed new or corrected forest reference levels have been determined in accordance with the principles and requirements set out in paragraphs and as well as article 5 . member states shall provide to the review team all data and information requested for carrying out the review and the assessment . to the extent that this is required in order to ensure compliance with the principles and requirements set out in paragraphs and as well as article 5 , the member state concerned shall recalculate the proposed new or corrected forest reference levels . in order to improve transparency , the commission shall compile a synthesis report with recommendations and make it publicly available , including by publication via the internet .


### to facilitate data collection and methodology improvement , land use should be inventoried and reported using geographical tracking of each land area , corresponding to national and eu data collection systems . the best use shall be made of existing union and member state programmes and surveys including the lucas land use cover area frame survey and the european earth observation programme copernicus for data collection . data management , including sharing for the reporting reuse and dissemination should conform to directive 2007 / 2 / ec of the european parliament and of the council of 14 march 2007 establishing an infrastructure for spatial information in the european community . ### to facilitate data collection and methodology improvement , land use should be expressly inventoried and reported using geographical tracking of each land area , corresponding to national and eu data collection systems . the best use shall be made of existing union and member state programmes and surveys including the lucas land use cover area frame survey , the european earth observation programme copernicus , in particular through sentinel - 2 , for data collection and the european satellite navigation systems galileo and egnos , which can be used in support of land - use surveying . data management , including sharing for the reporting reuse and dissemination should conform to directive 2007 / 2 / ec of the european parliament and of the council of 14 march 2007 establishing an infrastructure for spatial information in the european community .


### the lulucf sector can contribute to climate change mitigation in several ways , in particular by reducing emissions , and maintaining and enhancing sinks and carbon stocks . in order for measures aiming in particular at increasing carbon sequestration to be effective , the long - term stability and adaptability of carbon pools is essential . ### the lulucf sector is highly exposed and very vulnerable to climate change . at the same time , the sector has huge potential to provide long - term climate benefits and to contribute significantly to the achievement of union and international long - term climate goals . it can contribute to climate change mitigation in several ways , in particular by reducing emissions , maintaining and enhancing sinks and carbon stocks , and providing bio - materials than can substitute fossil - or carbon - intensive materials . in order for measures aiming in particular at increasing carbon sequestration to be effective , sustainable resource management and the long - term stability and adaptability of carbon pools are essential . long - term strategies are needed to make sustainable investments possible in the long run .


### the commission shall adopt delegated acts in accordance with article 14 to amend annex ii in the light of the review carried out pursuant to paragraph to update member state forest reference levels based on the national forestry accounting plans or the technical corrections submitted , and any recalculations made in the context of the review . until the entry into force of the delegated act , member state forest reference levels as specified in annex ii shall continue to apply for the period 2021 - 2025 and / or 2026 - 2030 . ### the commission shall adopt delegated acts in accordance with article 14 to amend annex ii in the light of the review carried out pursuant to paragraph to update member state forest reference levels based on the national forestry accounting plans or the technical corrections submitted , and any recalculations made in the context of the review . the first of those delegated acts , to be based on the submissions from member states under paragraph 3 , shall be adopted no later than 31 december 2019 . until the entry into force of the delegated act , member state forest reference levels as specified in annex ii shall continue to apply for the period 2021 - 2025 and / or 2026 - 2030 .


### the commission shall report to the european parliament and to the council by 28 february 2024 and every five years thereafter on the operation of this regulation , its contribution to the eu ' s overall 2030 greenhouse gas emission reduction target and its contribution to the goals of the paris agreement , and may make proposals if appropriate . ### within six months of the facilitative dialogue to be convened under the unfccc in 2018 , in 2024 and every five years thereafter , the commission shall submit a report to the european parliament and to the council on the operation of this regulation , its contribution to the eu ' s overall 2030 greenhouse gas emission reduction target and its contribution to the long - term goals of the paris agreement , and may make proposals if appropriate to update this regulation and its ambition in line with developments that emerge from the facilitative dialogue under unfccc and the latest scientific findings .


### member states that have chosen to include managed wetland in the scope of their commitments in accordance with article 2 shall account for emissions and removals resulting from managed wetland , calculated as emissions and removals in the periods from 2021 to 2025 and / or from 2026 to 2030 minus the value obtained by multiplying by five the member state’s average annual emissions and removals resulting from managed wetland in its base period 2005 - 2007 . ### member states shall account for emissions and removals resulting from managed wetland , calculated as emissions and removals in the periods from 2021 to 2025 and / or from 2026 to 2030 minus the value obtained by multiplying by five the member state ' s average annual emissions and removals resulting from managed wetland in its base period 2005 - 2007 .


### when the commission chooses to be assisted by an expert review team in accordance with commission decision 3301 ) in the review of national forestry accounting plans , it should build on the good practice and experience of the expert reviews under the unfccc , including as regards participation of national experts and recommendations , and select a sufficient number of experts from the member states . ### for the review of the national forestry accounting plans , an expert review team should be set up in accordance with commission decision 3301 ) . the expert review team should build on the good practice and experience of the expert reviews under the unfccc , including as regards participation of national experts and recommendations , and a sufficient number of experts from the member states should be selected .


### member states shall account for emissions and removals resulting from managed forest land , calculated as emissions and removals in the periods from 2021 to 2025 and from 2026 to 2030 minus the value obtained by multiplying by five its forest reference level . a forest reference level is an estimate of the average annual net emissions or removals resulting from managed forest land within the territory of the member state in the periods from 2021 to 2025 and from 2026 to 2030 . ### member states shall account for emissions and removals resulting from managed forest land , calculated as emissions and removals in the periods from 2021 to 2025 and from 2026 to 2030 minus the value obtained by multiplying by five annual average emissions and removals in the forest reference period . a forest reference period is an estimate of the average annual net emissions or removals resulting from managed forest land within the territory of the member state in the period from 1990 to 2009 .


### a member state may choose to include managed wetland , defined as land use reported as wetland remaining wetland , and settlement , other land converted to wetland and wetland converted to settlement and other land , in the scope of its commitment pursuant to article 4 . where a member state chooses to do so , it shall account for emissions and removals from managed wetland in accordance with this regulation . ### member states which do not have a specific accounting category for managed wetlands on [ date of entry into force ] may benefit from a transitional period of five years from [ date of entry into force ] to collect reliable and transparent data on managed wetlands and put in place a reporting system in accordance with this regulation . the the appropriateness of the data and of the reporting system shall be assessed as part of the compliance check referred to in article 12 .


### the commission shall report to the european parliament and to the council by 28 february 2024 and every five years thereafter on the operation of this regulation , its contribution to the eu ' s overall 2030 greenhouse gas emission reduction target and its contribution to the goals of the paris agreement , and may make proposals if appropriate . ### in the light of the 2018 facilitative dialogue , the commission shall report to the european parliament and to the council by 28 february 2019 on the adequacy of the level of ambition of this regulation . the commission shall report to the european parliament and to the council by 28 february 2023 and every three years thereafter on the operation of this regulation , its contribution to the eu ' s overall 2030 greenhouse gas emission reduction target and its contribution to the goals of the paris agreement , with a view to keeping this regulation in line with relevant decisions adopted by bodies of the unfccc or of the paris agreement , and shall make proposals .