### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 . ### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data at rest or in transit , with the informed consent of all the users concerned . for example , providers may offer services that entail the scanning of e - mails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the user where the user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the user and received by the intended user or users , it may be recorded or stored by the user , users or by another party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent by default the cross - domain tracking and storing of information on the terminal equipment by other parties ; this is often presented as ‘ reject third party trackers and cookies’ . users should be offered , by default , a set of privacy setting options , ranging from higher to lower and intermediate . these options may also be more fine - grained . privacy settings should also include options to allow the user to decide for example , whether flash , javascript or similar software can be executed , if a website can collect geo - location data from the user , or if it can access specific hardware such as a webcam or microphone . such privacy settings should be presented in an easily visible , objective and intelligible manner .


### the providers of publicly available directories shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct and delete such data . ### the operators of electronic information , communication and telecommunication services shall provide end - users that are legal persons with the possibility to object to data related to them being included in directories . the operators shall give such end - users that are legal persons the option to verify , correct and delete such data . natural persons who act with commercial intent , such as freelancers , small traders or self - emlyed persons , are equated to legal persons .


### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual ' s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user ' s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific and transparent purposes . ### terminal equipment of users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes very sensitive data that may reveal details of the behaviour , psychological features , emotional condition and political and social preferences of an individual , including the content of communications , pictures , the location of individuals by accessing the gps capabilities of their device , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . information related to the user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the user , and may seriously intrude upon the privacy of these users . furthermore , so - called spyware , web bugs , hidden identifiers and unwanted tracking tools can enter users ' terminal equipment without their knowledge in order to gain access to information or to store hidden information . techniques that surreptitiously monitor the actions of users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the users’ terminal equipment pose a serious threat to the privacy of users . therefore , any such interference with the user ' s terminal equipment should be allowed only with the user ' s consent and for specific and transparent purposes . users should receive all relevant information about the intended processing in clear and easily understandable language . such information should be provided separately from the terms and conditions of the service .


### the end - user concerned has given his or her consent to the processing of his or her communications metadata for one or more specified purposes , including for the provision of specific services to such end - users , provided that the purpose or purposes concerned could not be fulfilled by processing information that is made anonymous . ### after receiving all relevant information about the intended processing in clear and easily understandable language , provided separately from the terms and conditions of the provider , the user or users concerned have given their specific consent to the processing of their communications metadata for one or more specified purposes , including for the provision of specific services to such users , provided that the purpose or purposes concerned could not be fulfilled without the processing of such metadata .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wi - fi access points situated at different places within a city , for example department stores , shopping malls and hospitals , as well as airports , hotels and restaurants . those wi - fi access points might require a login or provide a password and might be provided also by public administrations . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in addition , this regulation should apply to closed social media profiles and groups that the user has restricted or defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate intranet networks , access to which is limited to members of an organisation .


### the end - user has given his or her consent ; or ### the user has given his or her specific consent , which shall not be mandatory to access the service ; or


### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall offer the option to prevent third parties from storing information on the terminal equipment of an end - user or processing information already stored on that equipment . ### software placed on the market permitting electronic communications , including the retrieval and presentation of information on the internet , shall :


### it is necessary to meet mandatory quality of service requirements pursuant to [ directive establishing the european electronic communications code ] or regulation 2015 / 212028 for the duration necessary for that purpose ; or __________________ 28 regulation 2015 / 2120 of the european parliament and of the council of 25 november 2015 laying down measures concerning open internet access and amending directive 2002 / 22 / ec on universal service and users’ rights relating to electronic communications networks and services and regulation no 531 / 2012 on roaming on public mobile communications networks within the union . ### it is strictly necessary to meet mandatory quality of service requirements pursuant to [ directive establishing the european electronic communications code ] or regulation 2015 / 212028 for the duration technically necessary for that purpose ; or __________________ 28 regulation 2015 / 2120 of the european parliament and of the council of 25 november 2015 laying down measures concerning open internet access and amending directive 2002 / 22 / ec on universal service and users’ rights relating to electronic communications networks and services and regulation no 531 / 2012 on roaming on public mobile communications networks within the union .


### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content or make that data anonymous after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the end - users or by a third party entrusted by them to record , store or otherwise process such data , in accordance with regulation 2016 / 679 . ### without prejudice to point of article 6 and points and of article 6 , the provider of the electronic communications service shall erase electronic communications content after receipt of electronic communication content by the intended recipient or recipients . such data may be recorded or stored by the users or by a specific other party entrusted by them to record , store or otherwise process such data .


### the independent supervisory authority or authorities responsible for monitoring the application of regulation 2016 / 679 shall also be responsible for monitoring the application of this regulation . chapter vi and vii of regulation 2016 / 679 shall apply mutatis mutandis . the tasks and powers of the supervisory authorities shall be exercised with regard to end - users . ### each member state shall provide for one or more independent public authorities to be responsible for monitoring the application of this regulation .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications shall be confidential . any interference , with electronic communications at rest or in transit , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or any processing of electronic communications , by persons other than the users , shall be prohibited , except when permitted by this regulation .


### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory and obtain end - users’ consent before enabling such search functions related to their own data . ### in publicly available directories the providers of these directories shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory . the operators shall inform end - users if new search functions are enabled .


### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing commercial communications or collect information related to or stored in end - users’ terminal equipment . ### this regulation should apply to providers of electronic communications services , to providers of publicly available directories , and to software providers permitting electronic communications , including the retrieval and presentation of information on the internet . this regulation should also apply to natural and legal persons who use electronic communications services to send direct marketing communications or collect information related to or stored in end - users’ terminal equipment .


### natural or legal persons may use electronic communications services for the purposes of sending direct marketing communications to end - users who are natural persons that have given their consent . ### the use by natural or legal persons of electronic communications services , including voice - to - voice calls , automated calling and communications systems , including semi - automated systems that connect the call person to an individual , faxes , e - mail or other use of electronic communications services for the purposes of presenting unsolicited or direct marketing communications to end - users , shall be allowed only in respect of end - users who have given their prior consent .


### the content of electronic communications may reveal highly sensitive information about the natural persons involved in the communication , from personal experiences and emotions to medical conditions , sexual preferences and political views , the disclosure of which could result in personal and social harm , economic loss or embarrassment . similarly , metadata derived from electronic communications may also reveal very sensitive and personal information . these metadata includes the numbers called , the websites visited , geographical location , the time , date and duration when an individual made a call etc . , allowing precise conclusions to be drawn regarding the private lives of the persons involved in the electronic communication , such as their social relationships , their habits and activities of everyday life , their interests , tastes etc . ### electronic communications may reveal highly sensitive information about the natural persons involved in the communication , from personal experiences and emotions to medical conditions , sexual preferences and political views , the disclosure of which could result in personal and social harm , economic loss or embarrassment . metadata derived from electronic communications may also reveal very sensitive and personal information . these metadata includes the numbers called , the websites visited , geographical location , the time , date and duration when an individual made a call etc . , allowing precise conclusions to be drawn regarding the private lives of the persons involved in the electronic communication , such as their social relationships , their habits and activities of everyday life , their interests , tastes etc . the protection of confidentiality of communications is also an essential condition for the respect of other related fundamental rights and freedoms , such as the protection of freedom of thought , conscience and religion , and freedom of expression and information .


### electronic communications data shall be confidential . any interference with electronic communications data , such as by listening , tapping , storing , monitoring , scanning or other kinds of interception , surveillance or processing of electronic communications data , by persons other than the end - users , shall be prohibited , except when permitted by this regulation . ### electronic communications data shall be confidential . any interference with electronic communications data , such as by unauthorised listening , tapping , storing , monitoring , scanning or other kinds of interception , or surveillance , by persons other than the end - users , shall be prohibited , except when permitted by this regulation .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of processing and storage capabilities of terminal equipment and the collection of information from users ' terminal equipment , or making information available through the terminal equipment , including information about or generated by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty should be delegated to the commission to supplement this regulation . in particular , delegated acts should be adopted in respect of the information to be presented , including by means of standardised icons in order to give an easily visible and intelligible overview of the collection of information emitted by terminal equipment , its purpose , the person responsible for it and of any measure the end - user of the terminal equipment can take to minimise the collection . delegated acts are also necessary to specify a code to identify direct marketing calls including those made through automated calling and communication systems . it is of particular importance that the commission carries out appropriate consultations and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement on better law - making of 13 april 201625 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states ' experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts . furthermore , in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission when provided for by this regulation . those powers should be exercised in accordance with regulation no 182 / 2011 . __________________ 25 interinstitutional agreement between the european parliament , the council of the european union and the european commission on better law - making of 13 april 2016 . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons in the provision and use of electronic communications services and in particular their right to respect of their private life and communications with regard to the processing of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty should be delegated to the commission to supplement this regulation . in particular , delegated acts should be adopted in respect of the information to be presented , including by means of standardised icons in order to give an easily visible and intelligible overview of the collection of information emitted by terminal equipment , its purpose , the person responsible for it and of any measure the user of the terminal equipment can take to minimise the collection . it is of particular importance that the commission carries out appropriate consultations and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement on better law - making of 13 april 201625 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states ' experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts . furthermore , in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission when provided for by this regulation . for instance , implementing measures are necessary to specify a code to identify direct marketing calls including those made through automated calling and communication systems . those powers should be exercised in accordance with regulation no 182 / 2011 . __________________ 25 interinstitutional agreement between the european parliament , the council of the european union and the european commission on better law - making of 13 april 2016 .


### regardless of whether the calling end - user has prevented the presentation of the calling line identification , where a call is made to emergency services , providers of publicly available number - based interpersonal communications services shall override the elimination of the presentation of the calling line identification and the denial or absence of consent of an end - user for the processing of metadata , on a per - line basis for organisations dealing with emergency communications , including public safety answering points , for the purpose of responding to such communications . ### regardless of whether the calling end - user has prevented the presentation of the calling line identification , where a call is made to emergency services , providers of publicly available number - based interpersonal communications services shall override the elimination of the presentation of the calling line identification and the denial or absence of consent of a user for the processing of metadata , on a per - line basis for organisations dealing with emergency communications , including public safety answering points , for the purpose of responding to such communications .


### when the processing of electronic communications data by providers of electronic communications services falls within its scope , this regulation should provide for the possibility for the union or member states under specific conditions to restrict by law certain obligations and rights when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests , including national security , defence , public security and the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including the safeguarding against and the prevention of threats to public security and other important objectives of general public interest of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , or a monitoring , inspection or regulatory function connected to the exercise of official authority for such interests . therefore , this regulation should not affect the ability of member states to carry out lawful interception of electronic communications or take other measures , if necessary and proportionate to safeguard the public interests mentioned above , in accordance with the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms , as interpreted by the court of justice of the european union and of the european court of human rights . providers of electronic communications services should provide for appropriate procedures to facilitate legitimate requests of competent authorities , where relevant also taking into account the role of the representative designated pursuant to article 3 . ### when the processing of electronic communications data by providers of electronic communications services falls within its scope , this regulation is without prejudice to the possibility for the union or member states under specific conditions to restrict by law certain obligations and rights set out in this regulation when such a restriction is targeted at persons suspected of having committed a criminal offence and constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests , including national security , defence , public security and the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including the safeguarding against and the prevention of threats to public security . therefore , this regulation should not affect the ability of member states to carry out lawful interception of electronic communications or take other measures , if necessary and proportionate to safeguard the public interests mentioned above , in accordance with the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms , as interpreted by the court of justice of the european union and of the european court of human rights .


### notwithstanding paragraph 1 , member states may provide by law that the placing of direct marketing voice - to - voice calls to end - users who are natural persons shall only be allowed in respect of end - users who are natural persons who have not expressed their objection to receiving those communications . ### notwithstanding paragraph 1 , member states may provide by law that the placing of direct marketing voice - to - voice calls to users shall only be allowed in respect of users who have not expressed their objection to receiving those communications . member states shall provide that users can object to receiving the unsolicited communications via a national do not call register , thereby also ensuring that the user is only required to opt out once .


### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 . ### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data at rest or in transit , with the informed consent of all the users concerned . for example , providers may offer services that entail the scanning of e - mails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the user where the user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the user and received by the intended user or users , it may be recorded or stored by the user , users or by another party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ' accept all cookies ' . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ' accept all cookies ' . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent by default the cross - domain tracking and storing of information on the terminal equipment by other parties ; this is often presented as ' reject third party trackers and cookies ' . end - users should be offered , by default , a set of privacy setting options , ranging from higher to lower and intermediate . these options may also be more fine - grained . privacy settings should also include options to allow the user to decide for example , whether flash , javascript or similar software can be executed , if a website can collect geo - location data from the user , or if it can access specific hardware such as a webcam or microphone . such privacy settings should be presented in an easily visible , objective and intelligible manner .


### if end - users that are natural persons give their consent to their data being included in such directories , they should be able to determine on a consent basis which categories of personal data are included in the directory . in addition , providers of publicly available directories should inform the end - users of the purposes of the directory and of the search functions of the directory before including them in that directory . end - users should be able to determine by consent on the basis of which categories of personal data their contact details can be searched . the categories of personal data included in the directory and the categories of personal data on the basis of which the end - user ' s contact details can be searched should not necessarily be the same . ### if users give their consent to their data being included in such directories , they should be able to determine on a consent basis which categories of personal data are included in the directory . in addition , providers of publicly available directories or electronic communications service providers should inform the end - users of the purposes of the directory and of the search functions of the directory before including them in that directory . users should be able to determine by consent on the basis of which categories of personal data their contact details can be searched . the categories of personal data included in the directory and the categories of personal data on the basis of which the user ' s contact details can be searched should not necessarily be the same .


### end - users who have consented to the processing of electronic communications data as set out in point of article 6 and points and of article 6 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues . ### users who have consented to the processing of electronic communications data as set out in point of article 6 and points and of article 6 , point of article 8 and point of article 8 shall be given the possibility to withdraw their consent at any time as set forth under article 7 of regulation 2016 / 679 and be reminded of this possibility at periodic intervals of 6 months , as long as the processing continues .


### confidentiality of electronic communications data ### confidentiality of electronic communications


### ‘ direct marketing communications’ means any form of advertising , whether written or oral , sent to one or more identified or identifiable end - users of electronic communications services , including the use of automated calling and communication systems with or without human interaction , electronic mail , sms , etc . ; ### ‘ direct marketing communications’ means any form of advertising , whether in written , oral or video format , sent , served or presented to one or more identified or identifiable end - users of electronic communications services , including the use of automated calling and communication systems with or without human interaction , electronic mail , sms , etc . ;


### publicly available directories of end - users of electronic communications services are widely distributed . publicly available directories means any directory or service containing end - users information such as phone numbers , email address contact details and includes inquiry services . the right to privacy and to protection of the personal data of a natural person requires that end - users that are natural persons are asked for consent before their personal data are included in a directory . the legitimate interest of legal entities requires that end - users that are legal entities have the right to object to the data related to them being included in a directory . ### publicly available directories of end - users of electronic communications services are widely distributed . publicly available directories means any directory or service containing end - users information such as phone numbers , e - mail address contact details and includes inquiry services . the right to privacy and to protection of the personal data of a natural person requires that users are asked for consent before their personal data are included in a directory . the legitimate interest of legal entities requires that end - users have the right to object to the data related to them being included in a directory .


### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent third parties from storing information on the terminal equipment ; this is often presented as ‘ reject third party cookies’ . end - users should be offered a set of privacy setting options , ranging from higher to lower and intermediate . such privacy settings should be presented in a an easily visible and intelligible manner . ### the principles of data protection by design and by default were codified under article 25 of regulation 2016 / 679 . currently , the default settings for cookies are set in most current browsers to ‘ accept all cookies’ . therefore providers of software enabling the retrieval and presentation of information on the internet should have an obligation to configure the software so that it offers the option to prevent by default the cross - domain tracking and storing of information on the terminal equipment by other parties ; this is often presented as ‘ reject third party trackers and cookies’ . users should be offered , by default , a set of privacy setting options , ranging from higher to lower and intermediate . these options may also be more fine - grained . privacy settings should also include options to allow the user to decide for example , whether flash , javascript or similar software can be executed , if a website can collect geo - location data from the user , or if it can access specific hardware such as a webcam or microphone . such privacy settings should be presented in an easily visible , objective and intelligible manner .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the providers of publicly available directories or the electronic communication services providers shall obtain the consent of users to include their personal data in the directory and , consequently , shall obtain consent from these users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory . electronic communication service providers shall give users the means to verify , correct , update , complete and delete such data . when electronic communication service providers obtain consent of users , they shall make users ' data available for public directory providers in an immediate , non - discriminatory and fair manner .


### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to end - users , for example when they enter stores , with personalized offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing end - users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the end - user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . ### accessing electronic communications networks requires the regular emission of certain data packets in order to discover or maintain a connection with the network or other devices on the network . furthermore , devices must have a unique address assigned in order to be identifiable on that network . wireless and cellular telephone standards similarly involve the emission of active signals containing unique identifiers such as a mac address , the imei , the imsi etc . a single wireless base station , such as a wireless access point , has a specific range within which such information may be captured . service providers have emerged who offer tracking services based on the scanning of equipment related information with diverse functionalities , including people counting , providing data on the number of people waiting in line , ascertaining the number of people in a specific area , etc . this information may be used for more intrusive purposes , such as to send commercial messages to users , for example when they enter stores , with personalised offers . while some of these functionalities do not entail high privacy risks , others do , for example , those involving the tracking of individuals over time , including repeated visits to specified locations . providers engaged in such practices should display prominent notices located on the edge of the area of coverage informing users prior to entering the defined area that the technology is in operation within a given perimeter , the purpose of the tracking , the person responsible for it and the existence of any measure the user of the terminal equipment can take to minimize or stop the collection . additional information should be provided where personal data are collected pursuant to article 13 of regulation 2016 / 679 . in addition , such providers should either obtain the user ' s consent or anonymise the data immediately while limiting the purpose to mere statistical counting within a limited time and space and offering effective opt - out possibilities .


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wi - fi access points situated at different places within a city , for example department stores , shopping malls and hospitals , as well as airports , hotels and restaurants . those wi - fi access points might require a login or provide a password and might be provided also by public administrations . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in addition , this regulation should apply to closed social media profiles and groups that the user has restricted or defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate intranet networks , access to which is limited to members of an organisation .


### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual ' s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user ' s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific and transparent purposes . ### terminal equipment of users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes very sensitive data that may reveal details of the behaviour , psychological features , emotional condition and political and social preferences of an individual , including the content of communications , pictures , the location of individuals by accessing the gps capabilities of their device , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . information related to the user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the user , and may seriously intrude upon the privacy of these users . furthermore , so - called spyware , web bugs , hidden identifiers and unwanted tracking tools can enter users ' terminal equipment without their knowledge in order to gain access to information or to store hidden information . techniques that surreptitiously monitor the actions of users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the users’ terminal equipment pose a serious threat to the privacy of users . therefore , any such interference with the user ' s terminal equipment should be allowed only with the user ' s consent and for specific and transparent purposes . users should receive all relevant information about the intended processing in clear and easily understandable language . such information should be provided separately from the terms and conditions of the service .


### the providers of publicly available directories shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . providers shall give such end - users that are legal persons the means to verify , correct and delete such data . ### the electronic communication service providers shall provide end - users that are legal persons with the possibility to object to data related to them being included in the directory . electronic communication service providers shall give such end - users that are legal persons the means to verify , correct and delete such data . users who act with commercial intent shall be equated to legal persons .


### electronic communications data should be treated as confidential . this means that any interference with the transmission of electronic communications data , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . the prohibition of interception of communications data should apply during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee . interception of electronic communications data may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when third parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the end - user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating end - user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , including browsing habits without the end - users ' consent . ### electronic communications should be treated as confidential . this means that any interference with the transmission of electronic communications , whether directly by human intervention or through the intermediation of automated processing by machines , without the consent of all the communicating parties should be prohibited . when the processing is allowed under any exception to the prohibitions under this regulation , any other processing on the basis of article 6 of regulation 2016 / 679 should be considered as prohibited , including processing for another purpose on the basis of article 6 of that regulation . this should not prevent requesting additional consent for new processing operations . the prohibition of interception of communications should apply also during their conveyance , i . e . until receipt of the content of the electronic communication by the intended addressee , and to any temporary files in the network after receipt . interception of electronic communications may occur , for example , when someone other than the communicating parties , listens to calls , reads , scans or stores the content of electronic communications , or the associated metadata for purposes other than the exchange of communications . interception also occurs when other parties monitor websites visited , timing of the visits , interaction with others , etc . , without the consent of the user concerned . as technology evolves , the technical ways to engage in interception have also increased . such ways may range from the installation of equipment that gathers data from terminal equipment over targeted areas , such as the so - called imsi catchers , to programs and techniques that , for example , surreptitiously monitor browsing habits for the purpose of creating user profiles . other examples of interception include capturing payload data or content data from unencrypted wireless networks and routers , and analysis of customers ' traffic data , including browsing habits without the users ' consent .


### ‘ electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting , distributing or exchanging electronic communications content ; including data used to trace and identify the source and destination of a communication , data on the location of the device generated in the context of providing electronic communications services , and the date , time , duration and the type of communication ; ### ‘ electronic communications metadata’ means data related to a user or electronic communications service , processed for the purposes of transmitting , distributing or exchanging electronic communications content and any other communications related data processed for the provision of the service , which is not considered content ; including data to trace and identify the source and destination of a communication , and the date , time , duration and the type of communication ; it includes data broadcasted or emitted by the terminal equipment to identify users ' communications and / or the terminal equipment or its location and enable it to connect to a network or to another device ;


### voice - to - voice direct marketing calls that do not involve the use of automated calling and communication systems , given that they are more costly for the sender and impose no financial costs on end - users . member states should therefore be able to establish and or maintain national systems only allowing such calls to end - users who have not objected . ### voice - to - voice direct marketing calls that do not involve the use of automated calling and communication systems , given that they are more costly for the sender and impose no financial costs on end - users , justify the possibility for member states to establish and or maintain national systems only allowing such calls to end - users who have not objected .


### where the provider of an electronic communications service is not established in the union it shall designate in writing a representative in the union . ### where the provider of an electronic communications service , provider of a publicly available directory , software provider enabling electronic communications or person sending direct marketing commercial communications or collecting information related to or stored in the end - users terminal equipment is not established in the union it shall designate in writing a representative in the union .


### the providers of publicly available directories shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data . ### the providers of publicly available directories or the electronic communication service providers shall obtain the consent of end - users who are natural persons to include their personal data in the directory and , consequently , shall obtain consent from these end - users for inclusion of data per category of personal data , to the extent that such data are relevant for the purpose of the directory . providers shall give end - users who are natural persons the means to verify , correct and delete such data .


### the providers of a publicly available directory shall inform end - users who are natural persons whose personal data are in the directory of the available search functions of the directory and obtain end - users’ consent before enabling such search functions related to their own data . ### the providers of a publicly available directories shall inform users whose personal data are in the directory of the available search functions of the directory . the electronic communication service providers shall inform users if new search functions are enabled .


### where the processing of electronic communications metadata takes place for the purpose of billing in accordance with point of article 6 , the relevant metadata may be kept until the end of the period during which a bill may lawfully be challenged or a payment may be pursued in accordance with national law . ### where the processing of electronic communications metadata takes place for the purpose of billing in accordance with point of article 6 , strictly necessary metadata may be kept until the end of the period during which a bill may lawfully be challenged or a payment may be pursued in accordance with national law .


### if all end - users concerned have given their consent to the processing of their electronic communications content for one or more specified purposes that cannot be fulfilled by processing information that is made anonymous , and the provider has consulted the supervisory authority . points and of article 36 of regulation 2016 / 679 shall apply to the consultation of the supervisory authority . ### if all users concerned have given their consent to the processing of their electronic communications content for one or more specified purposes that cannot be fulfilled by processing information that is made anonymous , and the provider has consulted the supervisory authority . points and of article 36 of regulation 2016 / 679 shall apply to the consultation of the supervisory authority .


### the use of processing and storage capabilities of terminal equipment and the collection of information from end - users ' terminal equipment , including about its software and hardware , other than by the end - user concerned shall be prohibited , except on the following grounds : ### the use of processing and storage capabilities of terminal equipment and the collection of information from users ' terminal equipment , or making information available through the terminal equipment , including information about or generated by its software and hardware , other than by the user concerned shall be prohibited , except on the following grounds :


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to further process electronic communications metadata . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to comply with regulation 2016 / 679 when processing electronic communications metadata , which should include data on the location of the device . the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where consent was obtained for the initial collection and the further processing is compatible in accordance with article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### if end - users that are natural persons give their consent to their data being included in such directories , they should be able to determine on a consent basis which categories of personal data are included in the directory . in addition , providers of publicly available directories should inform the end - users of the purposes of the directory and of the search functions of the directory before including them in that directory . end - users should be able to determine by consent on the basis of which categories of personal data their contact details can be searched . the categories of personal data included in the directory and the categories of personal data on the basis of which the end - user ' s contact details can be searched should not necessarily be the same . ### if users give their consent to their data being included in such directories , they should be able to determine on a consent basis which categories of personal data are included in the directory . in addition , providers of publicly available directories or electronic communications service providers should inform the end - users of the purposes of the directory and of the search functions of the directory before including them in that directory . users should be able to determine by consent on the basis of which categories of personal data their contact details can be searched . the categories of personal data included in the directory and the categories of personal data on the basis of which the user ' s contact details can be searched should not necessarily be the same .


### safeguards should be provided to protect end - users against unsolicited communications for direct marketing purposes , which intrude into the private life of end - users . the degree of privacy intrusion and nuisance is considered relatively similar independently of the wide range of technologies and channels used to conduct these electronic communications , whether using automated calling and communication systems , instant messaging applications , emails , sms , mms , bluetooth , etc . it is therefore justified to require that consent of the end - user is obtained before commercial electronic communications for direct marketing purposes are sent to end - users in order to effectively protect individuals against the intrusion into their private life as well as the legitimate interest of legal persons . legal certainty and the need to ensure that the rules protecting against unsolicited electronic communications remain future - proof justify the need to define a single set of rules that do not vary according to the technology used to convey these unsolicited communications , while at the same time guaranteeing an equivalent level of protection for all citizens throughout the union . however , it is reasonable to allow the use of e - mail contact details within the context of an existing customer relationship for the offering of similar products or services . such possibility should only apply to the same company that has obtained the electronic contact details in accordance with regulation 2016 / 679 . ### safeguards should be provided to protect end - users against unsolicited communications or direct marketing , which intrude into the private life of end - users . the degree of privacy intrusion and nuisance is considered relatively similar independently of the wide range of technologies and channels used to conduct these electronic communications , whether using automated calling and communication systems , instant messaging applications , e - mails , sms , mms , bluetooth , etc . it is therefore justified to require that consent of the end - user is obtained before commercial electronic communications for direct marketing purposes are sent to end - users in order to effectively protect individuals against the intrusion into their private life as well as the legitimate interest of legal persons . legal certainty and the need to ensure that the rules protecting against unsolicited electronic communications remain future - proof and justify the need to define a single set of rules that do not vary according to the technology used to convey these unsolicited communications , while at the same time guaranteeing an equivalently high level of protection for all individuals throughout the union . however , it is reasonable to allow the use of e - mail contact details within the context of an existing customer relationship for the offering of similar products or services . such possibility should only apply to the same company that has obtained the electronic contact details in accordance with regulation 2016 / 679 .


### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . any interference with the content of electronic communications should be allowed only under very clear defined conditions , for specific purposes and be subject to adequate safeguards against abuse . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit , with the informed consent of all the end - users concerned . for example , providers may offer services that entail the scanning of emails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the end - user where the end - user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the end - user and received by the intended end - user or end - users , it may be recorded or stored by the end - user , end - users or by a third party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 . ### the content of electronic communications pertains to the essence of the fundamental right to respect for private and family life , home and communications protected under article 7 of the charter . this regulation provides for the possibility of providers of electronic communications services to process electronic communications data at rest or in transit , with the informed consent of all the users concerned . for example , providers may offer services that entail the scanning of e - mails to remove certain pre - defined material . given the sensitivity of the content of communications , this regulation sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons . when processing such type of data , the provider of the electronic communications service should always consult the supervisory authority prior to the processing . such consultation should be in accordance with article 36 and of regulation 2016 / 679 . the presumption does not encompass the processing of content data to provide a service requested by the user where the user has consented to such processing and it is carried out for the purposes and duration strictly necessary and proportionate for such service . after electronic communications content has been sent by the user and received by the intended user or users , it may be recorded or stored by the user , users or by another party entrusted by them to record or store such data . any processing of such data must comply with regulation 2016 / 679 .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users ' consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . examples of such usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colours to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals , provided that the data are immediately anonymised or anonymisation techniques are used where the user is mixed with others . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### the processing of electronic communications data can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications services to process electronic communications metadata , based on end - users consent . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication . therefore , this regulation should require providers of electronic communications services to obtain end - users’ consent to process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure . where a type of processing of electronic communications metadata , in particular using new technologies , and taking into account the nature , scope , context and purposes of the processing , is likely to result in a high risk to the rights and freedoms of natural persons , a data protection impact assessment and , as the case may be , a consultation of the supervisory authority should take place prior to the processing , in accordance with articles 35 and 36 of regulation 2016 / 679 . ### the processing of electronic communications metadata can be useful for businesses , consumers and society as a whole . vis - à - vis directive 2002 / 58 / ec , this regulation broadens the possibilities for providers of electronic communications networks and services to further process electronic communications metadata . however , end - users attach great importance to the confidentiality of their communications , including their online activities , and that they want to control the use of electronic communications data for purposes other than conveying the communication , billing , interconnection payments or security . therefore , this regulation should , in principle , require providers of electronic communications networks and services to obtain end - users’ consent to further process electronic communications metadata , which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service . location data that is generated other than in the context of providing electronic communications services should not be considered as metadata . as an exception from obtaining end - users’ consent , the processing of electronic communications metadata for purposes other than those for which the personal data were initially collected should be allowed in cases where the processing is compatible in accordance with point of article 6 of regulation 2016 / 679 . examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps ; a graphical representation of data using colors to indicate the presence of individuals . to display the traffic movements in certain directions during a certain period of time , an identifier is necessary to link the positions of individuals at certain time intervals . this identifier would be missing if anonymous data were to be used and such movement could not be displayed . such usage of electronic communications metadata could , for example , benefit public authorities and public transport operators to define where to develop new infrastructure , based on the usage of and pressure on the existing structure .


### in this regulation , direct marketing refers to any form of advertising by which a natural or legal person sends direct marketing communications directly to one or more identified or identifiable end - users using electronic communications services . in addition to the offering of products and services for commercial purposes , this should also include messages sent by political parties that contact natural persons via electronic communications services in order to promote their parties . the same should apply to messages sent by other non - profit organisations to support the purposes of the organisation . ### in this regulation , direct marketing refers to any form of advertising by which a natural or legal person sends direct marketing communications directly to one or more identified or identifiable end - users using electronic communications services . in addition to the offering of products and services for commercial purposes , this should also include messages sent by political parties and independent politicians that contact natural persons via electronic communications services in order to promote their parties . the same should apply to messages sent by other non - profit organisations to support the purposes of the organisation .


### service providers who offer electronic communications services should inform end - users of measures they can take to protect the security of their communications for instance by using specific types of software or encryption technologies . the requirement to inform end - users of particular security risks does not discharge a service provider from the obligation to take , at its own costs , appropriate and immediate measures to remedy any new , unforeseen security risks and restore the normal security level of the service . the provision of information about security risks to the subscriber should be free of charge . security is appraised in the light of article 32 of regulation 2016 / 679 . ### service providers who offer electronic communications services should process electronic communications data in such a way as to prevent unauthorised access , disclosure or alteration , ensure that such unauthorised access , disclosure or alteration is capable of being ascertained , and also ensure that such electronic communications data are protected by using specific types of software and encryption technologies . the requirement to inform end - users of particular security risks does not discharge a service provider from the obligation to take , at its own costs , appropriate and immediate measures to remedy any new , unforeseen security risks and restore the normal security level of the service . the provision of information about security risks to the subscriber should be free of charge . security is appraised in the light of article 32 of regulation 2016 / 679 . the obligations of article 40 of the [ european electronic communications code ] should apply to all services within the scope of this regulation as regards the security of networks and services and related security obligations thereto .


### if it is necessary for web audience measuring , provided that such measurement is carried out by the provider of the information society service requested by the end - user . ### if it is technically necessary for web audience measuring of the information society service requested by the user , provided that such measurement is carried out by the provider , or on behalf of the provider , or by an independent web analytics agency acting in the public interest or for scientific purpose ; and further provided that no personal data is made accessible to any other party and that such web audience measurement does not adversely affect the fundamental rights of the user ;


### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as ' hotspots ' situated at different places within a city , department stores , shopping malls and hospitals . to the extent that those communications networks are provided to an undefined group of end - users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in contrast , this regulation should not apply to closed groups of end - users such as corporate networks , access to which is limited to members of the corporation . ### the development of fast and efficient wireless technologies has fostered the increasing availability for the public of internet access via wireless networks accessible by anyone in public and semi - private spaces such as wi - fi access points situated at different places within a city , for example department stores , shopping malls and hospitals , as well as airports , hotels and restaurants . those wi - fi access points might require a login or provide a password and might be provided also by public administrations . to the extent that those communications networks are provided to users , the confidentiality of the communications transmitted through such networks should be protected . the fact that wireless electronic communications services may be ancillary to other services should not stand in the way of ensuring the protection of confidentiality of communications data and application of this regulation . therefore , this regulation should apply to electronic communications data using electronic communications services and public communications networks . in addition , this regulation should apply to closed social media profiles and groups that the user has restricted or defined as private . in contrast , this regulation should not apply to closed groups of end - users such as corporate intranet networks , access to which is limited to members of an organisation .


### terminal equipment of end - users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the end - users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes information that may reveal details of an individual ' s emotional , political , social complexities , including the content of communications , pictures , the location of individuals by accessing the device’s gps capabilities , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . furthermore , the so - called spyware , web bugs , hidden identifiers , tracking cookies and other similar unwanted tracking tools can enter end - user ' s terminal equipment without their knowledge in order to gain access to information , to store hidden information and to trace the activities . information related to the end - user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the end - user , and may seriously intrude upon the privacy of these end - users . techniques that surreptitiously monitor the actions of end - users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the end - users’ terminal equipment pose a serious threat to the privacy of end - users . therefore , any such interference with the end - user ' s terminal equipment should be allowed only with the end - user ' s consent and for specific and transparent purposes . ### terminal equipment of users of electronic communications networks and any information relating to the usage of such terminal equipment , whether in particular is stored in or emitted by such equipment , requested from or processed in order to enable it to connect to another device and or network equipment , are part of the private sphere of the users requiring protection under the charter of fundamental rights of the european union and the european convention for the protection of human rights and fundamental freedoms . given that such equipment contains or processes very sensitive data that may reveal details of the behaviour , psychological features , emotional condition and political and social preferences of an individual , including the content of communications , pictures , the location of individuals by accessing the gps capabilities of their device , contact lists , and other information already stored in the device , the information related to such equipment requires enhanced privacy protection . information related to the user’s device may also be collected remotely for the purpose of identification and tracking , using techniques such as the so - called ‘ device fingerprinting’ , often without the knowledge of the user , and may seriously intrude upon the privacy of these users . furthermore , so - called spyware , web bugs , hidden identifiers and unwanted tracking tools can enter users ' terminal equipment without their knowledge in order to gain access to information or to store hidden information . techniques that surreptitiously monitor the actions of users , for example by tracking their activities online or the location of their terminal equipment , or subvert the operation of the users’ terminal equipment pose a serious threat to the privacy of users . therefore , any such interference with the user ' s terminal equipment should be allowed only with the user ' s consent and for specific and transparent purposes . users should receive all relevant information about the intended processing in clear and easily understandable language . such information should be provided separately from the terms and conditions of the service .


### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the end - user . this may include the storing of cookies for the duration of a single established session on a website to keep track of the end - user’s input when filling in online forms over several pages . cookies can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers that engage in configuration checking to provide the service in compliance with the end - user ' s settings and the mere logging of the fact that the end - user’s device is unable to receive content requested by the end - user should not constitute access to such a device or use of the device processing capabilities . ### exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in terminal equipment should be limited to situations that involve no , or only very limited , intrusion of privacy . for instance , consent should not be requested for authorizing the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a specific service explicitly requested by the user . this may include the storing of information for the duration of a single established session on a website to keep track of the user’s input when filling in online forms over several pages . tracking techniques , if implemented with appropriate privacy safeguards , can also be a legitimate and useful tool , for example , in measuring web traffic to a website . information society providers could engage in configuration checking in order to provide the service in compliance with the user ' s settings and the mere logging revealing the fact that the user’s device is unable to receive content requested by the user , should not constitute illegitimate access .