The evaluation report will include an assessment on the basis of the five evaluation criteria of the Better Regulation Guidelines, including on whether the operational objectives of the revised instument have been reached. A particular focus will be cast on the application of the provision on confidentiality of communications.

No later than 5 years after the date of application of the new legal instrument, and every five years thereafter, the Commission shall carry out an evaluation and submit the main findings to the European Parliament, the Council and the European Economic and Social Committee.

Less authorities than it is the case today are competent to supervise compliance with the ePrivacy rules

After 3 years of the entry into force of the regulation more than 50% of MS corresponding to 50% of the EU population have taken enforcement actions or issued general guidance on issues related to OTTs, Wi-Fi and IoT devices.

The following list of impact indicators could be used to monitor progress towards meeting the general objectives:

Monitoring will start right after the adoption of the legislative act. It will focus on how the future instrument is applied in the MS by the market participants in order to ensure a consistent approach. The Commission will organise meetings with MS representatives (e.g. group of experts) and the relevant stakeholders in particular to see how to facilitate transition to the new rules. A report on the implementation and application of the instrument will be prepared every year, taking stock of the state of play, the progress towards the achievement of the objectives and unresolved issues.

This section describes the monitoring and evaluation that could be applied to assess the impact of the objectives and the preferred option. The approach to monitoring and evaluation is outlined with respect to the three main objectives that the preferred policy option will address.

The experience with the implementation of the ePD has shown that the minimum harmonisation approach has not guaranteed the level of harmonisation required to ensure the internal market objective. The principle of confidentiality of communications has been implemented differently across MS. This has given rise to fragmentation and created barriers in the internal market, as businesses operating cross-border have had to deal with several different national regimes. The future ePrivacy instrument would therefore adopt an approach aimed at ensuring a higher level of harmonisation by means of more detailed and precise rules than it is the case today. Nonetheless, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation where this is necessary to ensure an effective application and interpretation of such rules and to the extent that they do not conflict with any provisions of this Regulation.

A regulation would be directly applicable and would not need to be implemented in national law as it would have immediate effect and is a particularly suitable instrument when the objective is the uniform application of rules in a certain area. This type of instrument would be the best to achieve the objective of ensuring a higher level of harmonisation and consistency, which is a main objectives of the ePD review. This would be particularly important for online services present in different territories. Moreover, the relationship of a revised Directive with the GDPR would be legally complicated and might lead to legal uncertainty, as it is not clear whether national laws implementing a directive can particularise or complement a general regulation.

The preferred option entails EU legislative intervention as only a binding instrument can guarantee the translation into practice of the measures proposed and the achievement of the related specific objectives.

Table 6: Overall impact of the various policy options. The symbols "✓" and "✗" indicate respectively positive (✓) and negative (✗) impacts, the number of the symbols is the net result of the summing-up of the respective individual ratings of the policy option as indicated in Annex 13 and indicates the magnitude of the change.

The external study supporting the present impact assessment attempted to estimate the impact on costs of the preferred policy option, on the basis of a pragmatic model based on a wide range of assumptions reflecting the general scarcity of data. Taking these limitations into account, the external study identified three distinct implementation scenarios, according to the entity who will establish the dialogue box between the user having chosen “reject third party cookies”/ "do-not-track" settings and websites visited wishing the Internet user to reconsider his/her choice. The entities who could be put in charge of this technical task are three: 1) the software providers concerned; 2) the third party tracker (e.g. the advertising networks); 3) the individual publishing websites. According to the study, this option would lead to overall savings in terms of compliance cost compared to baseline scenario of 70% (948.8 million savings) in the first scenario (browser solution), 60% (813.2 million) in the second scenario (tracking company solution) and of 5% (67.8 million) in the third scenario (publisher solution). As overall savings largely derive from a very significant decrease of the number of affected businesses, the individual amount of compliance costs one business is expected to incur – on average – would be higher than today. Far from being precise figures, they give however a rough idea of what the magnitude of the impact on businesses could be. The tables including the calculations relating to the key quantitative findings are in Annex 8, together with an overall explanation of the model, the related assumptions and limitations.

Elimination of redundant or outdated provisions: the proposal would eliminate the provisions on security of the processing of personal data in the electronic communications sector, which strongly overlap with the corresponding provisions in the GDPR and the Telecom Framework, thus further simplifying the legal framework. Moreover, it would eliminate the provision on itemised billing, which has been judged as no longer necessary in view of the evolution of technology and market reality.

Clearer exceptions to the privacy of terminal equipment: the proposal would spell out more clearly and in a more comprehensive manner the cases where interferences with the privacy of terminal equipment are permitted. In this way, the proposal would identify permitted uses for specific legitimate purposes not presenting concrete privacy risks, thus reducing false positives caused by the over-inclusive character of the present rules.

Greater transparency of unsolicited marketing calls: thanks to the introduction of the prefix and other measures relating to the transparency of marketing calls, most users (unless their telephone equipment does not display the identity of the calling line) will be enabled to identify a marketing call before picking up the phone. This will increase transparency and allow users to reject particular calls. In perspective, this may reduce complaints against unsolicited marketing calls.

More consistent enforcement: thanks to the streamlining of enforcement by means of the consistency mechanism, and in particular the allocation of enforcement to GDPR authorities, greater consistency and legal certainty in cases having cross-border dimension would be ensured.

Privacy by design and technological solutions to manage complex issues related to consent online: The proposal would require certain software providers (user agents) to enable general settings in a way that they can be used to manage privacy choices in a centralised way. This would greatly simplify the management of consent online for users, as the latter will be able to set their privacy choices once for all websites and applications (this does not exclude the possibility to derogate in specific instances). This would bring out significant savings for businesses having a website (up to -70% of the costs related to the ePrivacy as estimated in the external study). At the same time, it would greatly simplify Internet browsing, limiting the interference of invasive cookie banners.

Technological neutrality: The proposal would introduce a fully technologically neutral approach, thus ensuring that the rules are future proof and remain effective despite the evolution of technology;

The preferred policy option presents several elements of simplification and reduction of the administrative burden on businesses. These elements, which have all been explained in the context of the analysis of the impacts, are also listed below and, where possible, quantified:

In view of the above, the elimination of the measure of processing for marketing purposes without consent would ensure a better result in relation to Objective 1. At the same time, the elimination of the extension of the opt-in would ensure a better result in terms of efficiency. There is no sufficient evidence that this would significantly undermining objective 2. These two measures of Option 3 should therefore not be retained. The preferred option is, therefore, Options 3 without these specific measures (processing without consent for marketing purposes measure No 10(e) and mandatory opt-in for voice-to-voice marketing calls (measure No 4)).

Although Option 3 is the best option, while taking into account its efficiency and coherence, specific measures included in this option raise particular concerns in terms of effectiveness and efficiency (cost-effectiveness). In particular, the possibility to process communications data without consent of the users for marketing purposes (measure No 10(e)), albeit with privacy safeguards, would strongly limit the effectiveness of the option vis-à-vis the objective of ensuring effective confidentiality of electronic communications. In addition, the introduction of a mandatory opt-in regime for voice-to-voice live calls would generate costs, without offering sufficient guarantees that the underlying issues would be resolved by this measure.

Options 3 and 4 are the most effective options to achieve the objectives of the review, with Option 4 guaranteeing greater user protection and thus achieving the objectives 1 and 2 to a greater extent. However, in terms of efficiency, Option 4 is more expensive and thus less efficient, both in terms of compliance and opportunity costs. Under this perspective, Option 3 is considered a more proportionate, and thus preferable, solution compared to Option 4. By contrast, Option 3 has positive effects in terms of efficiency, as it is expected to drive compliance costs down (while potentially raising some non-insignificant opportunity costs). Option 3 is also coherent both internally and externally. Option 1 and 2 are much less effective options. While Option 5 would have very positive effects in terms of efficiency, it does not guarantee that the objectives are satisfactorily achieved.

Based on the above comparison, it appears that Option 3 is the best option to achieve the objectives, while taking into account its efficiency and coherence.

While the basic relationship with the RED will not change, Options 3 and 4 will include the additional requirement for some software acting as "user agent" to set out specifically described privacy settings. User agent software would include, for example, Internet browsers. This requirement is considered coherent with the RED, which covers radio equipment and includes a requirement for such equipment to incorporate privacy safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected. The options in question would not otherwise affect in any manner the operation of the RED and the power of the Commission to adopt delegated acts or European standards under that Directive to further specify the practical implementation of this requirement.

As far as the GDPR is concerned, the relationship with the general data protection rules will not change under Options 1, 2, 3 and 4. The ePrivacy instrument will remain a specific law aiming to protect confidentiality of electronic communications in accordance with Article 7 of the Charter. If personal data are involved, the GDPR rules will continue to apply on the top of the ePrivacy instrument for any matters that is not specifically regulated by the latter. In line with the expansion of the scope of the ePrivacy rules, some matters that were previously covered exclusively by the GDPR will be covered in the future also by the ePrivacy instrument. This is the case, as already mentioned, for OTTs, publicly accessible Wi-Fi networks and IoT connected devices related communications. Option 3 and 4 will further boost alignment with the GDPR, as they will provide for the application of the GDPR enforcement and consistency system.

Options 2, 3 and 4 do not present specific coherence issues, although they represent a significant deviation from the status quo and result in a significant expansion of the scope of the current ePrivacy instrument. The scope would be enlarged in relation to OTTs. While this may be seen as a significant extension, it is also a necessity given the need to ensure confidentiality of communications, irrespective of the technology used (i.e. technological neutrality). The same arguments apply as well to the clarification of the applicability of the confidentiality rules to publicly available private networks such as Wi-Fi and to IoT connected devices.

Option 5 would enhance the overall coherence of the system, as it would eliminate the dual regime of the protection of personal data in the electronic communications sector and make the GDPR the only legal instrument in the field of data protection. However, the repeal of the specific rules of confidentiality of communications would remove the specific protection of confidentiality of communications in line with the Charter, especially with regard to legal persons and communications not involving personal data, which are not protected under the GDPR.

The Baseline and Option 1 would not entirely solve the internal and external coherence issues identified. In particular, the asymmetric regulation of ECS and other forms of online communications would not be removed. Inconsistent enforcement would not be effectively addressed.

Option 5 is considered to be the least expensive option. The repeal of the ePD would significantly simplify the legal framework, by abolishing the sector-specific regulation in the ECS sector. However, while these costs would no longer be based on the ePD, the sector-specific rules now laid down in the ePD would be replaced by corresponding provisions of the GDPR. For example, the GDPR also contains obligations in relation to personal data breach notifications. Thus, some of these costs would still be incurred even after the repeal of the ePD, but for other reasons.

Imposing a general opt-in requirement under Option 3 (and 4) implies, by contrast, some additional compliance costs for businesses, as they will have to review their business models and limit marketing only in respect to those subscribers for which they have received prior consent. This is expected to raise the costs of a marketing campaign, as businesses would have to review and update their practices. This effect will be felt only in those MS that have at present adopted the opt-out system. The analysis of the data concerning the situation in MS, however, has shown that the largest majority of traders would be affected by this change, especially as far as fixed line calls are concerned (88% of traders) but also for mobile phones (61%). Considering that the evidence collected during the REFIT evaluation did not lead to conclude unequivocally that the problems related to voice-to-voice unsolicited communications are caused by the opt-out systems, but rather as the result of its ineffective implementation, the proportionality of the option does not seem to be demonstrated.

Options 1 and 2 would entail additional costs compared to the baseline. The estimate of the magnitude of these costs has been quantified by a Commission external study. According to the Study, Option 1 would entail additional costs for 5% compared to the baseline. The additional compliance costs of Option 2 are estimated to be higher (15% compared to the baseline). Option 3 would instead lead to a substantial reduction in overall compliance costs essentially thanks to the measures streamlining and simplifying the consent rules and greater harmonisation (up to 70% lower compliance costs in the best case scenario). Option 4 would finally lead to a much lower reduction in compliance cost by (5%). Options 2 and 4 are expected to present significant opportunity costs as well. Opportunity costs are expected to be present also in Option 3, although to a significantly lower extent.

The baseline scenario would not entail any additional cost. A Commission's external study calculated that the overall cost related to the ePD for businesses operating in the EU a website using cookies amounted to approximately EUR 1.8 billion in the period 2002-2015. However, this cost is projected to gradually decrease until 2030 to approximately EUR 1.4 billion per annum.

Under Option 5, confidentiality of communications will decrease because operators would be allowed to process communications data in the absence of the user's consent. Communications not containing personal data which are not covered by the GDPR would not be covered. As far as unsolicited communications are concerned, the generalisation of the opt-out rule would be a step-back as today a large portion of communications is subject to an opt-in consent. By contrast, Option 5 would achieve to a great extent the simplification objective, by ensuring a single set of rules applicable across all services, the necessary flexibility and a strong system of enforcement.

Option 4 contains most of the measures included in Option 3, but it goes further in the protection in a number of respects. Under this perspective, the ban on "cookie walls" would significantly limit online tracking. However, it should be noted that cookies/OBA allow to finance freely-accessible content. Websites may need to put in place paying subscriptions; if users are not willing to pay with money, this may affect their revenues. With respect to unsolicited commercial communications, the repeal of the exception to the opt-in rule would further strengthen the protection of users from unsolicited communications by electronic mail (e.g. email and SMSs). In conclusion, the option is expected to significantly enhance protection and thus achieve Objectives 1 and 2 (except for the measure allowing processing without consent), but also adversely affect business models financed on OBA and thus go, in part, against objective 3 aiming to simplify the legal framework.

By contrast, the introduction under this Option of a possibility to process communications data (e.g. traffic and location data) without users' consent to profile and deliver targeted advertisement (measure No 10(e)), albeit under strict privacy safeguards, undermines the effectiveness of the option vis-à-vis its objective of reinforcing the protection of confidentiality of communications. The possibility for OTTs and ECSs to interfere with the confidentiality of electronic communications without the consent of the users strongly reduces citizens' control over their communications and therefore constitutes a significant limitation in relation to the present objective. While the negative effects on privacy protection would be limited by strict safeguards, i.e. as approved by the competent authorities, the overall compatibility of this element with the general objective of reinforcing confidentiality of communications is questionable.

Option 3 achieves the objectives in a significant way. In addition to the benefits of Option 2, the introduction of clear transparency requirements with regard to e.g. tracking in public spaces would contribute to significantly increasing consumer awareness and would help them make informed decisions. By mandating privacy-friendly settings in browsers and/or similar software, this Option would greatly facilitate the user-centric management of privacy and security related permissions concerning online browsing. The generalisation of the opt-in requirement would further enhance the protection of users against unsolicited commercial communications. At the same time, the option would enhance harmonisation and simplification. The broadening of the exceptions for the consent requirement, with adequate privacy safeguards, would guarantee this flexibility. The repeal of redundant provisions would simplify the legal framework. Finally, the allocation of enforcement powers to a single category of authorities, the authorities competent to enforce the provisions of the GDPR, with the extension of the GDPR consistency mechanism shall support a uniformed interpretation of the rules and more effective enforcement.

Option 2 would partially achieve all the objectives. The extension of the scope of the ePD would fill important gaps in the protection and ensure a level playing field. The selective measures in the field of unsolicited communications would reinforce citizens' protection against nuisance calls. The clarification of certain provisions combined with the selective repeal of some others would also contribute to the objectives. However, the Option presents some limitations as it does not sufficiently address the weakness of the current cookie consent mechanisms. Finally, the option would not completely address the problem relating to the lack of cooperation and consistency in cross-border cases.

The analysis of the baseline scenario (section 5.1) has shown that if no action is taken, the problems are likely to continue and grow more important as the time passes. While the measures identified in Option 1 may to a certain extent improve the quality of implementation, there is no guarantee that the objectives could be effectively achieved without a change in the law. Many of the issues identified can only partially and hypothetically be tackled by interpretative communications or standards.

In this section, the comparison of the options in the light of the impacts identified is presented. The options are assessed against the three core criteria of effectiveness, efficiency and coherence. Annex 13 summarises and presents in table form the comparison of the policy options in terms of effectiveness, efficiency and coherence as well as comparison of impact on each category of stakeholder. It also presents a table comparing the overall expected costs and expected benefits/cost-savings of each options.

Operators concerned in the ECS sector and the tech industry broadly support the deregulation of the sector and consider that the general data protection rules provide sufficient protection. Close to one third (63.3%) of the industry respondents did not consider that there is an added value of having specific rules on confidentiality of electronic communications.

More specifically, close to two thirds (61.0%) of all respondents indicated that there is an added value of specific rules ensuring confidentiality of electronic communications. This view is in particular supported by citizens and civil society as well as public bodies (83.4% and 88.9% respectively). Public authorities (EDPS, WP29 and BEREC) expressed similar views. None of these stakeholders backed up the option of repealing the ePD.

In the Public Consultation, a strong majority of respondents acknowledged that the rules on confidentiality of communications in the electronic communications sector remain largely relevant , although there are differences depending on the types of stakeholders asked .

The impact on innovation is positive. Since they are no longer bound by the ePD, ECS providers would be able to invest resources in innovative business models capitalising on the wealth of data on electronic communications they have access to. This may translate into new innovative offerings in the market for consumers and businesses and greater spin in the data economy.

As explained in relation to Objective 1, the repeal of the ePD would remove the specific protection of the fundamental right under Article 7 of the Charter. The impact on this fundamental right is thus negative.

The impact of internal market of this option is rather mixed. The removal of the specific rules on confidentiality of communications may lead to further discrepancies across MS in the future, to the extent that MS are no longer bound by harmonised rules in this context.

Option 5 may produce positive effects for the employment, to the extent that they may encourage ECSs to invest more in the data economy and thus hire more people in new projects/areas.

This option would significantly clarify and simplify the legal framework. SMEs would benefit from such additional clarity and simplification of the legal framework, other than from the cost savings relating to the repeal of the ePD. This would translate into lower costs for online businesses, many of which are start-up and therefore very small enterprises.

This option is expected to have positive impact on ECS providers, by removing the specific rules in the electronic communications sector. This would increase their competitiveness vis-à-vis OTTs on the OBA side of the market. The GDPR would apply to all operators in the ECS market, thus guaranteeing a level playing field. There could be a consequential increase in revenues and competitiveness from ECS and a potential shift of revenues from OTTs to ECSs.

The ECS industry will have to adapt to the new environment. Since certain requirements laid down in the ePD will no longer apply to them, it can be expected that no costs related to compliance and administrative burden with the ePD will be incurred. It has to be noted in this regard that, while these costs would no longer be based on the ePD, businesses would still need to implement certain rules based on the GDPR or other legislation. For example, the GDPR also contains obligations in relation to personal data breach notifications.

The Commission and MS would have to bear the cost of the legislative process as per under Option 2, 3 and 4. For the rest, as the ePD would be repealed under this Policy Option, all costs stemming from the ePD for the Commission and ePD would be abolished.

Option 5 will achieve the objective. While in principle the full applicability of the GDPR may guarantee high level of harmonisation, at the same time, the matters currently set forth by the ePrivacy Directive would need to be interpreted and applied by supervisory authorities. The removal of the specific rules may lead to further discrepancies across MS in the future, insofar as authorities may have different views and apply the GDPR rules differently.

Unsolicited commercial communications would be covered by Article 21 of the GDPR which gives data subjects the right to object to data processing for direct marketing purposes. The repeal of the ePD would thus constitute a step-back in terms of protection for a number of marketing communications that are currently subject to the opt-in regime such as automated calling machines and electronic mail.

While the impact of the repeal on the level of confidentiality of communications will very much depend on how national authorities and courts would interpret and enforce the GDPR rules, in the absence of specific information and guarantees on this issue it is appropriate to consider that the present option may lead, at least in theory, to a reduction of the level of protection of confidentiality.

Third, the ePD gives citizens specific rights and protections. This is for example the case of the protection of confidentiality and integrity of terminal equipment (Article 5(3)), allowing interference with smart devices to be put in place only with the user's informed consent (thus protecting users against viruses, spyware or other malware), the specific protection against spamming and direct marketing, the obligation to delete traffic data, the right not to appear in directories of subscribers, the right to block calls from certain numbers, etc. Under this option, users would lose rights that today they are granted under current EU legislation.

Second, the ePD provides for specific protection of confidentiality of communications in keeping with the general framework of protection of personal data laid down in the GDPR. While personal data under the GDPR can be processed under a variety of legal bases, including the necessity to perform a contract and the controller's legitimate interest, the ePD allows confidentiality of communications to be derogated or interfered with only with the consent of the users. In light of their particularly sensitive nature, electronic communications are given special protection under Article 7 of the Charter and in line with the constitutional traditions common to the MS. The Court of Justice has recognised on various occasions the utmost importance of ensuring effective confidentiality of electronic communications, for example in the Digital Rights Ireland case, which has led to the invalidation of the Data Retention Directive 2006/24/EC.

First, the ePD and the GDPR do not have the same scope. The GDPR applies only to the processing of personal data of individuals. The ePD protects the confidentiality of electronic communications as such, irrespective of whether or not personal data are being processed. The GDPR does not apply, therefore, to communications not including personal data and does not protect legitimate interests of legal persons. For these reasons, more detailed rules were considered necessary after the adoption of Directive 95/46 for the protection of privacy and data protection in the electronic communications sector, which led to the adoption of the ePD. These reasons are still valid today.

Option 5 would not satisfactorily achieve the objective. Having heard stakeholders' views in detail, within and outside the framework of the public consultation, and in light of the findings of the ePD ex-post evaluation, the conclusion has been reached that an ePrivacy legal instrument protecting confidentiality of electronic communications is still necessary and that the repeal of such an instrument would leave citizens without an essential protection in respect of a fundamental right recognised by the European Charter. The main reasons underpinning this conclusion are laid down below.

This Option is supported by citizens and civil society organisations. In particular, national data protection authorities, the EDPS and civil society groups have all recommended measures to reduce the impact of cookie walls in order to ensure that consent to tracking is freely given. On the contrary, it is strongly opposed by the industry.

Option 4 would restrain the freedom of action of online operators, thus reducing their capacity to grasp the benefits of the data economy. The lower capacity to engage in the data business is thus expected to adversely affect the innovation potential in a number of sectors.

This option could have an effect as regards property rights and freedom to conduct business, to the extent that imposes some serious limitations to online business models based on OBA. The risks for the viability of these business models could ultimately hinge on the freedom of the press and pluralism of information, insofar as they affect one important source of financing for the online press.

The option is not per se incompatible with the GDPR, even though the empowerment of the Commission to issue implementing acts for the implementation of certain ePrivacy rules can be seen as inconsistent, to the extent that the same powers are not foreseen for the application of GDPR rules.

This option is expected to have a very positive impact on confidentiality of communications and related personal data, as it would substantially reduce online tracking.

This option would have a positive effect on the internal market as much as the previous option. Commission's implementing powers would help removing further interpretative uncertainty and fragmentation.

As to Objective 2, the general removal of the opt-out for sending messages by email to existing customers may reduce the effectiveness and thus the attractiveness of marketing campaigns even further compared to Option 2. This may in theory have some effects on employment in this sector, although it is likely that resources would be shifted to other forms of marketing.

For Objective 1, the measures may have negative impacts on employment in the short-medium term, to the extent that it could undermine the legal viability of some OBA based online business models.

This option introduces much stricter regulation of online tracking by means of cookies, by prohibiting websites owners to deny access to their websites in case users do not consent to tracking. As explained above, this would lead to an increase in compliance costs for website owners, an increase which will be more strongly felt by microenterprises and SMEs, given their smaller size. Other than direct compliance costs, opportunity costs also are expected to rise. Additional costs derive from the tightening of the rules on unsolicited communications (i.e. no exception to opt-in). The measures at stake are therefore expected to raise the costs for businesses and affect competitiveness, and ultimately hamper the viability of widespread OBA-based business models. The impact on SMEs is possibly more significant, given that they have fewer resources to adapt to a more complex legal framework. The impact on the online news publishing industry is of particular concern, given the importance of OBA for the viability of their businesses.

In conclusion, in addition to the same impact as Option 3, this option would generate high compliance and high opportunity costs for businesses (marketers, publishers and advertising business) and, potentially, high costs for citizens related to availability of (free of charge) online services. Commission's implementing powers for ensuring consistency of enforcement would generate some moderate benefits for businesses.

The external study supporting the present impact assessment attempted to estimate the impact on costs of each option, on the basis of a pragmatic model based on a wide range of assumptions reflecting the general scarcity of data. Taking these limitations into account, the external study has estimated that this option would determine a reduction of the overall compliance costs (-5%, i.e. 67.8 million) and administrative burden (-3%, i.e. 0.007 million), compared to the baseline scenario. Again, even if the overall impact on costs is positive, in average terms this would translate according to the model on higher compliance costs for individual firms, reflecting indeed the lower number of firms on which this reduced overall cost is divided. Far from being a precise figure, this gives however a rough idea of what the magnitude of the impact on businesses could be. The tables including the calculations relating to the key quantitative findings are in Annex 8, Opportunity costs resulting from the significantly tighter restrictions on processing data for OBA purposes are likely to be high, as explained, and may even undermine the viability of OBA based business models.

In addition to the impact analysed in relation to Option 3, this option would present additional compliance and opportunity costs for industry. The ban on cookie walls would entail costs for service providers to evaluate and amend their current practices (large one-off cost). Unlike in Option 3, under this option businesses will need to amend their websites/services so that they are also available to the extent possible without the use of cookies/tracking. For example, this could mean that in effect two versions of website need to be offered. It may be assumed that only a very limited percentage of users would accept tracking cookies (or equivalent techniques) for the purpose of OBA. Still, publishers could not refuse access to their content in these cases. Ultimately, this is likely to affect the financial viability of business models that are largely financed by means of advertising. The complete elimination of the opt-out regime for unsolicited marketing by email would result in further loss of revenue for traders, as marketing to previous clients is restricted.

For the Commission and MS the costs will be the same as per option 3. However, there may be a slight increase of costs for MS authorities following the introduction of the ban on cookie walls, as the checking of compliance may be more time consuming and it is possible that the number of complaints by citizens could increase (running cost). The Commission would face some additional costs in terms of human resources for the adoption of implementing powers (running cost). The number of resources needed would depend on the extent to which these powers are effectively used. It is expected that the impact would be moderate, including because the Commission retains discretion on whether and when using these powers and because the consistency mechanism is introduced at the same time and also gives a forum for handling cases with a European impact. On this basis, it may be estimated 1 to 2 additional FTEs (administrator level) may be sufficient to handle these cases. These additional costs may be covered by shifting or refocusing of existing effectives, and with the technical support of ENISA and JRC.

Commission's implementing powers to decide on the correct application of the rules in specific cases would provide the maximum results in terms of harmonisation and simplification. However, the tightening of the consent mechanism (banning of cookie walls) would introduce a significant element of rigidity, thus compromising the full achievement of the objective.

Option 3 will further reduce the nuisance of unsolicited communications, to the extent that it will prevent the use of opt-out in the context of a previous business relationship.

The present option would guarantee the greatest protection of confidentiality in that it would limit the online tracking by forbidding making the access to a particular website conditional upon the consent to accepting the use of cookies or equivalent tracking practices (so called "cookie wall"). As in Option 3, the effectiveness is reduced by the possibility to process metadata for marketing purposes without consent.

This option would not be supported by those industry members who call for the full repeal of the ePD (63% of the businesses responding to the public consultation). OTTs, in particular, will be against the extension of the ePrivacy rules to online communications.

To the extent that they demand the repeal of unnecessary provisions, ECS should support the results guaranteed in this direction by the repeal of the security provisions and the provisions on itemised billing, and automatic call forwarding.

Consumer organizations strongly support the extension of the rules to OTTs and reinforcement of protection of security and confidentiality. Close to 90% of citizens, civil society and public authorities favour an opt-in regime whereas 73% of industry's an opt-out regime.

National data protection authorities and the EDPS both called for a clarification of the rules on unsolicited communications and for the generalisation of the opt-in requirement (except in the context of a previous business relationship.

A majority of citizens and civil society, industry and public bodies believe that the allocation of enforcement powers to different authorities led to divergent interpretation of rules in the EU and to non-effective enforcement while they considered the DPAs to be the most suitable authorities to enforce ePrivacy rules. This supports measures enhancing the consistency and effectiveness of enforcement, including entrusting the rules to one category of competent authorities. Likewise, the consensus for clarifying the rules and increase harmonisation is high across virtually all stakeholders groups.

The proposal to impose privacy by default in browser setting was strongly supported by 89% of the respondents to the Eurobarometer, national data protection authorities and the EDPS.

National consumer authorities, consumer and trade organisations, as well as the European Parliament have been consistently calling for an increase in privacy protection in relation to electronic communications as a means to ensure greater levels of trust in the DSM. This option goes in the direction of these instances.

The review of the ePD could support the development and use of the IoT and digitalization of industry inter alia by fostering more regulatory certainty for all players throughout the IoT value chain contributing to a better investment climate and end-users confidence about security, privacy and confidentiality.

Given the emphasis on confidentiality requirements, the present option is also likely to stimulate the R&D in privacy preserving technologies. Research on anonymisation and pseudonymisation techniques, for instance, is expected to be significantly boosted. From this point of view, the option would facilitate the introduction and dissemination of new production methods, technologies and products in this emerging sector.

Option 3 would have a composite effect. Greater transparency and protection of privacy of electronic communications may to a certain extent limit innovative business models relying on a large availability of data, such as free online personalised services. This may reduce the capacity to grasp the benefits of the data economy. However, as already observed, the present option includes some crucial elements of flexibility, such as additional exceptions and derogations with adequate safeguards. Therefore, any negative effect is expected to be limited. Moreover, the new rules could lead to the emergence of innovative, privacy friendly business models and technical solutions.

The option does not aim to address per se consumers protection issues (Art. 169 TFEU). However, it cannot be excluded that some of the above highlighted changes would benefit consumers in their buying and selling experiences. This could be the case for instance of the measures providing for greater transparency, measures limiting aggressive marketing behaviours (phone calls) or allowing users to say no to tracking/discriminatory practices through privacy settings.

By enhancing the protection of confidentiality of communications, which is a necessary condition for the freedom of expression and other related rights, such as personal data protection, the freedom of thought and the freedom of association, the present option is expected to impact positively on these connected rights and freedoms. At the same time, the introduction of the possibility to process communications data without consent of the users for marketing purposes (measure No 11(e)), albeit under strict privacy safeguards, reduces users' control over the confidentiality of their communications and actually reduces the degree of protection of a fundamental right.

The right to respect for private and family life and communications is a fundamental right in the EU (Article 7 of EU Charter of Fundamental Rights). This option would increase the level of protection, boost legal certainty, and make EU confidentiality of communication more effective. The proposal is compatible with the GDPR.

Option 3 would have a positive effect on the internal market due to the greater clarity, harmonisation and consistency of the rules across 28 MS. The streamlining and strengthening of enforcement would contribute to greater consistency. Finally, the generalisation of the opt-in requirement would have a positive effect on the internal market as it would reduce the risk of diverging implementation in MS concerning the provisions on unsolicited advertising.

On the other hand, SMEs who are OTTs would be negatively impacted by the extension to them of the scope of the ePrivacy rules. As highlighted in relation to Option 2, this would imply an increase of compliance costs and, in particular, of opportunity costs. As highlighted above, the provision on of do-not-track browser settings would have a negative impact on the effectiveness of OBA models, although such impact for the reasons explained above is not expected to be significant or disruptive. In general, the additional costs are expected to affect in proportion more heavily SMEs than bigger players, given the lower amount of resources and installed customer base that smaller firms can rely on.

The impact on SMEs of this option is mixed. SMEs who are ECSs would have greater opportunities to monetise the value of data than it is the case today deriving from the addition legal grounds to process traffic and location data. Most importantly, SMEs having a websites (60-85% of the total) would draw significant benefits from the reduction of the compliance costs with regard to the cookie consent option under the application exceptions and derogations and the simplification related to browser settings. Since costs related to the cookie consent provision are considered to be the main source of cost for SMEs of the current ePD, these savings are expected to drive compliance costs significantly down.

ECSs and OTT would be able to compete on an equal footing as far as privacy legislation is concerned. As highlighted in relation to Option 2, the tightening of the rules for OTTs may have a negative effect on the capacity of online providers to collect big data about subscribers or users. This effect is likely to be felt more by small players or newcomers than by big established players with an already significant installed users' base. However, the potentially negative effect would be mitigated by the further flexibility introduced in the legal framework through brand-new exceptions and derogations.

This option is expected to have a positive impact on the business environment, especially on cross-border trade within the digital single market, as consumer confidence and trust that their rights are respected would increase. Traders operating over several markets would benefit from uniform regulatory conditions.

In conclusion, in addition to the same impact as Option 2, this option would generate high cost savings for businesses (website owners), next to additional moderate costs for MS (streamlining enforcement and consistency) and for some business categories (marketers and Internet browsers).

The external study supporting the present impact assessment attempted to estimate the impact on costs of each option, on the basis of a pragmatic model based on a wide range of assumptions reflecting the general scarcity of data. Taking these limitations into account, the external study identified three distinct implementation scenarios, according to the entity who will establish the dialogue box between the user having chosen “reject third party cookies”/ "do-not-track" settings and websites visited wishing the Internet user to reconsider his/her choice. The entities who could be put in charge of this technical task are three: 1) the software providers concerned; 2) the third party tracker (e.g. the advertising networks); 3) the individual publishing websites. According to the study, this option would lead to overall savings in terms of compliance cost compared to baseline scenario of 70% (948.8 million savings) in the first scenario (browser solution), 60% (813.2 million) in the second scenario (tracking company solution) and of 5% (67.8 million) in the third scenario (publisher solution). As overall savings largely derive from a very significant decrease of the number of affected businesses, the individual amount of compliance costs one business is expected to incur – on average – would be higher than today. Far from being precise figures, they give however a rough idea of what the magnitude of the impact on businesses could be. The tables including the calculations relating to the key quantitative findings are in Annex 8, together with an overall explanation of the model, the related assumptions and limitations.

Further cost savings can be expected for those sectors already applying the ePD based on the simplification of the legal framework and further harmonisation. In particular, the repeal of Article 4 on security obligations and Article 7 on itemised billing, the merging of Articles 6 and 9 on traffic and location data would lead to a moderate decrease in compliance costs and administrative burden for businesses .

With regard to unsolicited communications, the same cost analysed in relation to Option 2 in relation to measures concerning the clarification of the scope and the introduction of the prefix applies here. Imposing a general opt-in requirement will imply some additional compliance costs for businesses, as they will have to review their business models and limit marketing only in respect to those subscribers for which they have received consent. This is expected to raise the costs of a marketing campaign, as businesses would have to revise their practices and update the mechanisms they use to obtain consent (one-off cost to review current practices and update website to include mechanisms to request consent and running costs for technical updates). This effect will be felt only in those MS that have at present adopted the opt-out system. In particular, as far as fixed lines are concerned, 8 MS adopted an opt-in, 17 an opt-out, whereas 3 MS have mixed systems depending on whether consumers (opt-in) or other players (opt-out) are concerned. As far as mobile lines are concerned, 12 MS adopted an opt-in, 13 an opt-out, whereas 3 MS have mixed systems depending on whether consumers (opt-in) or other players (opt-out) are concerned. The analysis of the data concerning the situation in MS, however, has shown that the largest majority of traders would be affected by this change, especially as far as fixed line calls are concerned (88% of traders) but also for mobile phones (61%). On the other hand, businesses operating in different MS would no longer have to implement different regimes, neither deal with different kind of competent authorities; thus potentially leading to savings in terms of compliance costs for those businesses operating cross-border.

Additional costs would ensue for the limited number of providers of browsers or similar software as these would need to ensure privacy-friendly settings (one-off costs to revise their settings and running costs to ensure technical updates/services). These costs would essentially relate to the revision of existing offers and IT costs for implementing new solutions. In this context it has to be noted that some of these parties may already comply with such standards. The magnitude of direct compliance costs for providers of browsers or similar software cannot be estimated in quantitative terms but it is, for the above reasons, not expected to be very high. In general, this element only concerns a small fraction of all businesses applying the ePD. The browser market itself is highly concentrated in Europe: Users of Google’s Chrome browser account for a half of all website visitors, while close to a third of all users relies on Safari and Firefox. Four major companies dominate the market of browsers used by consumers: 94% of all website visitors in Europe rely on software from four companies. In addition, there are some additional browser operators with smaller market shares. On this basis, an overall moderate increase for browsers may be expected for all three solutions.

Under the present option, users with “reject third party cookies”/ "do-not-track" settings activated would be informed when visiting websites requiring tracking that visiting that website requires authorising tracking. In cases end-users choose the setting "never accept cookies" or "reject third party cookies", websites may still convey requests or place banners in their web sites requesting the user to change his/her view and accept cookies for the particular website. End-users shall be able to make informed decisions on a case-by case basis. It would then be for users to decide whether to continue to browse or to revert to alternative websites/services

Solutions for users to manage whether they want OBA tracking already exist in the market; and many privacy minded users have installed them; these solutions are part of the toolboxes related to tracking and thereby to some extent available to customers using these toolbox solutions.

While the impact on compliance costs is expected to be significantly positive, a large number of businesses would potentially incur large opportunity costs to the extent that OBA tracking would become more difficult. From a rather extreme perspective, if users would not accept third party cookies or would opt for do-not-track, such solution could undermine the availability of an essential input for OBA profiling. The reason for this is that consumers may be inclined to set their preferences on “reject third party cookies”/ "do-not-track" by default. However, in a moderate and more plausible scenario, an impact on the OBA / ad-network market might not be so significant considering that:

Basic compliance costs relating to the cookie consent rule have been estimated around EUR 900 per website (one-off), with more than 3.7 million websites potentially affected in 2030. The Commission external study supporting this impact assessment, however, reported that this figure could be much higher and even reach the levels hundred thousand euro for larger websites engaging in more complex processing operations. Given the wide formulation of the cookie-consent provision, and the limited scope of the related exceptions, this cost has currently to be borne not only by those websites engaging in web-tracking by means of third-party cookies, but essentially by all websites using cookies, even if only technical first party cookies that present little privacy invasiveness are used (except if such cookies can be considered covered by one of the strictly interpreted exceptions). The magnitude of the total savings potentially stemming from exemption from consent is therefore significant.

As concerns the new rules relating to tracking, information society services engaging in online tracking such as website operators would strongly benefit from the simplifications introduced in this area. First of all, the present option would introduce additional exceptions for first party cookies presenting no or non-significant privacy implications, such as cookies used for web measurement. This would exonerate a significant number of websites from the obligation to request consent, with connected significant savings. Additional savings are expected in relation to the introduction of the centralised setting of the privacy preferences. The new rules would indeed clarify that consent to tracking could be given by means of the appropriate setting of an application such as Internet browsers. Furthermore, it would require these operators to put in place privacy settings in a way that they can indeed be used to signify consent. Users would be prompted at the first utilisation of the equipment to choose their privacy settings on the basis of clear alternatives. Users would be able to control and modify their privacy options easily and at any point in time. As a consequence, website operators will not be in principle obliged to display cookie messages asking users to consent. This would greatly simplify website administration with connected significant savings.

The industry would face additional costs compared to the current situation based on the extension of the scope to entities previously not covered (e.g. OTTs) (large one-off cost to review and adapt data processing activities and smaller operational costs for updates and ad hoc legal advice), although the extent to which costs would change depends on the sector concerned and specific circumstances. As explained in relation to Option 2, while compliance costs are not expected in general to be high, the extension of the scope is expected to raise opportunity costs for OTTs. The option would not lead to additional costs for ECSs, as they process communications data already on the basis of consent.

Having regard to the extension of the consistency mechanism, it was estimated in the related impact assessment that authorities would need at least 2 or 3 persons working on matters in relation to the consistency mechanism (running cost). The application of the consistency mechanism to the ePrivacy rules is not expected to appreciably raise costs for the EDPS for providing the secretariat of the European Data Protection Board, with respect to the issues already covered by the present consistency mechanism under the GDPR. As a matter of fact, the GDPR already applies to the matters relating to the electronic communications sector that are not specifically regulated by the ePD. Therefore, the Board can be considered to be already sufficiently equipped to be involved in such matters.

As concerns the one-off costs, it is important to note that the greater majority of DPAs appears to already have some or all the competences to apply the ePD (for example 22 MS have data protection authorities competent for at least some confidentiality rules). For these authorities, the cost would be rather contained, as it can e.g. be expected that the number of additional staff that needs to be trained is low and the relevant IT systems already exist. As concerns the on-going tasks, it can be expected that most of the costs could be compensated by means of redistribution or refocusing of existing staff. Moreover, additional resources could derive from the increase of the powers to impose sanctions for breaches of ePrivacy rules.

For MS not having entrusted the ePrivacy enforcement to DPAs, the following types of costs are expected to arise: one-off costs relating to the shifting of enforcement powers from other authorities to DPAs (including e.g. organisation costs, costs for setting up new IT systems, costs for training staff), as well as on-going costs for carrying out the tasks related to the ePrivacy rules.

The streamlining and strengthening of enforcement powers would entail additional costs for MS authorities. The main costs for competent authorities would relate to the changes needed to allocate competence regarding all the provisions of the proposed ePrivacy instrument to the supervisory authorities of the GDPR (i.e. data protection authorities or DPAs) (one-off cost) and the extension of the consistency mechanism to aspects relating to the ePD (running cost). It should be noted that these costs will have to be borne specifically by the authorities in those MS that have not attributed competence to apply the ePD to the same supervisory authorities competent for applying the GDPR. Member States have followed very different approaches in this respect. Some Member States have designated DPAs (e.g. Bulgaria, Estonia, France), others the telecom national regulatory authority (NRAs) (e.g. Belgium, Finland, Denmark) and still others appointed both DPAs and NRAs (e.g. Austria, Germany, Greece) for the ePD enforcement. In some Member States, competence concerning the ePD is even shared between three or four different authorities, including in addition to DPAs and NRAs e.g. consumer protection authorities. The table included in Annex 11 presents an overview of the situation in each Member States.

The costs for the Commission and for MS are essentially the same as option 2 (low). However, in this case the Commission would need to devote resources to issue the necessary delegated and implementing acts concerning the transparency measures. It is estimated that this would require one administrator working full time on these matters (one-off and running cost). As per Option 1, most of these measures could be undertaken by redistribution and refocusing of existing personnel and with the contribution of ENISA and the JRC.

Even if the scope is extended to entities which are currently not subject to the rules, these entities will be able to use the additional flexibility introduced under this option (i.e. process communications data with consent or with privacy safeguards). ECSs will have more opportunities to process communications data and engage in the data economy.

In addition, this option would ensure that the new instrument would be in line with the market and technological reality. For example, the introduction of exceptions for Article 5(3) means that non-privacy invasive techniques are no longer covered by this provision. On this basis, fewer websites would be covered by Article 5(3).

The changes to Article 5(3) would also contribute to simplification. In particular, citizens would be able to manage their privacy settings in a centralised way, which is valid and binding for all third parties. Information society services engaging in tracking activities would be able to rely on the general privacy preferences set by the users.

Option 3 would satisfactorily achieve the objective. In addition to the positive elements of Option 2, the clarification and specification of certain rules would contribute to simplification and harmonisation. This would improve the situation for businesses. It would also increase transparency for citizens. By reinforcing and streamlining enforcement rules, ensuring that the same supervisory authorities, namely the data protection authorities, entrusted to enforce data protection rules under the GDPR, are also competent to enforce ePrivacy rules, this option would significantly improve the current situation of incoherent and differentiated enforcement. The allocation of the enforcement to data protection authorities and the extension of the GDPR consistency mechanism would ensure consistency, simplify the regulatory framework and thus reduce the administrative burden.

Option 3 would significantly contribute to achieving the objective. In addition to the positive elements of Option 2, the generalisation of the opt-in consent is expected to reduce the possibility of error by direct marketers, i.e. reaching persons that do not want to be reached (but have not subscribed to an opt-out list or in cases where opt-out lists are not functioning properly) and shift the burden of proof from citizens to callers to demonstrate that they have obtained consent. By contrast, it should be noted that the enforcement against unlawful calls is particularly difficult, especially where callers conceal or disguise their identity. Considering that the evidence collected during the impact assessment did not lead to conclude unequivocally that the problems related to unsolicited communications are caused by the opt-out systems, but rather as the result of its ineffective implementation, there is no precise guarantee that this measure would effectively improve compliance. Finally, the clarification of the rule on calling line control would make it easier for citizens to avoid unwanted marketing calls, as they would be able to block certain (categories of) numbers.

By contrast, the introduction under this Option (see under Objective 3) of a derogation to the consent rule for the processing of communications data (e.g. traffic and location data) for marketing purposes (measure No 10(e)) undermines at least to a certain extent the effectiveness of the option vis-à-vis its objective of reinforcing the protection of confidentiality of communications. The possibility for OTTs and ECSs to interfere with the confidentiality of electronic communications without the consent of the users reduces citizens' control over their communications and therefore constitutes a significant limitation in relation to the present objective. While the negative effects on privacy protection would be limited by strict safeguards, i.e. as approved by the competent authorities, this element reduces the effectiveness of this option.

This option would further reinforce the transparency of tracking technologies. The provision of clear and concise standardised information is expected to contribute to resolving the problems caused by tracking practices in public spaces. Privacy sensitive citizens will be better informed and be able to freely decide whether to agree or to move to a competing, more privacy friendly solution.

By mandating applications enabling access to the Internet such as browsers to implement and preconfigure privacy friendly settings, this option would reinforce user's control and at the same time greatly simplify the management of privacy preferences. Users will be able to manage their preferences in a centralised way regarding access to information stored in their terminal equipment. At the same time, it is expected that this option would significantly reduce the interference provided by cookie banner with users' browsing experience. In the online world, users are increasingly overloaded with notices and requests for consent. Given the limited time available and the increasing complexity of online interactions, users are less capable of coping with the growing amount of notices and requests. A centralised system governing users' privacy choices with regard to all third party interactions with their terminal equipment would greatly simply and make the level of protection more effective. Finally, by streamlining and strengthening enforcement rules, notably by specifically entrusting them to the same supervisory authorities as those enforcing the provisions of the GDPR, this option would create the conditions for a more effective and consistent enforcement.

This Option would achieve the objective. In addition to the positive aspects remarked in relation to Option 2, this option would introduce a more comprehensive and technology neutral notion of interference with the privacy and confidentiality of terminal equipment. This measure would make sure that the protection established by the provision in question would cover any interference with users' privacy. In particular, it would cover the technique of device fingerprinting, which is currently at least in part not covered by the present provision.

Therefore, the Option is in line with the views of citizens and public authorities. However, business organizations demanding the total repeal of the ePD would be against the proposal of maintaining the current dual regime of data protection/privacy regulations. OTTs would not support the extension of the ePrivacy rules to cover their activities.

The public consultation shows that an overwhelming majority of citizens and civil society and public bodies find that OTTs should provide the same level of protection when they provide communications services as ECS providers. As far as the industry is concerned, only (over) a third of the industry agrees, which includes ECSs and OTTs . The need to guarantee confidentiality of communications regardless of the technology used is also confirmed by the Eurobarometer on e-Privacy, the Article 29 Working Party and the EDPS. Civil society strongly supports the extension of the rules to OTTs and reinforcement of protection of security and confidentiality. Close to 90% of citizens, civil society and public authorities favour an opt-in regime whereas 73% of industry favours an opt-out regime.

Option 2 would have a composite effect. Greater protection of privacy of electronic communications may to a certain extent limit innovative business models relying on a large availability of data, such as free online personalised services. However, by extending confidentiality requirements to OTTs, the present option is expected to stimulate research and innovation on privacy-enhancing solutions.

This option would have positive effects on the level of protection of confidentiality of communications and related personal data as it would increase the protection by extending/clarifying the principle of confidentiality to communications not currently covered. However, shortcomings relating to online tracking would not be addressed.

Option 2 would have a positive effect on the internal market. The measures at stake would cover some gaps of the existing ePD, solving the problems related to its unclear, inconsistent and fragmented scope. They would also clarify the rules on unsolicited communications. Accordingly, the option is expected to slightly or moderately enhance harmonisation. The increased cooperation may foster consistency. However, the plurality of enforcement authorities, which has been seen as a major hindrance to consistent enforcement, will not be addressed.

The impact on SMEs of this option is generally connected with the extension of the ePrivacy instrument to OTTs and the clarification that the instrument also applies to publicly available private networks. It can be foreseen that a greater number of SMEs would be caught within the scope of the confidentiality rules and subject to the restrictions concerning the processing of electronic communications data. This implies additional compliance costs and opportunity costs. As highlighted above, it is possible that existing business models of OTT providers would need to be revised to the extent that they will no longer be able to rely on other legal bases under this option than consent. Thus, this specific sector would be significantly affected, at least in the short term. These costs would be higher for smaller players and newcomers that do not operate on the basis of consent. These OTTs may find it more expensive, as a result of tighter confidentiality rules, to obtain users' consent and establish the critical mass of users needed to compete with the established operators.

Option 2 would ensure that all players offering communication services would face equal regulatory standards. However, the level playing field would be ensured essentially by extending the current regulatory constraints beyond ECS, without providing for additional flexibility. This may limit competitiveness.

In conclusion, this option presents moderate transposition/implementation costs for MS and compliance costs for some categories of businesses (OTTs). Moreover, the extension of the rules to OTTs would raise moderate/high opportunity costs for these operators.

The external study supporting the present impact assessment attempted to estimate the impact on costs of each option, on the basis of a pragmatic model based on a wide range of assumptions reflecting the general scarcity of data. Taking these limitations into account, the external study supporting the present impact assessment has estimated that this policy option would increase the overall compliance cost for the businesses affected by a 15% compared to the baseline scenario, leading to an additional EUR 203.3 million compared to the baseline scenario. Far from being a precise figure, this gives however a rough idea of what the magnitude of the overall impact on businesses could be. The tables including the calculations relating to the key quantitative findings are in Annex 8. While the increase in cost in absolute terms is high, it should be considered that this reflects the fact that (some provisions of) the ePD covers a very broad range of affected entities, i.e. all businesses having a website. In average terms, the increase in costs is much more measured and cannot be considered a priori excessive in light of the underlying objectives. Being an average figure, this does not mean of course that the increase in costs may not be significantly greater for some companies (e.g. because significantly wider or more complex processing operations are at stake) or significantly smaller for other companies (e.g. because much smaller or less significant processing operations are at stake).

Eventually, the negative effects on opportunity are likely to be mitigated by two concomitant factors: 1) the fact that a significant number of users may be willing to share their data in order to benefit from personalised services; 2) the ability of providers to adapt and innovate their modus operandi by offering more privacy friendly alternatives, thus spurring competition and innovation on privacy features of their services. Overall, it is considered that the extension of the scope would raise opportunity costs for OTTs, but that this impact may be, at least in part, mitigated by the above factors.

While the impact on compliance costs is not expected to be significant, this option would certainly have an impact on opportunity costs for OTT providers. OTTs would face stricter standards compared to the current situation, namely with regard to the obligation to process communications data only with users' consent as well as with regard to the limitation concerning traffic and location data. To assess the magnitude of these costs, it is important to consider that several popular OTT communication providers operate today on the basis of consent and have put in place significant measures aimed at improving the transparency and security of their data processing activities (e.g. end-to-end encryption). However, even though consent is given by users in these cases, it will have to be verified whether the format of and the extent to which such consent can be considered in line with the notion of consent pursuant to the GDPR. The existing consent used would thus need to be reviewed and aligned with the GDPR concept in case the ePrivacy rules would also apply to these players, leading to compliance costs and potentially also to opportunity costs in cases where OTT players would be obliged to revert to less effective moda operandi or business models. Under this perspective, opportunity cost may be significant for providers which do not operate already in line with the GDPR consent notion. The limitations concerning traffic and location data further increase the impact.

As for unsolicited communications, the rules will be formulated in a technology neutral way, which would imply their applicability to ads sent through OTTs falling within the scope of the new instrument. The applicability to such OTTs is not clear based on the current ePD and interpretations differ among MS. This implies therefore a potential extension of the scope of the current rules to other players not previously covered, at least in some MS. This would increase compliance costs for these businesses by an amount corresponding to the tasks needed in order to ensure that either prior consent is collected or users having opted-out do not receive marketing messages (e.g. one-off cost to adapt a website in order to include mechanisms to require consent or allow opt-out). Some further costs would ensue from the obligation to use a specific prefix in order to distinguish direct marketing calls from other calls (annual running cost for subscribing to the prefix service). It can be assumed that this would amount to a small one-off cost for the introduction of this prefix. According to the external study supporting the impact assessment, the cost for the introduction of the prefix would be of around EUR 500 yearly per company.

However, the extent to which costs would change would depend on the sector concerned and specific circumstances. These costs, in particular, are not expected to be particularly high for big/medium enterprises, which have consolidated experience in the application of privacy rules. In particular, these changes would not substantially affect those OTT (such as especially the largest players) that already operate on the basis of consent. Finally, the impact of the option would not be felt in those MS that have extended already the scope of the rules to OTTs. In these cases, the overall added burden (in terms of compliance and opportunity cost) is expected to be fairly contained at least in relative terms.

Industry would face some additional costs compared to the current situation based on the introduction of additional requirements for some operators previously not covered by the framework. As a consequence of the extension of the scope, OTT providers would no longer be able to rely on all legal grounds for processing personal data under the GDPR and would only be allowed to process communications data with the consent of the users. OTT practices in MS will have to be revised in order to ensure compliance with the ePrivacy rules on confidentiality (large one-off cost to adapt their data processing activities to the new rules and progressively smaller operational costs for updates and maintenance of processing systems) and other ePD rules on calling line identification and automatic call forwarding (for OTT using numbers) and directories of subscribers (all OTTs) (as above large one-off cost and smaller operational costs). This would entail a careful review and adaptation of the current data processing practices, based on a thorough legal analysis likely requiring external professional advice.

The extension of the ePrivacy rules to new actors, such as OTTs (e.g. with regard to confidentiality and unsolicited communications) would add-up to the supervisory duties of national authorities, thus increasing their administrative workload (running cost). Strengthening cooperation among national authorities would entail additional costs for public authorities that are currently not equipped with appropriate powers and adequate resources (running cost). It is difficult to estimate such costs in detail, given the differences in the size, available resources and sources of funding, tasks and powers of national DPAs. Costs will be higher for those MS whose authorities are currently not equipped with the appropriate tasks, powers and resources to ensure effective international cooperation. On the other hand, the impact is expected to be moderated by the experience already formed in the framework of the Article 29 Working Party and BEREC. The interaction already existing within these groups is likely to reduce learning and other transaction costs in this respect, at least by providing an already existing template for cooperation.

MS will have to implement the new rules. If the new ePrivacy rules are contained in a directive, the new ePD would need to be transposed into MS laws. This would normally require some targeted changes to the current legislation. While the changes are not extensive, the enlargement of the scope may pose complex legal and technical issues to be resolved by national legislator. If the rules are contained in a Regulation, MS costs relating to the adaptation of the legal framework will be more limited.

The costs for the Commission are not very high and essentially coincide with the legislative process. Costs for the Commission to oversee the implementation and functioning of the new instrument would not change significantly compared to the current situation.

The repeal of the security rules would simplify the legal framework by eliminating regulatory duplication with other legal instruments, such as the GDPR, the Telecom Framework and the NIS Directive.

The clarification of the rules regarding the scope (see under Objective 1) and unsolicited communications (see under Objective 2) would help eliminate/reduce the risk of divergent transposition and implementation by MS. Moreover, the present option wold reinforce cooperation, by including a specific requirement for exchange of information and cooperation in cross border-cases. However, in the absence of more specific and formalised coordination rules, the impact on overall consistency of the enforcement is expected to be limited.

The effectiveness of this measure is, however, somewhat reduced by the fact that some phones may not display the calling number or that some companies may not provide this service for free. While the vast majority of mobile phones today would be technically equipped with a calling line identification function, the situation is different for landline fixed telephones. First, some telephone terminal equipment (old phones or vintage phones) do not have a display; second, in some MS, some telecom providers may not offer a calling line identification service or offer it as a premium service against the payment of a monthly fee. The introduction of the prefix would therefore not benefit those fixed telephone lines where the calling line identification is either not offered or not requested by the user.

The introduction of a special prefix is expected to increase transparency and allow citizens to reject or not answer calls identified as such thanks to the prefix. It is considered that such proposal would help reducing the nuisance generated by repeated or unwanted cold calls. Assuming that most marketers effectively comply with such rule, citizens would identify the call as being a marketing call and be able to freely decide at any time whether they intend to pick-up the call or not. It is therefore an additional safeguard for citizens to defend themselves against nuisance calls.

Option 2 would partially contribute to achieving the objective. The clarification of the scope would ensure that all forms of unsolicited electronic marketing are caught by the provision, irrespective of the technology used. This change would ensure that the proposal remains technology neutral and thus fit for purpose despite technological developments.

Option 2 would significantly contribute to achieve the objective, although only in part. The extension of the scope of the instrument would fill considerable gaps in the protection guaranteed by the current ePD. However, the present option presents two fundamental limitations. First, it would not address the issues identified in relation to the so-called cookie consent rule, i.e. consent fatigue, lack of transparency and freely-given nature of the consent. Second, it would not effectively address the issues connected with enforcement (see Section 1.4 on problem drivers).

The striking majority of stakeholders across all categories criticised the current rules and asked for a change. Citizens and civil society organisations request more privacy protection. Public authorities (EDPS, WP29 and BEREC) expressed similar views. Operators concerned in the ECS sector and OTTs both support deregulation and consider that the general data protection rules provide sufficient protection. Therefore, they recommend the ePD to be essentially repealed. These measures would thus not find substantial support in any group of stakeholders.

The impact on fundamental rights is difficult to predict, as it largely depends on the content of the measures adopted and on the degree of implementation in practice. In general, considering that any improvement would only be possible within the limitations of the current rules, it may be assumed that any positive impact could only be moderate.

The impact on internal market may be considered mildly positive. Interpretative communications from the Commission, self and co-regulation initiatives as well as standardisation activity at EU level would contribute to a certain extent to greater harmonisation of the current rules. However, there are also important limitations to the harmonising effects that these measures could achieve. Indeed, the interpretation and enforcement of privacy requirements is the task of independent national authorities. It rests ultimately upon the judgment of these authorities and national courts whether guidance from the Commission on the interpretation of the ePD provisions should be followed. Moreover, the success of self-regulatory measures depends on a number of circumstances, such as the degree of participation and compliance by the industry concerned.

The policy option aims to make the ePD implementation and application more effective, inter alia by introducing and disseminating new guidance, standards and best practices. For microenterprises and SMEs this implies the onus to understand and apply such guidelines, if necessary introducing the necessary changes in their processes. Some costs for microenterprises and SMEs may derive from the participation in standard setting or co-regulation activities, even though such participation is voluntary. On this basis, it is expected that Option 1 would create some additional costs for such companies. At the same time, the dissemination of additional guidance may contribute to enhance legal certainty and accordingly businesses may need to spend less in interpreting certain provisions.

This option is expected to have limited impact on the overall macroeconomic context as the rules, the conduct of the operators concerned as well as the level of compliance with ePrivacy rules, are not expected to change significantly. Small positive impacts may be expected based on the increased efforts to ensure correct implementation and the support for EU-wide self-regulatory initiatives. Both would slightly contribute to greater harmonisation.

The direct impact on businesses is negligible. Businesses would continue to face essentially the same compliance costs and costs related to administrative burden. ECS providers would continue facing the same opportunity costs vis-à-vis OTT providers, resulting from the stricter rules they are subject to under the current ePD. It can be assumed that some minor cost savings would occur based on the clarification of the legal framework resulting from the interpretative communications and the Commission’s promotion of a business-friendly (but effective) approach to the current rules. At the same time, minor costs could be incurred. Specifically, industry would need to bear certain costs for allocating resources for the participation to the codes of conduct and standard-setting activities. Considering past similar exercises, it could be assumed that the increase of cost would be moderate, as participation would be voluntary and normally only a relatively small proportion of businesses participate in such activities (running cost for the duration of the standardisation activities). In this context it is to be noted that some businesses already participate in such activities. Businesses would be more extensively affected by the specification of privacy by design requirements of terminal equipment through EU standards, as they would need to implement the new standards (one-off cost and lower running cost ensuring updates). Depending on the content of such standards, the companies concerned may be more significantly affected.

National authorities will have to be involved in the co-regulatory efforts. This cost would vary according to the number of meetings and the degree of cooperation. Assuming that many issues may be steered by the Commission, a conservative estimate of 3 meetings a year for 3 years, the cost may be estimated to be between EUR 2,500 and 7,000 per authority/per annum (running cost). Similarly, national authorities would need to finance participation in efforts towards coordinated enforcement. Assuming in this case 2 meetings per year, the annual cost would be between EUR 1,700 and 4,700 (running cost). Minimal compliance costs for MS authorities to get familiar with the new implementing/soft law measures would be around EUR 1,000 per authority (1 day of training) (one-off cost) .

The launching of an awareness raising campaign may require the help of an external contractor; the cost may be estimated in the region of EUR 250-400,000 depending on the tools employed (one-off cost). The funding of projects under the Secure Societies chapter of H2020, covering awareness-raising and other activities, amounts to EUR 1,694.6 million. Of these, EUR 19.04 million were specifically dedicated to the topic “Privacy” under work programme 2014-2015. A 25% increase would amount to EUR 4.76 million for the period 2014-2020, equalling an average annual increase of 680,000 Euro (running cost for the duration of the intervention).

The soft measures identified in this option would have a limited positive effect, by introducing additional guidance and cooperation. However, the same limitations as under Objective 1 apply. The internal and external inconsistency (including with the GDPR) of the ePD would not be effectively addressed in the absence of a legislative change. Similarly, the existing fragmented implementation will not change significantly in the absence of legislative intervention: while it is possible for MS to cooperate and exchange good practices, any change and improvement would take time and not necessarily lead to significant results. Likewise, the costs and business constraints stemming to certain ePD provisions would not be addressed.

While the soft measures identified in this option would contribute to improve the current implementation, they present in general the same limitations identified in general in relation to Objective 1 above.

Awareness raising activities would be beneficial, but would however not be sufficient for reinforcing individuals' rights effectively in the absence of a strong underlying legal framework.

Self-regulation, security and privacy by design standardisation would have positive effects. However, the success of these initiatives depends on the goodwill and agreement of the participating stakeholders. Negotiations may take considerable time and efficient outcomes are not guaranteed. The establishment of EU level self-regulation mechanisms could, in fact, only be achieved meaningfully and effectively with a clear and harmonised legal framework at its foundation.

While the soft measures identified in this option may to a certain extent contribute to improve implementation, they also present a number of limitations. The limited scope of the ePD cannot be effectively extended by interpretative communications or other soft law measures. The CJEU offered an interpretation of the notion of electronic communication service which is clearly linked to the responsibility for the conveyance of signal over the underlying electronic communication network vis-à-vis end-users. The so-called OTTs provide their services in the form of applications running over the internet access service (hence "over-the-top") and are therefore in general not subject to the current EU telecom rules. The Commission could not enforce, therefore, the current ePD against MS for not extending its scope to entities not currently covered. Moreover, interpretative communications would not be binding and could therefore have only limited impact on reducing legal uncertainty and resulting costs.

This section analyses the economic, environmental and social impact of the option in line with the Better Regulation Guidelines together with the coherence with other policy and the views of stakeholders. The description of the impact of the options included in this section is complemented by an in depth economic analysis conducted by an external contractor supporting the present impact assessment (see Annex 8). The detailed assessment of the impact of the policy option on different categories of stakeholders is included in Annex 7. As the external study makes clear, the economic assessment faced some limitations in the collection of data, whose impact was mitigated to a maximum possible extent (the limitation encountered are explained in Annex 8). The expected costs and benefits/cost-savings of each option are summarised and compared in Annex 13.

5.What are the impacts of the different policy options and who will be affected?

5.There would be no duplication of rules in the security area and the privacy in the electronic communications sector would be regulated solely by the general data protection rules.

4.The new data protection rules would apply equally to all providers of electronic communications without distinctions based on the technology used. The concrete application of Article 7 of the Charter imposing the respect for private life and communications would not be specified in secondary law provisions, hence creating legal uncertainty.

1.The GDPR provides for reinforced rights of individuals and obligations of data controllers, which are in keeping with the challenges of the digital age. The consent rule under the GDPR has been in particular substantially strengthened with a view to ensure that it is freely-given. The GDPR addressed the issue of unbalance of power between the controller and the processor, requesting that this aspect be taken into account in the assessment of the validity of consent. Also other grounds for processing electronic communications data would be available under the GDPR, such as contract and legitimate interest.

Under this option, the Commission would propose the repeal of the ePD. Several stakeholders, especially in the ECS and OTT sector, have argued that ePD rules are no longer needed and that the objectives of the ePD would be achieved by the GDPR alone. With the repeal of the ePD, the confidentiality of electronic communications would fall under the general data protection regime as laid down in the Directive 95/46 and as of 2018 the GDPR. The objectives would be achieved as follows:

2.Introduce Commission's implementing powers for deciding on the correct application of the ePrivacy rules in order to ensure correct and consistent application of the EU law.

4.Under this option, the Commission would repeal the provision allowing direct marketers to send electronic mail to subscribers and users when they have received their contact details in the context of a previous business relationship .

2.Explicitly prohibit the practice of denying access to a website or an online service in case users do not provide consent to tracking (so-called "cookie-wall").

Under this option, the Commission would propose more far reaching measures reinforcing the protection of privacy/confidentiality and guaranteeing greater simplification/harmonisation. In particular, under this Option the Commission would propose a general banning on the so-called "cookie walls" and specific Commission implementing powers for ensuring consistent enforcement across MS.

e.For a lawful business practice (e.g. OBA) where the processing is strictly limited to anonymised or pseudonymised data and the entity concerned undertakes to comply with specific privacy safeguards.

d.For a lawful business practice provided that there are no significant risks for the privacy of individuals. In particular, the data collection is performed solely by the entity concerned on behalf of the ECS for the purpose of web analytics and web measurement.

c.Billing: in line with the current provision on traffic data, communications data may be retained insofar as necessary for billing or network management purposes.

b.Security: the processing of traffic data is necessary to protect, maintain and manage the technical security of a network or service, with appropriate privacy safeguards.

a.Transmission or provision of a service: the processing of communications data is necessary for the purpose of the transmission of the communication or for providing a service requested by the user.

10.Providing for additional/broadened exceptions to confidentiality/permitted uses for specific purposes which give rise to little or no privacy risks:

9.Repeal the provisions on traffic data and location data to reflect the fact that the traffic and location data are more and more a homogeneous category, both in terms of privacy intrusiveness and technological availability ("communications data"). The processing of traffic and location data will be regulated under the general provision of confidentiality of communications.

7.Reinforce and streamline enforcement powers: The new instrument would make sure that national competent authorities are provided with effective investigation end enforcement powers, including deterrent administrative fines and remedies. The proposal would entrust the application and enforcement of the provisions of the ePrivacy instrument to the same independent supervisory authorities appointed under the GDPR since confidentiality and privacy of electronic communications are closely linked with the related personal data processing. Under this option, the Commission would also extend the application of the consistency mechanism established under the GDPR to the supervisory authorities established under the ePrivacy instrument.

6.Propose changes aimed at clarifying and minimising the margin of manoeuvre of certain provisions identified by stakeholders as a source of confusion and legal uncertainty. This will be achieved, in part through the measures identified above, by clarifying applicable law, the scope of the provisions concerning confidentiality of communications, the scope and requirements concerning confidentiality of terminal equipment and the rules on unsolicited advertising.

5.Extend the provision on presentation of calling line identification to include the right of users to reject calls from specific numbers (or categories of numbers).

3.Impose enhanced transparency requirements alerting users when information emitted by their devices is captured. Entities collecting such information would be obliged to display clear, concise and conspicuous privacy messages/alerts (including by means of icons). The Commission would have delegated powers to specify the exact form and content of the message to be displayed.

Under the new rules, users would be prompted at the moment of the first utilisation of the equipment to choose their privacy settings among a specifically established set of privacy options, ranging from higher (e.g. “reject third party cookies” /"do not track") to lower levels of privacy protection. Users will be able to control and modify their privacy options easily and at any point in time. Users with reject third party cookies” /"do-not-track" settings in place would be clearly (but unobtrusively) informed when visiting websites requiring tracking and/or accepting third party cookies that visiting that website requires authorising tracking. It will then be for the user to decide whether to accept the tracking on the specific website or not. The general aim of this provision is to simplify and make the cookie handling by users more privacy friendly.

2.On the subject of confidentiality of terminal equipment and tracking of online behaviour the envisaged proposal would reformulate the current approach in favour of a technology neutral approach applying to all forms of tracking of (or other interference with) users' terminal equipment (including with regard to online behaviour), irrespective of the technique employed. The proposal would clarify that consent can be given by means of the appropriate settings of a browser or other application. Consent under this option will be in line with the concept of consent under the GDPR. In line with the privacy by design principle, and in accordance with the GDPR and the RED, the proposal would require certain software providers to provide more transparency and provide their products with privacy friendly settings as a means to provide consent and to reinforce user's control over online tracking and over the flow of data from and into their terminal equipment.

1.The new instrument would propose a technology neutral definition of electronic communications, encompassing a