Since January 2017, every European marketing manager has heard the same sentence in meetings: “anyway, the ePrivacy Regulation is going to change everything”.
It will change nothing. The European Commission withdrew its proposal on 6 October 2025.
The European Parliament’s Legislative Observatory shows the status of procedure 2017/0003(COD) without ambiguity: “Procedure lapsed or withdrawn”, last recorded event “Proposal withdrawn by Commission”.
Eight years, and nothing
The proposal was meant to replace the 2002 directive with a regulation, that is, a directly applicable text, identical across the twenty-seven member states.
It was also meant to settle several open questions: the status of cookies and their equivalents, the place of modern electronic communications, the fine articulation with the GDPR.
It died in the Council, after eight years of negotiation, without ever reaching a concluding trilogue. The withdrawal is part of the Commission’s 2025 work programme, which provided for abandoning several blocked or obsolete proposals.
What remains in force, and why that is not neutral
The European text applicable to email marketing therefore remains Directive 2002/58/EC, whose Article 13(1) sets prior consent:
“The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent.”
A directive, not a regulation. The difference is not a lawyer’s subtlety: it decides your workload if you send across several countries.
A regulation applies as written everywhere. A directive must be transposed by each state, with its own margin of interpretation, its own definitions and its own supervisory authority. Twenty-seven transpositions, twenty-seven versions of the same principle.
In France it is Article L.34-5 of the postal and electronic communications code, and the CNIL’s guidance. In Germany, Spain or Italy, other texts, other authorities, and sometimes other answers to the same question.
The withdrawal of the regulation freezes that fragmentation for a long time. That is its main consequence, and the only one to retain.
What the withdrawal does not do
It repeals nothing. The directive remains enforceable, so do the national transpositions, and authorities keep sanctioning on that basis: the CNIL issued a 900,000 euro fine in May 2025 for breach of Article L.34-5.
It liberates nothing either. Those expecting a relaxation will be disappointed; so will those expecting a tightening. European email law is the law of 2002, supplemented by the GDPR of 2016, and it will remain so for the foreseeable future.
Nor does it change the division of labour between the two texts. Article 95 of the GDPR provides that it “shall not impose additional obligations” where the 2002 directive already sets specific obligations with the same objective. In practice: the legality of the channel comes under the directive, the processing of the data comes under the GDPR.
The paradox of waiting
For eight years, the announcement of a text to come served as an argument for two opposing camps.
For the cautious, to justify expensive arrangements put in place in anticipation of a text that did not exist.
For the reckless, to postpone compliance work on the grounds that “everything was about to change”.
The second group lost more, because the law applicable during those eight years never stopped applying, and because the authorities did not suspend their activity while waiting for Brussels.
The lesson goes beyond this file: a draft text is not a text, and a company that regulates its conduct by drafts is always in compliance with an imaginary law.
What to do tomorrow morning
Remove from your internal documents every mention of an ePrivacy deadline. They are still there, in roadmaps and training decks, and they describe a world that does not exist.
If you send across several European countries, take stock of your markets and check the transposition applicable to each. The exercise is tedious and unsurprising on the general principle, but the differences live in the details: definition of an existing customer, treatment of business addresses, deadlines.
And for France, stick to the two texts that actually govern you: Article L.34-5 for the legality of the send, the GDPR for retention and individuals’ rights. They are stable, public, and nobody will replace them soon.
Sources
- European Parliament, Legislative Observatory. Procedure 2017/0003(COD), Privacy and Electronic Communications. Status: Procedure lapsed or withdrawn, withdrawal recorded 6 October 2025
- Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, Article 13
- Regulation (EU) 2016/679 (GDPR), Article 95
- French postal and electronic communications code, Article L.34-5
- CNIL (decision of 15 May 2025). Prospection commerciale : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.