Playing Regulatory Catch-up? – The Relevance of EDPB Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive

Abstract

Recently, the European Data Protection Board (the EDPB) released new guidelines on the technical scope of Art. 5(3) of the ePrivacy Directive (the ePD) and held its consultation procedure. These guidelines aim to clarify the scope and details of Art. 5(3), specifically what ‘the storing of information, or to gain access to information stored in the terminal equipment of a subscriber or user’ means on a technical level. This opinion describes the circumstances under which such information may be stored or accessed.

In this contribution I pose the hypothesis that the broadening of the published guidelines is at least in part necessary to prevent the ePD from becoming irrelevant, if only non-covered techniques are to be used. In this opinion, I will first discuss the background of the ePD, provide context for the guidelines and their structure, and then follow and comment on the respective parts of the analysed phrase alongside the analysis of the EDPB. In the end, I will conclude and check if all the latest developments are likely to be caught by the new interpretation according to the technical guidelines, and what this could mean for legal practice.

I. Introduction

The most ‘in the news’ data protection regulation over the last few years is likely the General Data Protection Regulation (the GDPR), for supposedly forcing cookie banners on everyone (which it does not, that’s just the path most companies chose). It was preceded by the Data Protection Directive (the DPD), which had been in force since 1995 and also regulated the processing of personal data and the freedom of movement of personal data. The GDPR broadened the scope of the definition of personal data, broadened its reach to have more global consequences and made data processors directly liable. The ePD works alongside the GDPR, harmonising provisions to ensure the right of privacy and confidentiality set forth in the EU Charter of Fundamental Rights (the CFR) and complements the GDPR ‘with respect to the processing of personal data in the communications sector’.¹ It applies to all offerings of an electronic communications service to the public, if that service is offered over a network and offered in the EU. Only Arts. 5(3) and 15 apply more broadly also to website owners and other businesses, even if they do not offer a communications service. It is also possible for both acts to apply, as is the case for cookies.² In most cases, the ePD acts as a lex specialis on the general rules of the GDPR. The EDPB gives the example of traffic data, which is limited by the application of the ePD.³ Any references to the previous DPD can be replaced with references to the GDPR in the ePD. As the ePD is relatively old, some of its language will sound a bit dated, like reading legislation written for the early internet and fax machines. An update to the ePD was proposed in the form of the ePrivacy Regulation (the ePR), but it has not seen any progress in six years.⁴ Still, if one looks past this exterior shell, the inside is still relevant to newer technology and legal questions that come with it. This also seems to be the opinion of the EDPB and its predecessor, Art. 29 Working Party (the Art. 29 WP). In their opinions and guidelines over the years, they have clarified their view on privacy regulations, especially regarding the GDPR and its relation to the ePD, and the application thereof to cookies and anonymization techniques.⁵ These soft-law documents are published with some regularity and are likely crucial to provide some overarching guidance at the EU level, even though they do not bind the national authorities or interpretation by the courts in any way. Still, it is unlikely that participating authorities will diverge much from the guidelines they helped create.

Having regard to the ePD and previous opinions of Art. 29 WP and its own previous work, the EDPB recently ran a public consultation regarding its newly updated technical guidelines⁶ for the ePD.⁷ The technical guidelines concern themselves, specifically and solely, with the elucidation of the phrase ‘the storing of information, or to gain access to information stored in the terminal equipment of a subscriber or user’, which Member States should ensure is only allowed when a user or subscriber has been duly informed, has given consent and has been given the right to refuse.⁸ While some commentators have doubted the authority of the EDPB to publish such guidelines that broaden the application of the ePD⁹ and take some issue with potential effects,¹⁰ I would argue that the guidance offered in the technical guidelines is a natural evolution of legislation originally drafted in a different time with different technological boundaries, which so far lacks any contemporary replacement while waiting for the ePR. Especially in the light of business big and small always finding new ways to creatively misunderstand data protection provisions, this ‘regulatory catch-up’ is sorely needed.

In its guidance on fingerprinting in WP29 Opinion 9/2014¹¹ and on the Cookie Consent Exemption in Opinion 4/2012, the Art. 29 WP clarified that in its opinion the relevant phrasing also applies to other technologies and brings them into the ambit of the clause, and that the phrasing does not only apply to cookies. The EDPB also states that perceived ambiguities have ‘created incentives to implement alternative solutions for tracking internet users and lead to a tendency to circumvent the legal obligations provided by Article 5(3) ePD’.¹² This is true, even though the selection of its example use cases might not properly reflect the latest development in these technologies. Instead, it also includes technologies such as tracking pixels which have been used in addition to cookies for a long time and so cannot really be said to be used as a response to the problematic use of cookies.¹³

II. Structure of the technical guidelines

The EDPB steps through the phrasing of the relevant phrase in Art. 5(3) ePD ‘the storing of information, or to gain access to information stored in the terminal equipment of a subscriber or user’ word for word and also points out specifically that exemptions to the consent requirement are not discussed. This also means, for example, that whether or not consent has been obtained, or whether other circumstances are present, is out of the scope of the guidelines, in that sense they are very technical and only technical.

With regard to reacting to a changing technical landscape, the EDPB specifically mentions technical identifiers embedded in machines or operating systems, as well as ‘tools allowing the storage of information in terminals’.¹⁴ However, on the face of it at least, none of these seem to be particularly new. Their description might, however, fit certain new developments explained below, although you wouldn’t know it directly from first reading.

In the detailed analysis, the guidelines step through four major criteria of the phrase of the ePD, which are: (i) information, (ii) terminal equipment, (iii) ‘provision of publicly available electronic communications services in public communications networks’ and (iv) ‘gaining of access’ or ‘storage’.¹⁵

1. ‘Information’

The first criterion (i.e. information) is put into the context of its grounding in the private sphere of users and Art. 7 of the EU Charter of Fundamental Rights (Respect for Private and Family Life),¹⁶ where the guidance interprets the term information very broadly, though with good reason. Essentially, information is designated as all information on a user’s device, independent of who or what put it there and for how long it exists. The EDPB especially stresses that information does not only mean personally identifiable information, as might be inferred by a casual observer. This is in fact a core pillar of its further arguments and the elaboration on the use cases. This can be seen as an extension of authority and broadening of the application of the ePD but is only logical to counter ambiguities and perceived circumventions, as well as more and more refined techniques for re-identifying seemingly innocuous information.

2. ‘Terminal equipment’

The second criterion (i.e. the terminal equipment or, more commonly, the devices in question) covers all kinds of devices according to the guidance, with the exception of relays or other pass-through devices. It also does not matter what ownership model the device employs or if it consists of one or more parts.¹⁷ Furthermore, according to the technical guidelines it does not matter whether a protected communication was enacted by the user or not. Several comments on this in the consultation found this notion to be too broad or sometimes incoherent. Still, the overall intent is clear: closing loopholes.

In some of the comments so far, in conjunction with ‘gaining access or storage’, this was criticised especially harshly, as it could encompass some functionality that is inherently necessary for the functioning of the internet, such as sending the web address that is requested by the browser to the server.¹⁸ This address can also be (and is in fact) used for tracking, such as when a social media post or news article has a unique identifier attached to its end. Some of the oppositions voiced as part of the EDPB consultation procedure claim that in fact such tracking is privacy friendly, and in some cases this can be true or it can at least be more privacy-friendly. There is also a large amount of information that can be sent this way, which makes it not in itself privacy friendly. Thus it does make sense in the spirit of regulatory catch-up, as a lot of data is sent automatically just in the normal course of operation of a computer, without a user ever consenting, just by visiting a website. This is normal and is how the internet works, but why shouldn’t privacy regulations apply to information received in this manner? For a while now the advertising-based business models have been in decline anyway, especially for smaller players. Because of that, I do not foresee a disruption of industry practices, even if this were applied and enforced properly. And if instead these guidelines were enforced, they could lead to a more sustainable course correction in business models, as opposed to tracking in indirect or new ways.

3. ‘Publicly available electronic communications services in public communications network’

Thirdly, the EDPB qualifies its analysis by looking at the phrase ‘Provision of publicly available electronic communications services in public communications networks’, as this sets the scope for the ePD, although it is not defined there but instead in the Electronic Communications Code, and previously in Directive 2002/21/EC. Here, with regard to communications technology and public networks, we see a further attempt to make the old ePD future proof, by stressing that it is expressly, as strengthened by recitals and other directives,¹⁹ not dependent on a particular kind of communications technology or type of network. Even asynchronous or ad-hoc networks are covered, so long as at least potentially more than two devices are part of the network, even though intermittently there might be only two devices. This could for example apply to ad-hoc decentralised networks or transmission technologies that span nets using mobile devices. Furthermore, it is expressly described that the ‘public’ portion of the phrase does not mean that a network has to be freely accessible to all, but just to some subset of the public.²⁰

4. ‘Gaining of access or storage’

Lastly, the analysis by the EDPB goes into the details of ‘gaining access’ and ‘stored information’ and ‘storage’.²¹ In this part, the authors explicitly refer to Art. 1 of the ePD which refers to ‘an equivalent level of protection … particular the right to privacy, with respect to the processing of personal data’ and the notion that at its core the ePD is a privacy instrument. They furthermore stress that the sphere of private life extends to a user’s terminal equipment (Recital 24). The user can also be a legal person, as their rights also should be protected against third parties according to Recital 26 of the ePD. For the purpose of the interpretation of gaining access, the guidelines describe this very broadly, stating in essence that it does not matter whether the data was actively requested, is sent out periodically or is gathered in some other way, and that it also does not have to take place cumulatively with the storage of information in that phrase.²²

Further elaborating on the storage part of the phrase at issue, the EDPB writes that usually access and information storage is not direct but generated by specific software on a website or installed, such as a browser. It also states that the length of time, amount of time or storage medium is irrelevant, and that even networked storage, if functionally equivalent, would fall within the ambit of this phrase. Most importantly, stored information is said to not only refer to files but to any kind of information on the users’ device, processed by a third party, by sensors or generated locally.²³ These explanations fit with the overall hypothesis that the main aim of these guidelines is to avoid circumvention and achieve regulatory catch-up that will be harder to circumvent (if not for the fact that these guidelines are only soft law, enforcement varies, and not all Member States empower their Data Protection Agencies to enforce the ePD). This last part is also why some authors question the legitimacy of publishing the technical guidelines, though to my knowledge the EDPB does not make any jurisdictional claim in the technical guidelines.²⁴

III. Example cases – are the most recent developments caught?

Below I address the example cases presented in the guidelines and check if they are captured in the new guidelines. The guidelines do not target any specific vendor or vendor-specific developments, but in their use cases give rather general examples that are not particularly new. However, when reading the elaboration on the phrasing in conjunction with the examples given and resources about recent developments to develop alternatives to third-party cookies and traditional targeted advertising, it stands to reason that the new technical guidelines are meant to cover some or all of these new developments that are being tested, even though the guidelines do not mention them.

To go into more detail on this topic, one recent example was known as FLoC²⁵ (Federated Learning of Cohorts). This was later abandoned and replaced with another attempt, called Topics.²⁶ Both of these developments were developed by Google in concert with advertising industry partners. Both Topics and FLoC aim to calculate some data locally, while still allowing for targeted advertising. In FLoC, a machine learning model running in the users’ browser would generate a cohort for the specific user, where the user would be grouped with other similar users that exhibit similar browsing behaviour. This would periodically be recalculated. These cohorts are then observed by advertisers and publishers on the web, which share their observations about cohorts with the advertising companies. Those companies can then in response push out targeted ads to users in these cohorts. Likely because there were unsolved questions involving GDPR compatibility, FLoC was at first not tested in the European Union.²⁷ While only a cohort label would be shared, it was still seen as potentially harmful, as there would be no way for the user to disagree or to see what data was shared or how it would be used. There was also no way to avoid forming cohorts with protected or unwanted characteristics.²⁸ According to Google, FLoC would have limited the privacy impact, while still allowing interest-based advertisements. However, NGOs and researchers argued that while FLoC worked without cookies, it would have enabled at least as much privacy intrusion.²⁹

The Google Topics API, by contrast, will generate categories of interest for each user.³⁰ These categories will be generated locally based on websites visited and selected from a predetermined advertising interest taxonomy.³¹ The weights for the model can be public, and users can look at the topics that are applied to them, which is an improvement compared to FLoC, as the taxonomy does not include interests that might have been grouped inadvertently by the FLoC method, such as protected characteristics. The taxonomy can also be public and deliberately does not contain certain controversial topics that might have been automatically grouped in FLoC. Some of these governance questions are not fully settled yet and still not finalized in the reviewed documents. This is due to the system being tested, but also due to ongoing discussion with regulators, especially with the Competition & Markets Authority (the CMA) in the UK.³²

Only the predetermined categories are shared with ad exchanges, which can then still send out targeted ads, but while receiving less data than before, as the ad auction happens on users’ devices. Researchers on this proposal also said they verified reduced risk of cross-site tracking.³³ The move from cohorts to topics according to the developers, which include not only Google but also advertising industry bodies, is meant to be both more useful for advertisers, but also easier to understand for users (as they can check and understand categories.) However, Topics likely still poses risk, as it processes personal data (even if locally) and could lead to further market concentration at Google and other big advertising players, due to the development and, probably, the deployment of the technology being largely governed and run by Google and advertising bodies with a large influence. Google would, for example, still control the browser and know a lot about its users, whereas advertisers and publishers would not if they only receive the categories generated by topics. In addition, it would also further manifest the monopoly position of the Google Chrome browser. In short, while the Topics proposal brings some improvements, it still poses risks, for both users and publishers. And, worse, it gives rise to further issues of market concentration and competition law in the browser and advertising markets, as both browsers, ad exchanges and publishers would be forced to use the Google proposal without much choice.

To me, there is no doubt that based on the technical guidelines by the EDPB a product such as Topics would fall under the ambit of the ePD. While information is processed locally, and it is presumably more privacy friendly, it still falls under the regulation of the directive, unless no information at all would leave the device or would be accessed, which is not possible, as far as I know. In that sense, it is admirable that the EDPB aims to future-proof the ePD, but what, if any, consequences arise from that remains to be seen. This is because while the EDPB is made up of most data protection agencies, their strategies for enforcement differ, for example the German Data Protection Conference (Datenschutzkonferenz) recently offered some guidance that was found by some³⁴ to conflict with the new technical guidelines by the EDPB.³⁵ However, in my opinion this is more because the position and distinction by the Data Protection Conference are themselves inconsistent and hard to maintain, as they bring browser fingerprinting and other hidden identifiers within the ambit of Art. 5(3) but claimed at the time that information sent in the process of requesting a website, such as the browser user agent string, IP addresses and other header information, was not covered by Art. 5(3), despite allowing significant transfer of information.³⁶ A reasonable way to interpret the comments by the Data Protection Conference is if by referring to URL they meant mostly the web domain, such as www.google.de, and not arbitrary data that is also submitted as part of a request for loading a website.

Regarding the mission of the EDPB of furthering coherence between data protection agencies within the EU, I found it surprising that the EDPB has not been more direct in addressing the next-generation advertising systems its technical guidelines are presumably meant for. In any case, if it really wanted to future-proof and push forward its interpretation, it would help to be more explicit and also approach companies directly and inform them of the new interpretation. In practice, this role might fall to national data protection agencies and the courts.

Lastly, a further next-generation system discussed by Google is the Web Integrity Environment, originally pitched as a sort of digital rights management and safe zone for the web, it was severely criticized, because it would take further control of the users’ devices away from them and solidify Google’s control of users’ devices and browsers.³⁷ This API was added to Google Chrome for testing and was meant to, for example, combat click-fraud on advertisements or fake engagement metrics on social media, by a process that would attest the software that ran on the users’ computer while accessing a website.

While some of these goals are laudable, it would also cement Google’s control and, within the ambit of the ePD, could also be caught under the meaning of Art. 5(3). In the end, widespread criticism led to the removal of the proposed API from Google Chrome, and a new proposal that will just cover web views (browser windows) on the Android operating system for phones and tablets has been proposed and is still being pursued.³⁸

Thus, for more helpful and broadly applicable guidelines it would help if the EDPB were to be more explicit in its accompanying information and to clarify the remaining issues as highlighted by NGOs and academics. Still, insofar as the ePD is still relevant, the guidelines are a good attempt at regulatory catch-up and thus slowing or stopping the spiral of regulatory escape. As third-party cookies were identified as a bad practice and now even Google is phasing them out, over time new and old ways of circumvention have been invented and used. One example is link-based tracking, which is, for example, used for affiliate links or e-mail campaign tracking where the discussion about a URL as data from above is relevant. A similar, older technique is the counter pixel, where a small, invisible image is embedded in a webpage or e-mail, and when the client requests that (potentially unique) URL, it is registered and tracked. At the same time, new techniques, such as Topics, are invented. Thus the technical guidelines are an attempt to focus on old and new tracking methods that are more relevant than ever and broaden the application in such a way that it is harder for ad tech companies to invent new tracking methods that circumvent current regulation. One argument against this is that such methods are necessary for certain parts of the economy, although that is just one of several possible business models. While companies are used to more accurate tracking, for decades advertising functioned without proper tracking of any kind, so why can it not function with less accurate tracking? Similarly, it was often claimed that cookie banners are prescribed by the ePD or GDPR, but neither in fact does that, they merely require a legal basis for data processing and cookie banners are seen by businesses as an easy option to get ‘consent’ which is one possible legal basis.

In the line of this argument there is no clear causation, but as the ill effects of user tracking have become more and more known, various groups such as Google have tried to deflect and limit the impact of potential regulation, and now in these latest developments are leading the charge on providing an alternative platform for personalised and targeted advertising, centralising their control.³⁹ In the UK the CMA has been supervising Google since closing its investigation for potential abuse of a dominant position after specific commitments by Google were made to assuage concerns. These commitments include, inter alia, non-discrimination and transparency commitments, as well as commitment not to use certain kinds of user data, such as browser history data, and a ‘standstill’ before the final removal of third-party cookies.⁴⁰ Despite the closing of the investigation in 2022, in its latest report from 2024 on the implementation of the commitment the CMA still expresses concerns, especially regarding the potential abuse of the market position of Google Ad Manager (GAM), the longer term governance of the privacy sandbox and its use of first-party data⁴¹

If authorities are successful in establishing this new interpretation of the ePD and do actually enforce it, that will go a long way towards encompassing a broader set of technologies within the ambit of Art. 5(3) ePD, and, who knows, maybe other widening interpretations will follow. Businesses will have to find their own way forward in any case for advertising and revenue, as Google’s proposals are not necessarily in their favour. Consumers and some business users are likely to benefit though, both from the increased focus on other tracking methods and revenue streams and maybe even from Google’s proposal.

Footnotes

Author notes