EU ePrivacy Directive

Storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user is allowed only on condition that the subscriber or user has given consent, having been provided with clear and comprehensive information in accordance with data protection law, in particular about the purposes of the processing. There are only two exceptions: technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, and storage or access strictly necessary to provide an information society service explicitly requested by the subscriber or user. Analytics, advertising attribution, A/B testing and personalised recommendation therefore all require prior consent, with a refusal path as easy as acceptance.

Applies when

Chinese AI companies operating websites, apps or embedded SDKs for EU users. Common failures: treating analytics SDKs and crash reporting as "strictly necessary" and skipping consent; loading third-party SDKs before consent; and relying on the implied-consent-by-continued-browsing pattern common in China, which is not accepted in the EU.

Deadline: Consent must be obtained before storing or accessing information in terminal equipment.

Evidence to retain

• · Cookie and SDK inventory covering purpose, category, lifetime and third-party recipients
• · Consent management platform configuration and consent and refusal logs
• · Technical verification that non-essential scripts do not load before consent
• · Item-by-item justification for any "strictly necessary" exemption claimed

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Automated calling and communication systems without human intervention, fax or electronic mail may be used for direct marketing only in respect of subscribers or users who have given prior consent. The exception is the Art. 13(2) soft opt-in: where a natural or legal person obtains its customers’ electronic contact details for electronic mail in the context of the sale of a product or service in accordance with data protection law, that same person may use those details to market its own similar products or services, provided customers are clearly and distinctly given the opportunity to object, free of charge and in an easy manner, both at the time of collection and in each subsequent message, where the customer did not initially refuse. Art. 13(4) prohibits marketing email that disguises or conceals the sender’s identity or lacks a valid reply address.

Applies when

Chinese AI companies running growth and re-engagement campaigns aimed at EU businesses or consumers. Common failures: using email addresses collected at trade shows or sign-up forms for product marketing without consent; stretching the soft opt-in to cover products that are not "similar"; and broken unsubscribe links or continued sending after opt-out.

Evidence to retain

• · Marketing consent capture records covering source, timestamp and scope
• · Assessment justifying reliance on the soft opt-in, including the "similar products" reasoning
• · Samples showing the objection opportunity and unsubscribe link in each message
• · Turnaround and execution records for unsubscribe requests

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

Member States must ensure, through national legislation, the confidentiality of communications and related traffic data by means of a public communications network and publicly available electronic communications services, in particular prohibiting listening, tapping, storage or other kinds of interception or surveillance of communications and related traffic data by persons other than users without the consent of the users concerned, except when legally authorised under Art. 15(1). That paragraph does not prevent technical storage necessary for the conveyance of a communication, without prejudice to the principle of confidentiality. Art. 5(2) further provides that this does not affect any legally authorised recording of communications and related traffic data carried out in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or other business communication. Note that the scope qualifier — a public communications network and publicly available electronic communications services — is the first filter in any given case: internal corporate systems and features that are not an electronic communications service are not automatically caught, so the characterisation must be settled first.

Applies when

Chinese companies offering messaging, conferencing, email, customer-service or voice-assistant products. Settle scope first: whether the product is a publicly available electronic communications service under the national definition transposing the European Electronic Communications Code, Directive (EU) 2018/1972, which generally covers number-independent interpersonal communications services. If it is not, this Article does not apply directly and the analysis returns to the GDPR. Once in scope, the key judgement is that using communication content to train or fine-tune models is not "technical storage necessary for conveyance", so the consent of the users concerned is required. Note that "users concerned" in multi-party communications often includes counterparties who are not your customers, which is the hardest part to satisfy in practice.

Evidence to retain

• · Inventory of purposes for processing communication content with the legal basis determination
• · Design and implementation evidence for obtaining consent in multi-party communications
• · Documented boundary between technical storage necessary for conveyance and other processing
• · Technical controls and audit records excluding communication content from training sets

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)