Anti-Tracking Guide

EU rules on tracking and fingerprinting

What the EDPB guidelines on Article 5(3) of the ePrivacy Directive say about tracking links, pixels, IP-based tracking and fingerprinting, and what stays open.

Official source: EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) ePrivacy Directive. Verified on

1 min read · Review scheduled for 2027-01-20

Contents

In short

  • The guidelines are version 2.0, adopted 7 October 2024. Version 1.0 came on 14 November 2023 for public consultation (EDPB).
  • Article 5(3) of the ePrivacy Directive is the rule on storing information on, or reading it from, a user's device. The guidelines explain which techniques it covers.
  • Tracking links and pixels: the guidelines say distributing them counts as storage, at least through client-side caching, and collecting the identifier is "gaining access" (section 3.1).
  • IP-based tracking: Article 5(3) can apply when the IP address comes from the user's own equipment, such as a static outbound IPv4 address or IPv6 addresses (section 3.3). Carrier-grade NAT may fall outside.
  • Fingerprinting: the guidelines say WP29 Opinion 9/2014 already put fingerprinting within Article 5(3), and that using HTTP headers or caching such as ETags to collect fingerprinting information can trigger it.

What this means in practice

For a website owner: collecting a fingerprint, using tracking pixels or adding identifiers to links can need the same consent as cookies, unless an exemption applies. For a visitor: a site that does these things without asking may be in breach. The link cleaner and fingerprinting guide relate to these techniques.

What the guidelines do not settle

They do not analyse the exemptions from consent. The EDPB says Article 5(3) applying does not automatically mean consent is required, so each case needs its own assessment.

Limits

We read the guidelines for the points above only. We did not read the national laws that carry out the Directive, which differ by country, nor the Digital Omnibus changes discussed in 2025 and 2026. A lawyer can tell you what applies to you.

Keep reading: Global Privacy Control and California

Outside this page: Enforcement decisions by national authorities.