The ePrivacy "Two-Layer" Consent Problem, Explained Simply

Why two layers exist

Most confusion about email tracking consent comes from treating it as one legal question when it's really two. When your email's tracking pixel loads on a recipient's device, it triggers two separate laws simultaneously: the ePrivacy Directive (which governs accessing the device) and GDPR (which governs handling the personal data that results). They stack. They have different requirements. And crucially, they apply in a specific order. Once you see the two layers, the rules that seem contradictory — "you need consent" but "GDPR has six lawful bases" — stop conflicting, because they're describing different layers.

Layer 1: ePrivacy Article 5(3) — accessing the device

The first layer governs a narrow but critical act: storing information on, or gaining access to information in, a person's terminal equipment (their device). That's what loading a tracking pixel does. ePrivacy Article 5(3) requires consent for this, with only a narrow "strictly necessary" exemption. There is no legitimate-interest option at this layer. The EDPB confirmed in its Guidelines 2/2023 (finalized 16 October 2024) that pixel loading is exactly this kind of device access. This is the layer that catches email tracking — and it's checked before anything else.

Layer 2: GDPR Article 6 — processing the data

Once a pixel has fired and produced data (this recipient opened at this time on this device), using that personal data is governed by GDPR. GDPR Article 6 offers six lawful bases for processing — consent, contract, legal obligation, vital interests, public task, and legitimate interest. This is the layer where legitimate interest actually lives. So the statement "GDPR lets you use legitimate interest" is true — for this second layer, the data-processing layer. It says nothing about whether you were allowed to fire the pixel in the first place.

Why the order matters

The two layers apply sequentially, and that sequence is the whole game. You must satisfy Layer 1 first: did you have consent (or a strictly-necessary exemption) to access the device? Only if yes do you get to Layer 2: what's your GDPR basis for using the data? If you fail Layer 1, Layer 2 is irrelevant — you never lawfully obtained the data to process. This is why "I have a legitimate interest in measuring engagement" doesn't rescue an unconsented pixel: it's a Layer 2 answer to a Layer 1 problem. We unpack that specific mistake in the legitimate interest myth — this article explains the architecture; that one applies it to the LI confusion specifically.

Lex specialis: why ePrivacy wins where they overlap

A reasonable question: if GDPR allows legitimate interest and ePrivacy demands consent, which governs the pixel? The answer is a legal principle called lex specialis — where a specific law and a general law both apply, the specific one prevails. ePrivacy is the specific law for device access and electronic communications; GDPR is the general data-protection law. So for the act of accessing the device, ePrivacy's consent rule wins over GDPR's more flexible bases. GDPR doesn't disappear — it governs the data once lawfully collected — but it can't override ePrivacy's consent requirement for the access itself. This is the technical reason the two layers don't simply collapse into "just use GDPR."

What happened to the ePrivacy Regulation

You may have heard that an ePrivacy Regulation was coming to replace the aging Directive. For years it was expected to modernize and unify these rules across the EU. That effort was withdrawn in 2025 after failing to reach agreement — which means the 1990s-era ePrivacy Directive remains the governing instrument, implemented through each member state's national law (France's Article 82, Italy's Article 122, the UK's PECR, and so on). This is why the rules feel patchwork: there's no single modern regulation, just a Directive transposed 27 different ways, with national regulators like the CNIL and Garante now applying it to email pixels. For how those national applications play out, see the email tracking consent pillar and our guide to the equivalent device-access logic behind US website tracking law.

Frequently asked questions