The European Commission’s decision to withdraw the long-delayed ePrivacy Regulation, announced today in its 2025 Work Programme, marks the beginning of much-needed reform.
After years of legislative limping back-and-forth, this move acknowledges that the current ePrivacy framework no longer reflects the realities of the digital landscape or user expectations. The European Publishers Council (EPC) has long called for change, advocating for a more balanced approach—one that that protects users’ privacy while also enabling publishers to generate advertising revenue to fund independent editorial media in a sustainable way.
Now, we have a crucial opportunity to rethink and modernise digital privacy rules to serve both users and media businesses. The ePrivacy Regulation proposal, which was meant to replace the ePrivacy Directive, has been blocked in the institutional process since 2017 and for good reason. It was trying to adapt an old law, and its fragmented implementation into national laws and it is no longer fit for purpose. Its withdrawal is an opportunity to rethink the EU’s approach to digital privacy.
The Burden of ePrivacy on Publishers
The EU ePrivacy Directive complements the General Data Protection Regulation (GDPR) by strengthening privacy protections for electronic communications. However, originally dating back to 2009, it is no longer adapted to the technical evolution of the internet and has created significant counter effects for media businesses that are reliant on digital advertising. The restrictive approach of the current ePrivacy legal framework makes it harder for publishers to use data to attract advertising revenue and for them to adapt content according to audiences’ preferences. This, in turn, has a direct impact on the effectiveness of ad-funded journalism, as personalised advertising is a crucial revenue stream.
Large tech platforms benefit hugely from the framework in place through their capacity to leverage user consent across their multiple services building vast data troves, out-competing publishers for advertising revenue through their ability to hyper-target users on their platforms.
The over reliance of user consent actively disincentivises the AdTech ecosystem from developing more privacy-enhancing technology since the high compliance costs for consent collection and management remain a barrier.
The consent-based model imposed by the ePrivacy legislation is also no longer suitable or adequate for users who are constantly faced with consent requests with no prospect of making real choices.
A workable framework for privacy and publishers
The withdrawal of the draft ePrivacy regulation now provides us with the opportunity to develop a new approach to digital privacy, and work towards a more effective legal framework for user and publishers.
Preserving publishers’ economic sustainability –publishers must be able to monetise their content through personalised advertising, which remains the backbone of many online news organisations. We need a framework which ensures a balance between data protection and privacy while recognising the importance of ensuring the economic viability for press publishers in an era dominated by Big Tech.
Strengthening the publisher relationship with their readers – Publishers have a direct relationship with their readers based on trust. We need that relationship to deepen to remain competitive. This needs to be recognised in a framework which takes into consideration more fully the options available under the risk- based approach of the GDPR.
Avoiding Fragmented Regulations – We need to ensure a coherent data protection and privacy legal framework which reduces regulatory complexity, leading to uncertainty and legal challenges.
What’s Next for Privacy and Publishers?
The withdrawal of the ePrivacy Regulation is only a first step into a much-needed rethinking of the EU privacy legal framework. Importantly for us – and for society at large - any revisions must allow us to operate businesses that continue to fund Europe’s independent press and that keep audiences engaged with fact-checked professional content. This is especially important as disinformation proliferates across platforms, and new, unaccountable AI products compete head on with editorial media.
For a deeper dive, explore EPC’s 2030 Vision Paper on privacy, data protection, and the future of media sustainability at pages 6-17.