Article 5(3) of the ePrivacy Directive, and what a read link may measure

Article 5(3) of Directive 2002/58/EC — the ePrivacy Directive — is the European provision that governs software reaching into a device. OctoDoc's post-v1.0 read-link design treats it as the governing instrument because a read link that measures reading is code running inside somebody else's browser on somebody else's machine.

The paragraph has two limbs. The first states a condition: storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user is allowed on condition that the person concerned has given consent, having been provided with clear and comprehensive information about the purposes of the processing. The second names the situations that condition does not reach — technical storage or access for the sole purpose of carrying out the transmission of a communication, and storage or access strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

The text in force is not the text as enacted. The 2002 original was an opt-out construction: it required that the subscriber be provided with information "and is offered the right to refuse such processing by the data controller". Directive 2009/136/EC, at Article 2 point 5, provides that "Article 5(3) shall be replaced by the following" and sets out the consent construction quoted below. Recital 66 of that amending directive describes the carve-out as limited to "those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user".

Directive 2002/58/EC, Article 5(3), consolidated at 19 December 2009:

"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

Two features of that sentence do most of the work in practice. It is written around an operation on a device, not around personal data, so it reaches an operation whether or not the information retrieved identifies anybody. And the second sentence names exactly two exemptions, neither of which is a balancing test.

The European Data Protection Board published Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive. The cover page of version 2.0 reads "Adopted on 7 October 2024", and the version-history table inside gives the same date for version 2.0 and 14 November 2023 for the version that went out for public consultation. The guidelines are about which technical operations fall inside the provision, not about which of them are exempt.

Three findings shape how a reading-measurement feature has to be built. Storage and access are severable: "Storing of information and access to information already stored do not need to be both present for Article 5(3) ePD to apply." There is no cookie requirement and no requirement that the same party do both, and the guidelines restate Article 29 Working Party Opinion 9/2014 to that effect.

Instructions sent to a browser are treated as access in their own right: "Additional examples would include JavaScript code, where the accessing entity instructs the browser of the user to send asynchronous requests with the targeted information. Such access clearly falls within the scope of Article 5(3) ePD, as the accessing entity explicitly instructs the terminal equipment to send the information." Per-page dwell and scroll depth are measured exactly that way, which is why they sit on the gated side of the line below.

An address counts, conditionally: "However, gaining access to IP addresses would only trigger the application of Article 5(3) ePD in cases where this information originates from the terminal equipment of a subscriber or user."

The guidelines are explicit about their own limits: "While the present guidelines do not analyse the application of the exemptions to the obligation to collect consent provided by Article 5(3) ePD, it is important to once again recall that the applicability of this article does not systematically mean that consent needs to be collected." Scope and exemption are separate questions, and an operation can be inside the Article and still sit inside one of its two limbs.

A reading log would be the differentiating feature of a post-v1.0 read link, and Article 5(3) is the provision that constrains it hardest. The planned OctoDoc posture makes the baseline small enough to defend line by line and gates everything else, rather than arguing the interesting cases.

Two decisions follow from that and are worth stating plainly, because both cost the product something. Fingerprinting is deleted, not disabled: device and TLS fingerprinting were removed from the v1 codebase rather than shipped behind an off switch, because a switch is a code path and a code path can be flipped by a configuration change or a support macro without anyone re-reading the Article. And no legitimate-interest configuration is exposed to organisations in the EU region, so an EU-region sender cannot obtain per-page dwell from a party who declined, by any setting available in the product.

The abuse log is the one planned baseline item that sits closest to the line. The post-v1.0 design classifies a truncated address, held 24 hours to keep an unauthenticated public URL from becoming a distribution endpoint, into the strictly-necessary limb and would state it on the pre-collection screen.

This page describes an instrument, quotes it, and states how one piece of software is configured. It does not assess any particular organisation's processing, and nothing here is an evaluation of any reader's own deployment.

Nobody wants to read the contract. OctoDoc is being built so you do not have to: write a document from a prompt, ask plain-language questions about the one you were sent, and keep every one of them in a single place instead of four accounts and an inbox.

Anyone can check a sealed file with no account.

Unlimited human sends on the paid tier.