The ePrivacy Directive governs privacy in electronic communications across the European Union, regulating the confidentiality of communications, traffic data, and — most relevantly for network APIs — location data. It sits alongside the GDPR as the sector-specific regime for communications providers, and generally requires consent before location or traffic data may be processed for value-added services.
ePrivacy Directive
Directive European Union
ePrivacy is the regulation most directly implicated by the network-API programme, and it is rarely named in the industry’s own marketing.
- Traffic and location data - Processing beyond what is necessary for transmission or billing generally requires informed consent, and this is precisely the category CAMARA’s Device Location, Geofencing and Population Density APIs operate on.
- Confidentiality of communications - A baseline restriction independent of the GDPR’s lawful-basis machinery.
- Applies to the operator - The obligations fall on the provider of the electronic communications service — the carrier — rather than on the developer consuming an API.
- A long-delayed successor - The proposed ePrivacy Regulation, intended to align the regime with the GDPR, has been stalled for years, leaving a directive implemented differently in each member state.
This is why the GSMA’s consent model is the most thoughtful piece of policy engineering in The State of Telecom APIs: consent recorded when it happens and interrogable afterward is an answer to a regulator asking, later, on what basis a subscriber’s location was disclosed — and under a directive implemented separately in each member state, “later” and “in which country” are both hard questions.
A note on provenance. This entry is analytical rather than cited: the report documents the CAMARA location APIs and the consent design in detail, and the connection to this Directive is drawn here rather than in the paper itself.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
CAMARA
CAMARA's location and network-data APIs operate on exactly the traffic and location data this Directive restricts.
GSMA Open Gateway
The programme's consent design is a direct answer to regulators operating regimes like this one.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
permissions-policy
evidentiary
observable at the edge
Device access — camera, microphone, geolocation — is consent territory.
set-cookie
evidentiary
observable at the edge
Prior consent for non-essential storage. A non-essential cookie set on the first request, before any consent interaction, is the violation visible from outside.
