---
title: "The articles we cite, in plain language"
url: "https://consenttheater.org/law"
description: "Plain-language renderings of the GDPR and ePrivacy articles ConsentTheater relies on, with the verbatim official text alongside and a link back to the EU's canonical source."
---

Law references

# The articles we cite, in plain language

Last updated 2026-09-06

ConsentTheater's tracker classifications and policy pages reference a small number of EU legal provisions. Each page below pairs a short, plain-language explainer with the verbatim official text, and links back to the canonical source on [eur-lex.europa.eu](https://eur-lex.europa.eu). We host these articles for navigation convenience — for any binding legal use, always consult the original.

-   [GDPR Article 5 Principles relating to processing of personal data The six core principles every controller must satisfy: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and integrity. Plus the accountability rule.](/law/gdpr/art-5/)
-   [GDPR Article 6 Lawfulness of processing The six legal bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests.](/law/gdpr/art-6/)
-   [GDPR Article 7 Conditions for consent What it means to "have consent" under the GDPR — burden of proof, plain language, the right to withdraw, and freely-given conditions.](/law/gdpr/art-7/)
-   [GDPR Article 17 Right to erasure ("right to be forgotten") When a data subject can require erasure, what exceptions apply (free expression, public interest, legal claims, archiving for research), and how it interacts with public publication.](/law/gdpr/art-17/)
-   [GDPR Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes The research-and-archiving carve-out that lets datasets like ours preserve historical observations under appropriate safeguards, even when other rights would otherwise apply.](/law/gdpr/art-89/)
-   [ePrivacy Directive Article 5 Confidentiality of the communications The "cookie article" — the rule that storing or accessing information on a user's terminal device requires prior informed consent, with a narrow strictly-necessary exemption.](/law/eprivacy/art-5/)
-   [ePrivacy Directive Article 13 Unsolicited communications The anti-spam article. Marketing calls, texts and email need prior consent (opt-in), with a narrow existing-customer exemption, and hidden-sender marketing is always prohibited.](/law/eprivacy/art-13/)

Across the channel

[UK GDPR & PECR United Kingdom — same articles, ICO regulator The UK GDPR retains the EU text in domestic law (Schedule I, Data Protection Act 2018), and PECR Regulation 6 carries the cookie rule. Substantively the same articles, enforced by the ICO. This page maps each EU article to its UK counterpart.](/law/uk-gdpr-and-pecr/)

Looking for a different article? The full GDPR (99 articles, 173 recitals) and the full ePrivacy Directive are available on the EU's legal portal:

-   [Regulation (EU) 2016/679 — General Data Protection Regulation](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
-   [Directive 2002/58/EC — ePrivacy Directive](https://eur-lex.europa.eu/eli/dir/2002/58/oj)