On February 10, 2021, the EU member states agreed in the Council of the European Union on a version of the ePrivacy Regulation suitable (cf. Media release and Council version; a comparison of the Commission’s original proposal and the version now adopted by the Council can be found here).
This means that the trilogue can begin, i.e. the vote between the Council, the Commission and the Parliament. If an agreement is reached before the end of 2021, the ePrivacy Regulation could be 2023 at the earliest – enter into force after a transitional period of two years.
The provision to the spatial scope has the following content in the version of the Council – with a Triviality threshold in favor of companies outside the EEA:
Article 3 – Territorial scope and representative
1. this regulation applies to:
(a) the provision of electronic communications services to end-users who are in the Union,
(aa) the processing of electronic communications content and of electronic communications metadata of end-users who are in the Union;
(b) [omitted]
(c) the protection of terminal equipment information of end-users who are in the Union.
(cb) the offering of publicly available directories of end-users of electronic communications services who are in the Union;
(cc) the sending of direct marketing communications to end-users who are in the Union.
2. where the provider of an electronic communications service, the provider of a publicly available directory, or a person using electronic communications services to send direct marketing communications, or a person using processing and storage capabilities or collecting information processed by or emitted by or stored in the end-users’ terminal equipment is not established in the Union it shall designate in writing, within one month from the start of its activities, a representative in the Union and communicate it to the competent Supervisory Authority.
2a. The requirements laid down in paragraph 2 shall not apply if activities listed in paragraph 1 are occasional and are unlikely to result in a risk to the fundamental rights of end-users taking into account the nature, context, scope and purpose of those activities.
[…]
However, according to the wording, the exception in Art. 3(2a) only refers to the obligation to appoint a representative in the EEA, not to the application of the regulation itself.
The recitals do not provide a basis for a different interpretation. Recital 8aaa, on the contrary, states the application of the Regulation to undertakings outside the EEA without referring to an exception:
(8aaa) Furthermore, this Regulation should apply regardless of whether the processing of electronic communications data or personal data of end-users who are in the Union takes place in the Union or not, or of whether the service provider or person processing such data is established or located in the Union or not.
It must therefore currently be assumed that Swiss companies are also applicable if they only occasionally and not specifically perform an act that falls within the material scope of the Regulation (e.g., send an advertising e‑mail to a natural person).