BRUSSELS—Companies will be allowed to track users' metadata in order to provide "value added services"—AKA behavioural advertising—a leaked draft of the European Union’s planned new law on electronic communications has revealed.

Article 6 of the draft (PDF) says: "Providers of telecommunications services may process electronic communications metadata if the end-user has given prior consent to the provider for one or more specific services, including the provision of value-added services." Telecom firms have been traditionally barred from using customer data to provide additional services.

The leak, which emerged on Monday, reveals a recent—though not the current—draft of the proposed law, according to anonymous Brussels' sources.

It contains many expected elements: the law will be a Regulation not a Directive, which means it must be directly written into law in EU member states without wiggle-room for national interpretation; so-called over-the-top (OTT) messaging service providers, such as WhatsApp, Facebook Messenger, and Skype, will fall under the jurisdiction of the law, despite heavily lobbying against this; and fines will be supersized to bring them in line with the new General Data Protection Regulation (GDPR) that will come into force in May 2018—companies could face fines up to €20 million or four percent total worldwide annual turnover.

Material scope of the proposed regulation is also equivalent to the GDPR: Every interaction by EU based legal and natural persons on the Internet.

The European Commission declined to confirm details of the draft, an update of the so-called Cookies Directive.

A commission spokesperson said in an official statement: "The main objective of the review of the e-Privacy Directive is to adapt the current rules which apply to electronic communications services to the new General Data protection regulation. The new instrument will ensure a high level of privacy and confidentiality for users."

Green MEP Jan Philipp Albrecht—an outspoken privacy campaigner who is responsible for steering through the GDPR—said it made sense for the two laws to be aligned. However, he said that where there are differences, they have huge implications.

Provisions to allow tracking of metadata for direct marketing purposes is particularly egregious, he told Ars.

According to Article 16 (1) of the leaked draft, use of data for direct advertising should be permitted only with the prior consent of the end-user. But Article 16 (2) makes an exception to this protection if there is a "customer relationship" between the advertisers and the end user.

"We would expect that electronic communications should be rated as more sensitive than other forms of data. Metadata, too, is more sensitive because you can read into it more patterns of behaviour, networks of people, where they are with location data, and so on. We have not only the right to privacy, but the right to confidential communications, so I would have thought you treat these as more sensitive," he told Ars.

"Another bad point is the general provision that you should be able to withdraw your consent only every six months. This falls behind the GDPR where it is clear you can withdraw your consent at any time in the same easy way that you gave it," said Albrecht, who argues that the six months' proposal is a "no-go."

On the issue of consent, the draft proposal zeros in on Web browsers. Article 9 allows for consent to be given by the use of "appropriate technical settings for software products that enable access to the Internet,"—essentially, "do not track" settings.

In what looks like an effort to undo some of the "cookie consent fatigue" that European Web users have complained about, the draft proposes that when cookies are used solely for configuration purposes, there is no need to inform users: in other words, one less annoying pop-up.

When cookies are used for tracking, website owners can rely on do not track settings for consent, or lack of it.

Although the proposals are largely in line with the GDPR, independent privacy consultant, Pat Walshe points out: "If we are not to repeat the mistakes of the past, [we] need to ensure consistency with the proposed European Electronic Communications Code (EECC). Even then, there are issues."

He told Ars: "We need to ensure the definition of electronic communications service is sound. The EECC still refers to 'remuneration,' its definition of electronic communications service. But many OTT services are 'free.' It needs to be clear that the rules apply irrespective of whether 'remuneration' is involved."

Walshe argued that the draft proposals are "flawed in other significant ways." The plan for privacy default and software, he said, "has huge implications for how hardware is set and sold, just think of the stuff preloaded on a Samsung Android device."

Meanwhile, the leaked draft leaves the door open for national governments to make up their own minds on data retention rules.

The Europe-wide Data Retention Directive was struck down by the European Court of Justice in 2014. Despite this, many national governments have re-introduced similar laws requiring telecommunications providers to store data for certain lengths of time in case of a need for law enforcement purposes. The majority of these apply only to "traditional" telcos. With the ePrivacy law widening its scope to cover OTT providers, national authorities may be tempted to do the same.

The UK may have to implement the amended law before it exits the EU, depending on the progress of the legislation and when the Brexit negotiations conclude. Following Brexit, implementation of the legislation would remain in force in the UK unless it is amended or repealed. Even if Brexit has occurred before the E-Privacy Regulation makes it into law, organisations that provide services to users in the bloc may need to adhere to it anyway.