28 July 2020

 

 
 

DATA PROTECTION

Updated Guide on the use of cookies from the Spanish Data Protection Agency

 
     
 

The Spanish Data Protection Agency (AEPD) has published an update to its “Guide on the use of Cookies, which includes important changes for companies to bear in mind with regards to the correct implementation of cookies.

The first version of the AEPD Guide was published in November 2019. However, only a few months later, the AEPD has felt it necessary to update its Guide, basically to mirror the Guidelines that the European Data Protection Board issued in May on the topic of consent.

The main changes made to the Guide on the use of Cookies are the following:

  • “Continue browsing” consent mechanism no longer valid: While in the first version of the Guide the AEPD considered that users’ consent to the use of cookies could be validly given by their continuing to browsing through the website or app, the new Guide rules this out. The updated Guide states that “the mere fact of continuing to view a screen, or scrolling or navigating through a website will, under no circumstances, be considered a clear affirmative action”.

    This brings the Guide into line with the European Data Protection Board’s opinion on this mechanism. In practical terms, it means that websites using this type of consent mechanism will have to be adapted.

  • Prohibition of cookie walls: While the first version of the Guide took a more flexible approach, the updated Guide adopts a more restrictive position on cookie walls (i.e. cookies that must be accepted by users before they can access services and functions). Specifically, it states that “so-called cookie walls will not be acceptable unless they offer an alternative to consent”. The AEPD does however allow cookie walls to be used, “provided the user is properly informed and an alternative to access the service without having to accept the use of cookies is offered”.

The AEPD establishes a term of three (3) months for companies that do not currently comply with the updated criteria in the Guide to adapt their cookies to the new guidelines. The new criteria must be implemented by 31 October 2020 at the latest.

The complete text of the new “Guide on the use of cookies” is available on the AEPD’s website.

 

 
 

In case of any doubts or comments, please do not hesitate to contact

           
 

Leticia López-Lapuente
leticia.lopez-lapuente@uria.com

 

Laia Reyes
laia.reyes@uria.com

 

Reyes Bermejo
reyes.bermejo@uria.com

           
 

Núria Porxas
nuria.porxas@uria.com

 

Francisco Javier García
javier.garcia@uria.com

 
 
 

The information contained in this newsletter is of a general nature and does not constitute legal advice