28 July 2020




Updated Guide on the use of cookies from the Spanish Data Protection Agency


The Spanish Data Protection Agency (AEPD) has published an update to its “Guide on the use of Cookies, which includes important changes for companies to bear in mind with regards to the correct implementation of cookies.

The first version of the AEPD Guide was published in November 2019. However, only a few months later, the AEPD has felt it necessary to update its Guide, basically to mirror the Guidelines that the European Data Protection Board issued in May on the topic of consent.

The main changes made to the Guide on the use of Cookies are the following:

  • “Continue browsing” consent mechanism no longer valid: While in the first version of the Guide the AEPD considered that users’ consent to the use of cookies could be validly given by their continuing to browsing through the website or app, the new Guide rules this out. The updated Guide states that “the mere fact of continuing to view a screen, or scrolling or navigating through a website will, under no circumstances, be considered a clear affirmative action”.

    This brings the Guide into line with the European Data Protection Board’s opinion on this mechanism. In practical terms, it means that websites using this type of consent mechanism will have to be adapted.

  • Prohibition of cookie walls: While the first version of the Guide took a more flexible approach, the updated Guide adopts a more restrictive position on cookie walls (i.e. cookies that must be accepted by users before they can access services and functions). Specifically, it states that “so-called cookie walls will not be acceptable unless they offer an alternative to consent”. The AEPD does however allow cookie walls to be used, “provided the user is properly informed and an alternative to access the service without having to accept the use of cookies is offered”.

The AEPD establishes a term of three (3) months for companies that do not currently comply with the updated criteria in the Guide to adapt their cookies to the new guidelines. The new criteria must be implemented by 31 October 2020 at the latest.

The complete text of the new “Guide on the use of cookies” is available on the AEPD’s website.



In case of any doubts or comments, please do not hesitate to contact


Leticia López-Lapuente


Laia Reyes


Reyes Bermejo


Núria Porxas


Francisco Javier García


The information contained in this newsletter is of a general nature and does not constitute legal advice