The Spanish Data Protection Agency updates its Guidelines on cookies again

2020-09-07T09:20:00
Spain

On July 28, the Spanish Data Protection Agency (AEPD) published a new update of its Guidelines on cookies.

The Spanish Data Protection Agency updates its Guidelines on cookies again
September 7, 2020

On July 28, the Spanish Data Protection Agency (AEPD) published a new update of its Guidelines on cookies.

As we explained in this blog at the time, the AEPD had already updated the Guidelines on November 8, 2019. Among other issues, that updated version established recommendations on how to obtain consent. Unlike the guidelines published by other European authorities, the AEPD considered that the option to “continue browsing” constituted a valid way to obtain users’ unambiguous consent in certain cases.

A few months later, on May 6, 2020, the European Data Protection Board (EDPB) settled the debate on this form of consent for installing cookies by publishing its guidelines on consent. The EDPB specified that actions such as scrolling through a website and similar actions by data subjects do not entail the data subject’s unambiguous consent.

Consequently, the AEPD has updated its Guidelines on cookies again, this time to adapt them to the EDPB’s position. Thus, the new version indicates that under no circumstance does the “continue browsing” option constitute a valid form of consent, “insofar as those actions can be difficult to distinguish from other user activities or interactions, so it would not be possible to consider the consent unambiguous.

Furthermore, this new version includes another specification made by the EDPB in relation to the impossibility of browsing a website without first accepting the installation of all cookies. The Guidelines explain that the so-called “cookie walls” that do not offer an alternative to consent cannot be used.  Cookie walls prevent users from accessing the services and functionalities of a website without first accepting the installation of cookies. Therefore, they can only be used when there is an alternative to accessing the services and functionalities without the need to accept cookies. In this case, the services of both alternatives must be genuinely equivalent and must be offered by the publisher.

Authors: Alejandro Negro and Pedro Méndez de Vigo

September 7, 2020