In anticipation of the GDPR, the Spanish AEPD issued cookie guidelines to help businesses get ready for compliance.
Explore more privacy compliance insights and best practices
The GDPR – General Data Protection Regulation – is the European set of data security rules that went into effect in May 2018.
AEPD is short for “Spanish Agency for Data Protection.” Their role is to guarantee that Spaniards follow European law and the LOPD-GDD – Organic Law of Protection of Personal Data and Guarantee of Digital Rights.
The AEPD is informative and instructive in nature. On their website, they have a total of 66 guides, some of which are also available in English.
In addition, tools, videos, and other mechanisms for implementing compliance solutions are available to the user.
The AEPD published three guidelines in 2017 to help people, particularly Small and Medium Enterprises (SMEs), in dealing with the necessary preparations for data protection compliance.
These guides have been updated and new ones have been added to the list until 2020.
WP29 stands for “Article 29 Working Group”, an independent working party that dealt with issues relating to privacy and personal data protection and was replaced by the European Data Protection Board, EDPB, after the GDPR went into effect. WP29 was comprised of a representative from each EU Member State's data protection authority, the European Data Protection Supervisor, and the European Commission. It was introduced in 1996.
The European Data Protection Board (EDPB) is an independent organization that ensures that the GDPR is consistently applied in the European Union (EU), as well as Norway, Liechtenstein, and Iceland.
They also encourage cooperation among the EU states' data protection authorities.
LSSI is an acronym for the Law of the Society of Information Services and Electronic Commerce of Spain, also known as LSSICE.
Cookies are text files that are housed in the user’s computer when they visit a website. They are used to collect data.
It is necessary to inform and obtain consent for the use of cookies for both first and third party cookies, whether session or persistent.
According to the LSSI article, "Service providers may use data storage and retrieval devices in the terminal equipment of the recipients, provided that they have given their consent after they have been provided with clear and complete information on their use, in particular, on the purposes of data processing, in accordance with the provisions of Organic Law 15/1999, of December 13th, on the Protection of Personal Data”.
Some cookies are exempt from the provisions of Article 22.2 of the LSSI and do not require consent to be used. They are as follows:
When a user requests a service, the editor sends first-party cookies.
Third-party cookies are sent by a computer or domain that is not managed by the publisher, but rather by another entity that processes the data obtained.
Session cookies collect and store data while a user navigates a website and then expire at the end of the session.
Persistent cookies are stored in the terminal and can be accessed and processed for a set period of time, which can range from a few minutes to several years.
They allow the user to navigate through a web page, platform, or application and use the various options or services available. Cookies are used for a variety of purposes, including controlling traffic and data communication, identifying the session, and accessing restricted access parts, among others.
This category also includes cookies used to manage advertising spaces. These cookies are exempt from all obligations when they are used exclusively to provide the service requested by the user.
They allow a personalized user experience in a website by remembering options and choices such as language, filters, etc.
When the user chooses these characteristics, they are exempt from the obligations of Article 22.2 of the LSSI.
They enable someone to quantitatively monitor and analyze the website's user behavior.
According to the WP29, they are not exempt from the duty to obtain informed consent for their use, but they are unlikely to pose a privacy risk when they are first-party cookies.
These are the ones that collect information about user behavior through continuous monitoring of their browsing habits, allowing for the delivery of personalized advertisements.
Users should be informed about:
Users must be informed in a concise, understandable, clear, and unambiguous manner.
During consent collection, this information cannot be more than two clicks away from the first page. The main information is to be provided in two layers, the main layer and a detailed, optional layer, in a clearly visible notice.
This information may be provided along with the privacy policy when requesting registration for a service or before downloading a service or an application.
Other information required by GDPR article 13 that is unrelated to cookies may be referenced in the privacy policy.
To use cookies that are not exempt from regulation, consent must be obtained. Consent has to be freely given by clicking on “I consent" or "I accept" buttons, or other terms of a similar nature.
Consent can also be obtained by inferring it from a clear action taken by the user after they have been provided with sufficient information about the use of cookies.
The most appropriate method of obtaining consent will be determined by the type of cookies, their purpose, and whether they are your own or those of third parties.
It is necessary to inform the user if data will be shared with other web pages of the same publisher or even with third parties associated with the publisher.
Some of the mechanisms that can be used to obtain consent are as follows:
According to the Spanish DPA cookie guidelines, information can be provided in two layers. The first layer must be identified by a generally used term, such as “cookies”, and must contain the following information:
The AEPD cookie guidelines provide the following examples of compliant cookie banners:
It is stated that cookies (analytics and behavioral advertising cookies) are used by both the website editor and third parties, and a link is provided for users to learn more about the cookies, which also directs the user to the cookie setup panel. Besides, when users click the "Accept Cookies" button, explicit user consent is obtained. If the user does not click the "Accept Cookies" button, cookies are not being set. As a result, if users continue to browse without clicking "Accept Cookies," cookies are disabled.
It is provided that cookies are set by both the website editor and a third party (analytics and advertising cookies). A link is provided to take the user to the second layer, which contains more detailed information about cookies. The manner through which a user can accept or reject cookies is also specified. A link to cookie configuration is already available.
The websites listed below are examples of Spanish websites that adhere to the aforementioned DPA rules.
(Source: www.edelvivesdigital.es)
(Source: www.bancosantander.es)
The WP29 advises organizations to avoid creating profiles of children for marketing purposes in general.
For websites or online services aimed specifically at minors, extra care must be taken to ensure that the language used is simple and clear.
In the case of minors under 14 years of age, the data controller must ensure that the holder of parental authority or guardianship has given consent for the processing of personal data.
As a result, the level of risk associated with cookie use should be considered. The lower the risk, the simpler the verification system that can be implemented.
For example, in the case of a website aimed at minors who did not register, and if their device and navigation data are only used for analytical purposes, the holder of parental authority or guardianship could be obtained through warning or call directed to the minor. The first information layer should state that “if you are under 14 years of age, notify your father, mother, or guardian to accept, configure, or reject cookies before continuing browsing”.
When cookies are used to store data about users or their terminal for experience customization and no profile of the minor is created, additional precautions should be taken to verify that consent was given or authorized by the holder of parental authority or guardianship.
The editors may use any reasonable verification formula to ensure that the person with parental authority or guardianship is the one who gives consent, not the minor under fourteen years of age (for example, questions or captchas).
Higher-risk uses may necessitate additional information from parents or guardians for verification (for example, a contact email to which the editor can send an email to verify acceptance by the minor's parents or guardian).
If consent to the use of cookies is obtained during the registration process for a service, or in the context of another process in which personal data from minors is requested, additional information about the parents or guardians may be requested for verification purposes. Alternatively, they may be asked to sign a consent declaration.
The same publisher who provides different services through different domains may inform and obtain consent for the use of cookies in the rest of the domains that have similar characteristics via a single web page.
Users have to be informed about the web pages or domains to which cookies will be sent, the type of cookies, and the purposes for which they will be processed.
If a publisher provides services with distinct characteristics, additional safeguards must be taken.
It will not be necessary to obtain consent every time a user visits the same web page where the service is offered.
However, it is clear that if the purposes of cookie collection or the third parties that use cookies change, the cookie policy must be updated and users must make a new decision.
The EDPB recommends consent renewal at appropriate intervals as best practice. The agency considers it good practice that consent validity be limited to 24 months.
During this time, any preferences selections made by the user should be preserved.
Users must be able to easily and at any time revoke their consent.
The publisher must inform users about how to withdraw consent and delete cookies. These guidelines must be incorporated into their cookie policy.
Because the EDPB guidelines on consent state that it must be freely given, access to services and functionalities must not be conditional on cookie acceptance.
This criterion is particularly important when denying access would prevent the exercise of a legally recognized right.
Non-acceptance of the use of cookies may, in some cases, prevent access to the website or the total or partial use of the service, provided that the user is properly informed about it and cookie-free alternative access to the service is offered. The alternative must be of equal value and be offered by the same publisher.
The website owners will not be required to report on cookie usage:
If cookies are used to create a marketing profile to store data for other commercial purposes, the editor must:
Book a call today if you would like more information about Secure Privacy and GDPR Cookie Consent compliance, or if you would like our data protection expert to perform a quick 'check-up' of your website, cookie consent banner, or cookie policy.
The Spanish DPA, AEPD cookie guidelines reveal which cookie banners are likely to be cookie-compliant.
(Source: AEPD Cookie Guidelines)
(Source: AEPD Cookie Guidelines)
The checklist below will help you stay in compliance with the AEPD cookie guidelines.
▢ Have a cookie consent banner or another mechanism in place to collect users’ consent for cookies
▢ Inform your users about cookies, their purposes, who uses them, how to reject or withdraw them, the data conservation period, and so on. Provide this information in a concise, understandable, clear, and unambiguous manner.
▢ Ensure that the information you want to provide is no more than two clicks away from the first page. The main information is provided in two layers, the main layer and a detailed, optional layer, in a clearly visible notice.
▢ Do not place cookies before obtaining consent, except for essential cookies. Consent can be obtained by clicking on the "I consent" or "I accept" buttons, or other terms of a similar nature
▢ In your cookie policy include information and instructions on how to withdraw consent
▢ Keep the user's choice, whether accepting or rejecting, for no more than 24 months
▢ Collect consent for each category of processing
▢ Avoid using cookie walls to be on the safe side
▢ Maintain logs of the user consent choice.
Irish Data Protection Commission
The Belgian Data Protection Authority
French CNIL Consent Guidelines
The Dutch DPA's Cookie Consent Guidelines
Greek DPA Cookie Consent Guidelines
Luxembourg DPA Cookie Guidelines
Our detailed GDPR compliance guide
The ultimate guide to GDPR Cookie Consent Compliance
