The new cookie law in Spain: what you need to know to avoid being fined
Posted: Thu Jan 23, 2025 7:03 am
If you have a website to promote your business or an e-commerce site , you will know that you must comply with the personal data protection law . This regulation governs the digital rights of users and the use of cookies, those small files that are installed on devices when accessing web pages to collect information about browsing habits and preferences.
In mid-2020, the Spanish Data Protection Agency (AEPD) updated its Guide on the use of cookies to respond to the new guidelines of the European Data Protection Committee (EDPC). The new regulations provide greater protection to users, providing them with more options to manage cookies and protect their privacy.
The 3 main changes in the new cookie law
Removing consent by using the “continue browsing” option. The EDPB considers that it cannot be assumed that the user gives his consent to the installation of cookies by using the “continue browsing” option. In fact, it considers that this is an action that gives rise to confusion, since the user is not giving his consent freely and in an informed manner. Therefore, it is prohibited.
Banning “cookie walls” that block access if the user does not bahrain mobile phone number data give their consent. The EDPB assumes that “cookie walls” are a form of coercion for the user to accept cookies. Under the new cookie law, access to certain websites or web content cannot be prohibited when users reject cookies, unless they are technically necessary. Instead, the website must offer an alternative to access an equivalent service without accepting cookies, which must be its own, not offered by third parties.
Provide the possibility of revoking consent. The new cookie law also modifies some aspects related to the revocation of consent. The website must offer the necessary information in its cookie policy so that users know how to withdraw consent and delete cookies from their devices. The method of revocation must be simple and the cookie management or configuration system must always be available.
What should the cookie notice on your website look like?
The banner or pop-up containing information about cookies must offer at least the following options:
Reject cookies or Reject all cookies except strictly necessary ones.
Accept Cookies and/or Configure Cookies , an option for the user to select the cookies that will be used during their visit.
The cookie law also states that clear, transparent, complete, concise and understandable information must be provided for the average user . The notice must indicate the use of data storage and recovery devices, with special emphasis on the purposes of data processing. In addition, this information must be translated into all the languages offered by the website.
The AEPD guide provides an example of the information that this notice should contain: “ We use our own and third-party cookies for analytical purposes and to show you personalized advertising based on a profile created from your browsing habits (for example, pages visited). Click HERE for more information. You can accept all cookies by clicking the “Accept” button or configure them or reject their use by clicking HERE ”.
In the case of third-party cookies , those that you do not manage directly but that are installed through your website, the regulations provide for a contract between the data controllers and the third parties that details the way in which the user will be offered information on the use of cookies, obtaining their consent and the means and consequences of revoking it.
In mid-2020, the Spanish Data Protection Agency (AEPD) updated its Guide on the use of cookies to respond to the new guidelines of the European Data Protection Committee (EDPC). The new regulations provide greater protection to users, providing them with more options to manage cookies and protect their privacy.
The 3 main changes in the new cookie law
Removing consent by using the “continue browsing” option. The EDPB considers that it cannot be assumed that the user gives his consent to the installation of cookies by using the “continue browsing” option. In fact, it considers that this is an action that gives rise to confusion, since the user is not giving his consent freely and in an informed manner. Therefore, it is prohibited.
Banning “cookie walls” that block access if the user does not bahrain mobile phone number data give their consent. The EDPB assumes that “cookie walls” are a form of coercion for the user to accept cookies. Under the new cookie law, access to certain websites or web content cannot be prohibited when users reject cookies, unless they are technically necessary. Instead, the website must offer an alternative to access an equivalent service without accepting cookies, which must be its own, not offered by third parties.
Provide the possibility of revoking consent. The new cookie law also modifies some aspects related to the revocation of consent. The website must offer the necessary information in its cookie policy so that users know how to withdraw consent and delete cookies from their devices. The method of revocation must be simple and the cookie management or configuration system must always be available.
What should the cookie notice on your website look like?
The banner or pop-up containing information about cookies must offer at least the following options:
Reject cookies or Reject all cookies except strictly necessary ones.
Accept Cookies and/or Configure Cookies , an option for the user to select the cookies that will be used during their visit.
The cookie law also states that clear, transparent, complete, concise and understandable information must be provided for the average user . The notice must indicate the use of data storage and recovery devices, with special emphasis on the purposes of data processing. In addition, this information must be translated into all the languages offered by the website.
The AEPD guide provides an example of the information that this notice should contain: “ We use our own and third-party cookies for analytical purposes and to show you personalized advertising based on a profile created from your browsing habits (for example, pages visited). Click HERE for more information. You can accept all cookies by clicking the “Accept” button or configure them or reject their use by clicking HERE ”.
In the case of third-party cookies , those that you do not manage directly but that are installed through your website, the regulations provide for a contract between the data controllers and the third parties that details the way in which the user will be offered information on the use of cookies, obtaining their consent and the means and consequences of revoking it.