The new Guidelines on Cookies of the Spanish Data Protection Agency forces the review of all cookie policies of commercial websites

The new document maintains some of the obligations that were already in place in the previous guidelines and takes the opportunity to update other matters with the purpose of adapting the cookies landscape to the General Data Protection Regulation of the EU (GDPR). In this sense, it is especially important how the user’s consent for the acceptance of cookies is regulated. According to the guidelines, consent shall consist on a statement or a clear affirmative action, as requested in the GDPR. The traditional method of “if you continue browsing you will provide your consent to our use of cookies” is modulated, adding some reinforced information requisites, clear and precise actions and the possibility to withdraw the consent in a similarly simple manner.

Additionally, the guidelines include the regulation of other sensitive aspects such as how to obtain consent from minors younger tan 14 years old, the possibility to collect consent in one website for several domains of the same editor with a similar content, the cookie related responsibilities or the possibility to deny the provision of a service in case the cookies are not accepted, in some specific situations. Another important topic is the limitation of the cookies related consent to a maximum of 24 months, which is considered as best market practices.

This document is consistent with some of the most recent decisions of the AEPD regarding cookies, some of which included significant monetary fines. We will be dealing with all these matters in detail in our coming discussion event on cookies regulation, which will take place on November 19 in Madrid.