The Spanish Agency for the Protection of Personal Data has updated the “Guide on the use of cookies”, whose criteria must be applied from 11 January 2024. Although the content of this guide is largely its 2021 version, there are certain updates that may mean a change in the use of cookies by companies.
The main changes are detailed below:
Preference cookies:
Preference cookies are those that allow information to be remembered so that the user can access the service with certain characteristics. These cookies require the user’s consent for them to be activated on a website, but until now, this consent had an exception, in the case where it is the user who chooses these same features, as it is considered a service expressly requested by the user (such as, for example, if the user selects the language of the website).
With the new update, the AEPD considers that user-selected cookies that remember the currency to be used in transactions, the font size or the colour contrast between the background and the content to improve readability, are also exempt from consent, provided that their use is limited to that necessary for their purpose, and the information that can be derived from the user’s selection cannot be used for other purposes.
Cookie banners:
The AEPD establishes a new criterion in relation to the design of cookie banners. As of 11 January, it is mandatory that these must incorporate the options (i) Accept, (ii) Reject all cookies and (iii) Configure cookies.
Furthermore, the Accept and Reject options must be presented in a fair manner, without their design, colour, etc. causing confusion to the user, i.e. the user must not be given the impression that he/she has to accept the use of cookies in order to be able to use the website.
Paywall Cookies
One of the main novelties of this update of the “Guide on the use of Cookies” is the interpretation made by the AEPD on the possibility of denying the service of the website in case of refusing the use of cookies (also known as Cookies Paywalls).
The general rule on consent to the use of cookies is based on the fact that, in order for consent to be freely given, access to services and functionalities should not be made conditional on the user’s acceptance of the use of cookies, so that the use of so-called “cookie walls” that do not offer an alternative to consent is not permitted.
However, with the exception of this general rule, it shall be permissible for the rejection of cookies to prevent access to the website or the full or partial use of the service when an alternative, not necessarily free of charge, access to the service is offered without the need to accept the use of cookies.
In conclusion, we are facing a new reality in which in order to access the services of a website it will be necessary to accept cookies or pay to reject them.
