In November 2019, the AEPD published the so-called “Guide on the use of cookies”. However, such a guide was controversial since its beginning, because certain actions considered by the Spanish body as a valid form of obtaining consent from users weren’t approved by the data protection authorities of other states.
Essentially, the controversy was focused on the validity of the “keep browsing” option as a form of consent and that such consent may be considered as explicit, as the General Data Protection Regulation (GDPR 2016/679) requires. Other matter where disputes arose was the so-called “cookie walls”, which entails the possibility of limiting the access to certain services or contents if the use of cookies is not accepted.
Therefore, the European Committee, in May, reviewed the Consent Guidelines, deeming that “keep browsing” is not a valid form of consent and that “cookie walls” may entail that consent isn’t free, and, therefore, isn’t valid either.
Due to all the above, it has proved necessary for the AEPD to update and adapt the Guide on the use of cookies, which has recently been undertaken at the end of July 2020.
The main updates are the two mentioned above. In particular, the “keep browsing” option was one of the most used options; it was sufficient to understand that for the user to consent the cookies download, it was only necessary that the user browsed sections of the web site other than the second layer of information on cookies or the privacy policy, scrolled up or down, closed the first layer or the information notice or clicked on any content of the web page. As we have said above, such “keep browsing” option is no longer valid because the above mentioned actions are difficult to distinguish from other actions or user interactions.
However, after reviewing the Consent Guidelines 5/2020, the EDPB has stated that the “keep browsing” option is not a valid form of consent, since those actions may be difficult to distinguish from other user interactions in the site web. Hence, it would not be possible to interpret the consent as unmistakable as the case would be if the user clicked “accept”, and at proof level this latter is the most appropriate form.
Regarding “cookie walls”, their use is forbidden, unless there are alternatives to consent. The access to services cannot be bound to just accepting the use of cookies by the user. E.g. it would be clearly illegal to set accepting cookies as a prerequisite for accessing a web site when the user may only exercise a right through the access to such a site.
The AEPD has granted 3 months in order to implement the new criteria, and therefore, they should be operative by the end of October 2020. Accordingly, the mechanisms to obtain consent should be reviewed and adapted in every web site o platform using cookies.
At Belzuz Abogados, as a law firm with expertise in digital and IT law, we will be delighted to provide services of guidance and to update and adapt the new criteria on cookies.
Digital Law department | Madrid (Spain)
Belzuz Abogados SLP
This publication contains general information not constitute a professional opinion or legal advice. © Belzuz SLP, all rights are reserved. Exploitation, reproduction, distribution, public communication and transformation all or part of this work, without written permission is prohibited Belzuz, SLP.