In terms of cookies, the Spanish Data Protection Agency (“AEPD”) has followed the provisions of the Spanish E-commerce Act[1], except in very few cases where it also decided to analyze the related privacy policy (as a result of the same claim) based on GDPR requirements.
The following is a summary of the main sanctions imposed in this area from 2015 to November 2019.
|
Company /individual |
Facts |
Regulation and section(s) infringed |
Penalty |
Link |
|
VUELING AIRLINES, S.A. |
The webpage did not offer the user the possibility to withraw the given consent for the installation of cookies (save as otherwise provided through the options of the browser, which is not sufficient). In this sense, it did not offer a granular cookies-setting panel. |
Art. 22.2[1] Spanish E-commerce Act |
Initial proposed fine: 30.000€ Final fine: 18.000€ due to responsibility recognition and prompt payment.
|
|
|
TELEFONICA MOVILES ESPAÑA, S.A.U. |
TELEFONICA used "super cookies" when accessing the mobile network from terminals, without duly informing the user and without his or her consent.
|
Art. 22.2 Spanish E-commerce Act |
20.000 € |
https://www.aepd.es/resoluciones/PS-00005-2016_REC.pdf
|
|
BANKINTER, S.A. |
The installation of cookies from the website was carried out by accessing the website and not after providing the user with the information and the request for consent. |
Art. 22.2 Spanish E-commerce Act |
Initial proposed fine: 10.000€ Final fine: 6.000€ due to responsibility recognition and prompt payment.
|
|
|
ABELHAS.PT LIMITED |
The defendant owned a website that used third party cookies with analytics purposes and cookies for social network management purposes. The information included a first layer that did not specify the purposes of the cookies used, and a second layer that did not refer to local storage related to social networks.
|
Art. 22.2 Spanish E-commerce Act |
5.000 € |
https://www.aepd.es/resoluciones/PS-00372-2016_ORI.pdf
|
|
VF JEANSWEAR ESPAÑA, S.L.
|
Installation of cookies without giving proper information and without requesting the user consent. |
Art. 22.2 Spanish E-commerce Act |
Initial proposed fine: 5.000€ Final fine: 3.000€ due to responsibility recognition and prompt payment. |
|
|
PACSOLUTOR, S.L. |
Lack of information in the cookie information notice on the website. Specifically, no information was provided about the purpose of third party analytical and advertising cookies installed.
|
Art. 22.2 Spanish E-commerce Act |
3.000€ |
|
|
FRONTERA SISTEMAS DE ESPAÑA, S.L.
|
The webpage provided incomplete information about the installation of cookies and with regard to the type and purposes of the cookies used. |
Art. 22.2 Spanish E-commerce Act |
Initial proposed fine: 3.000€ Final fine: 1.800€ due to responsibility recognition and prompt payment.
|
|
|
I.S.G.F. INFORMES COMERCIALES, S.L.
|
Third party cookies were installed before providing clear and complete information to users about their use. Also, the user did not have the possibility to reject or accept its use by means of a free, specific, informed and unequivocal action. In addition, the information displayed at both levels of information was neither clear nor complete.
|
Art. 22.2 Spanish E-commerce Act
|
Warning |
|
|
PASTOR TOYS INTERNACIONAL, S.L.
|
The website did not offer a granular cookies setting panel. The information about the tools provided by various browsers to configure cookies through the browser would be complementary to the previous one, but insufficient on its own.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
VOYAGE PRIVE ESPAÑA, S.L.
|
The webpage considered the installation of cookies to be accepted if the user continues navigating through it.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
PARAULA.CENTRE DE SERVEIS LINGÜISTICS DE LES ILLES BALEARS |
Lack of required information in the cookie information notice (first layer). In addition, the "ACCEPT" button was included, which is incompatible with the "continue browsing" mode offered in this case.
The second layer did not provide information on the system for managing the acceptance, rejection of given consent or rejection of cookies in granular form.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
COMUNICACIONES DEL CAMPO ESPAÑOL, S.L.U.
|
Third party cookies were installed prior to obtaining the valid consent of the user, since they were installed without giving proper information and without any affirmative action of acceptance. Also, there was a lack of essential information in the cookies information notice (first layer).
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
IDEARIUM 3.0, S.L.
|
The website prevented the user from navigating if he or she did not accept the cookies information notice. On the other hand, cookies from third parties were installed without giving information or asking for the necessary consent from the user, nor giving the information of how to delete cookies installed.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
CHOLLOMODA FASHION RETAIL, S.L.
|
Some functions of the website were only available by accepting the installation of cookies. In fact, the installation of third party cookies was carried out immediately after accessing the website, without any information or action by the user. No information was given about third party cookies or the possibility of managing consent.
It is interesting to note that, for the same complaint from an individual, the AEPD also opened a procedure for lack of update and information in the privacy policy.
|
Art. 22.2 Spanish E-commerce Act
Art. 13 GDPR |
Warning for both procedures |
Cookies: https://www.aepd.es/resoluciones/A-00020-2019_ORI.pdf
Privacy: |
|
AGROMILLORA CATALANA, S.A.U.
|
The cookies information notice was incomplete. By accessing to the Cookie Policy, the user did not receive information about some types of cookies used. Also, the installation of some types of cookies was carried out by just accessing the website
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
INDIVIDUAL |
The Respondent owned two websites where there was no link that referred to the cookie Policy.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
https://www.aepd.es/resoluciones/PS-00390-2016_ORI.pdf
|
|
RANDSTAD ESPAÑA, S.L.U. |
Information on the use of cookies was incomplete and therefore no informed consent was collected from the client.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
MEDITERRANEO REAL, S.L. |
The respondent's website did not report on the use of cookies despite the use of third party analytical and advertising cookies.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
https://www.aepd.es/resoluciones/A-00299-2015_ORI.pdf
|
|
PACSOLUTOR, S.L.U. |
Installation of cookies on the claimant’s device without having previously requested consent for the installation and without informing the user of the consequences and without collecting the proper informed consent.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
https://www.aepd.es/resoluciones/A-00248-2015_ORI.pdf
|
|
ARKISA PROYECTOS INMOBILIARIOS, S.L. |
There was no information about the use of cookies provided on the respondent's website, and also there was no collection of proper consent for the installation and use of third party cookies (more specifically Google, Facebook and Twitter).
|
Art. 22.2 Spanish E-commerce Act |
Warning |
https://www.aepd.es/resoluciones/A-00133-2015_ORI.pdf
|
|
MAGUS CREATIVA EUROPE, S.L. |
There was no clear and complete information provided about the use of cookies on the website (there was no mention of the purposes for which the cookies were installed in users' terminals).
|
Art. 22.2 Spanish E-commerce Act |
Warning |
https://www.aepd.es/resoluciones/A-00075-2015_ORI.pdf
|
|
CUATRO DATOS SOLUCIONES Y DESARROLLO, S.L. |
The owner of the website installed third party cookies without informing users and therefore without their prior informed consent.
It was sanctioned in accordance with the E-commerce act, although there was a reference to the characteristics of the informed consent established in the RGPD.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
LIVING TERRITORIWEB, S.L. |
The owner of the website did not inform about the use of cookies and did not have a Cookie Policy. In addition, he did not display an cookie information notice about such devices when accessing the website. In the absence of a "Legal Notice", no information was provided specifying the holder's data.
It was sanctioned in accordance with the E-commerce act, although there was a reference to the characteristics of the informed consent established in the RGPD.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
ALLIGATOR MULTIMEDIA, S.L. |
The cookies information notice did not provide information regarding the use of own and third party cookies, nor was there any mention of the purposes for which the advertising and analytical cookies were installed in users' terminals.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
CEMEDIC, S.L. |
When accessing the website of the respondent, third party persistent cookies were automatically installed without requiring the acceptance and the performance of any action on the page was enough for the installation. The information given was just the included in the cookies notice, without extending it with all the data required.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
INDIVIDUAL |
The owner for two websites proceeded to install third party cookies on users' computers without providing the necessary information and therefore, without obtaining the appropriate consent.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
|
|
LIVE NATION ESPAÑA, S.A.U. |
The Spanish Food Safety and Nutrition Agency denounced the website www.livenation.es for the violation of legal obligations about information and consent regarding the use of cookies.
|
Art. 22.2 Spanish E-commerce Act |
Warning |
