On 28 July 2020, the Spanish Data Protection Agency (hereinafter, “AEPD”) has published an update of its Guide on the Use of Cookies[1] (the “Guide”) to adapt it to the new Guidelines 05/2020 on consent under Regulation 2016/679 adopted on 4 May 2020 by the European Data Protection Board.

The changes introduced by the Guide can be found in its section “3.1.2.2. Layered information”. The most important modification is that the “if you continue browsing” option is no longer a valid way to collect user consent. Therefore, and unlike the previous AEPD’s Guide on the Use of Cookies adopted on November 2019, the fact of keeping browsing the website is not anymore considered as an undoubtedly positive action under any circumstances.

In accordance with the above, an “Accept” or “Accept all cookies” button must be place in the cookie banner. If the user has not pressed the referred “Accept” or “Accept all cookies”, no cookies required consent can be installed.

The AEPD provides three different examples for the cookie banner:

Example 1

We use our own and third-party cookies to analyse our services and show ads related to your preferences, according to profiling based on your browsing habits (for example, websites visited). You may know more and set up your preferences HERE.

ACEPT COOKIES                       REJECT COOKIES

Example 2

We use our own and third-party cookies for analytic purposes and in order to show personalised ads according to profiling based on your browsing habits (for example, websites visited). Click HERE to know more. You may accept all cookies by clicking on “Accept” or reject or set up your preferred configuration by clicking HERE.

ACEPT

Example 3

We use our own and third-party cookies to analyse our services and show ads related to your preferences, according to profiling based on your browsing habits (for example, websites visited). Click HERE to know more. You may accept all cookies by clicking on “Accept” or reject or set up your preferred configuration by clicking CONFIGURATION.

CONFIGURATION                       ACCEPT

If examples 2 and 3 are used, in order to comply with the requirement that granting consent must be as easy as withdrawing it, a button that allows to “Reject all cookies” or to save user’s cookies configuration must be included. In the latter case, when the user saves his configuration without having accepted any cookie, the user must be reminded that pressing the referred button will be equivalent to rejecting all cookies. The AEPD provides the following example:

Example: configuration button

When you press “Save settings”, the selection of cookies you have chosen will be saved. If you have not selected any option, pressing this button will be equivalent to rejecting all cookies.

SAVE SETTINGS

The corresponding changes must be adopted before 31 October 2020; therefore, a three-month period is given to carry out the adaptation process.