AEPD (Spain) - EXP202414144 - Revision history

Le at 13:50, 13 August 2025

2025-08-13T13:50:33Z

← Older revision		Revision as of 13:50, 13 August 2025
Line 63:		Line 63:
	}}		}}

	The DPA fined a website €5,000 for setting non-necessary cookies without users' consent, including when users refused or withdrew consent to said cookies.		The DPA fined the operator of a website €5,000 for setting non-necessary cookies without users' consent, including when users refused or withdrew consent to said cookies.

	== English Summary ==		== English Summary ==

Le: Le moved page AEPD (Spain) - Expediente Nº: EXP202414144 to AEPD (Spain) - EXP202414144: naming convention

2025-08-13T11:45:28Z

Le moved page AEPD (Spain) - Expediente Nº: EXP202414144 to AEPD (Spain) - EXP202414144: naming convention

← Older revision	Revision as of 11:45, 13 August 2025
(No difference)

Cci: /* Facts */

2025-08-11T14:35:26Z

Facts

← Older revision		Revision as of 14:35, 11 August 2025
Line 70:		Line 70:
	The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.		The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.

	On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical<ref>~~Similar to other DPAs, the~~ Spanish DPA uses the expression "technical cookies" in reference to all cookies that fall under either of the two exemptions of Article 5(3) ePrivacy Directive. In other words: technical cookies are needed to make the communication possible over the network, or (more likely) are strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.</ref> and unnecessary cookies without the user's prior consent.		On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical<ref>The Spanish DPA uses the expression "technical cookies" in reference to all cookies that fall under either of the two exemptions of Article 5(3) ePrivacy Directive. In other words: technical cookies are needed to make the communication possible over the network, or (more likely) are strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.</ref> and unnecessary cookies without the user's prior consent.

	The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.		The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.

Cci: /* Facts */ clarified what DPA means by "technical cookies"

2025-08-11T14:33:52Z

Facts: clarified what DPA means by "technical cookies"

← Older revision		Revision as of 14:33, 11 August 2025
Line 70:		Line 70:
	The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.		The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.

	On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical and unnecessary cookies without the user's prior consent.		On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical<ref>Similar to other DPAs, the Spanish DPA uses the expression "technical cookies" in reference to all cookies that fall under either of the two exemptions of Article 5(3) ePrivacy Directive. In other words: technical cookies are needed to make the communication possible over the network, or (more likely) are strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.</ref> and unnecessary cookies without the user's prior consent.

	The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.		The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.

Cci: fixed a typo in short summary, changed "technical" to "non-essential"

2025-08-11T14:28:48Z

fixed a typo in short summary, changed "technical" to "non-essential"

← Older revision		Revision as of 14:28, 11 August 2025
Line 63:		Line 63:
	}}		}}

	The DPA fined a website €5,000 for setting ~~technical~~ cookies without users' consent, including when users refused or withdrew consent to said cookies.		The DPA fined a website €5,000 for setting non-necessary cookies without users' consent, including when users refused or withdrew consent to said cookies.

	== English Summary ==		== English Summary ==

Ap: I implemented the changes from the feedback document I sent you. After that the summary will be published in the newsletter!

2025-08-08T15:11:09Z

I implemented the changes from the feedback document I sent you. After that the summary will be published in the newsletter!

← Older revision		Revision as of 15:11, 8 August 2025
Line 10:		Line 10:
	\|ECLI=		\|ECLI=

	\|Original_Source_Name_1=~~Agencia Española de Protección de Datos (~~AEPD)		\|Original_Source_Name_1=AEPD
	\|Original_Source_Link_1=https://www.aepd.es/documento/ps-00224-2025.pdf		\|Original_Source_Link_1=https://www.aepd.es/documento/ps-00224-2025.pdf
	\|Original_Source_Language_1=English		\|Original_Source_Language_1=English
Line 63:		Line 63:
	}}		}}

	The DPA fined a website €5,000 for setting technical cookies without users' consent, including when users refused or withdrew consent to said cookies		The DPA fined a website €5,000 for setting technical cookies without users' consent, including when users refused or withdrew consent to said cookies.

	== English Summary ==		== English Summary ==
Line 70:		Line 70:
	The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.		The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.

	On 3 September, 2024, a complaint ~~was filed with~~ the ~~DPA against a website called EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U~~. According to the complaint, the controller used non-technical and unnecessary cookies without the user's prior consent.		On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical and unnecessary cookies without the user's prior consent.

	The controller ~~contended~~ that the website's cookie policy was in accordance with the current regulations ~~and that technical control showed no deviation from the policy~~. Furthermore, the controller claimed that consent could be managed and revoked through their website: for the technical cookies no consent was required.		The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.

	The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent.		The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent.

	=== Holding ===		=== Holding ===
	The DPA found a breach of Article 22.2 LSSI on the installation of cookies before the user's consent. The exemptions apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents.		The DPA found a breach of the national ePrivacy implementation law (LSSI)<ref>Law 34/2002, of July 11, on information society services and electronic commerce (Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico)</ref>. [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a22 Article 22.2 LSSI] on the installation of cookies before the user's consent. The exemptions under this Article apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents.

	The DPA decided this infraction was minor based on Article 38.4 g) LSSI. According to the criteria of Article 40 LSSI, the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence.		The DPA decided this infraction was minor based on Article [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a38 38(4)(g) LSSI]. According to the criteria of [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a40 Article 40 LSSI], the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence.

	The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of ~~€3000~~.		The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3,000.

	== Comment ==		== Comment ==

Eleonora: /* Facts */

2025-07-29T06:04:42Z

Facts

← Older revision		Revision as of 06:04, 29 July 2025
Line 70:		Line 70:
	The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.		The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.

	On 3 September 2024, a complaint was filed with the DPA against EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. According to the complaint, the controller used non-technical and unnecessary cookies without the user's prior consent.		On 3 September, 2024, a complaint was filed with the DPA against a website called EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. According to the complaint, the controller used non-technical and unnecessary cookies without the user's prior consent.

	The controller contended that the website's cookie policy was in accordance with the current regulations and that technical control showed no deviation from the policy. Furthermore, the controller claimed that consent could be managed and revoked through their website: for the ~~remaining installed~~ cookies, no consent was ~~mandated~~.		The controller contended that the website's cookie policy was in accordance with the current regulations and that technical control showed no deviation from the policy. Furthermore, the controller claimed that consent could be managed and revoked through their website: for the technical cookies no consent was required.

	The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent.		The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent.

	=== Holding ===		=== Holding ===
	The DPA found a breach of Article 22.2 LSSI on the installation of cookies before the user's consent. The exemptions apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents.		The DPA found a breach of Article 22.2 LSSI on the installation of cookies before the user's consent. The exemptions apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents.

	The DPA decided this infraction was minor ~~accroding to~~ Article 38.4 g) LSSI. According to the criteria of Article 40 LSSI, the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence.		The DPA decided this infraction was minor based on Article 38.4 g) LSSI. According to the criteria of Article 40 LSSI, the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence.

	The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3000.		The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3000.

Eleonora: Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=Expediente Nº: EXP202414144 |ECLI= |Original_Source_Name_1=Agencia Española de Protección de Datos (AEPD) |Original_Source_Link_1=https://www.aepd.es/documento/ps-00224-2025.pdf |Original_Source_Language_1=English |Original_Source_Language__Code_1=EN |Original_Source_Name_2= |Original_Source_Link_2=..."

2025-07-27T18:53:00Z

Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=Expediente Nº: EXP202414144 |ECLI= |Original_Source_Name_1=Agencia Española de Protección de Datos (AEPD) |Original_Source_Link_1=https://www.aepd.es/documento/ps-00224-2025.pdf |Original_Source_Language_1=English |Original_Source_Language__Code_1=EN |Original_Source_Name_2= |Original_Source_Link_2=..."

Show changes