The internet is a parallel world into which we project our identity – not just by creating social media profiles or interacting with content, but simply by browsing the web. Every action, every view, every download and Every click provides valuable information for all kinds of organisations, for which our personal data is very important. Thanks to the digital trail we leave behind – and which we ourselves allow to be tracked by accepting those well-known cookies – companies can get to know each other better and offer us exactly what we want, so that we find them irresistible.
However, to ensure that the internet does not pose a risk to users and to avoid breaching data privacy regulations, a Cookies Act has been drawn up to protect us and to set out in detail how the information we provide will be used.
But what exactly are these famous cookies?
To understand what the Cookies Act says and what it protects us from, it is important that we know exactly what cookies are. In the context of computing and web browsing, these are small text files that websites store on your device (such as a computer, tablet or mobile phone) when you visit a web page. These files contain information that websites use for various purposes, such as remembering your preferences, tracking your activity on the site and providing a personalised browsing experience.
What information can cookies store?
Examples of the information that cookies may store include the following types of data:
User preferences: details such as preferred language, geographical location, date and time format, and website display settings.
Login details: usernames and passwords to enable automatic access to user accounts on websites.
Shopping trolleys: The products or services selected by the user in online shops may be stored in cookies so that they can be recalled during the browsing session or between visits.
Activity tracking: Cookies can track a user’s activity on the website, such as the pages visited, the time spent on the site and the clicks made. This information is used to analyse user behaviour and improve the user experience on the site.
Authentication details: to keep users logged in to a website and allow access to restricted areas.
Targeted advertising: Cookies may store information about a user’s interests and are used to display relevant adverts based on their browsing history.
Security and authentication: Some cookies are used to maintain the security of the user’s session, such as to prevent phishing attacks.
Session details: session identifiers that enable the website to recognise users during their current visit.
Third-party tracking data: Third-party cookies, such as those used by web analytics services and advertising networks, collect data to analyse website traffic and measure the effectiveness of advertising.
Key points of the current Cookies Act
Now that we know exactly what cookies are and what data they collect, let’s see where this law places the legal safeguards to protect users. In July 2023, the Spanish Data Protection Agency (AEPD) updated its requirements regarding cookie consent banners in line with the new guidelines issued by the European Data Protection Board.
Here are some of the most important changes that will come into force in January 2024
Cookie consent banner
The consent banner must display the name of the website’s publisher, the purposes of these cookies, information on who owns the cookies, the type of data that will be collected, and how the user can accept, modify or reject this processing. Furthermore, the buttons on this banner must be clearly visible and a link must be included providing access to more detailed information.
On the second layer of the banner, when the user scrolls down to it in search of further information, the cookies must be grouped into at least one category, so that the user can accept or reject them one by one. Within each purpose, cookies may also be grouped according to the third party responsible for them, so that the user can consent to their data being shared only with the company of their choice.
Methods for obtaining consent
It must be made absolutely clear whether consent is given exclusively for the website on which it is being requested, or whether it extends to other websites, whether operated by the same publisher or by third parties associated with that publisher. Furthermore, the option to refuse cookies must be clearly offered to the user and, under no circumstances, shall the user’s inactivity be deemed to constitute consent.
Cookie duration
The duration of cookies must be the minimum necessary to achieve the purpose for which they have been set, whilst the use of cookie banners following the recent update may be lawful, provided that adequate information is supplied to the user and they are given the option to access the service without having to give their consent to the use of cookies.
Furthermore, it is important to bear in mind that the services offered by both options must be genuinely similar and that the alternative service cannot be provided by an entity other than the publisher.
Did you find this post interesting and would you like to know more about data privacy online? Subscribe to Educa.Pro and discover all the content we’ve prepared for you on digital transformation and new laws in the digital sphere!
