Editor’s note: This article was first published in September 2014 about the Spanish cookie rules of the time. The GDPR (2018) and later AEPD guidance have changed the requirements, and “if you keep browsing you accept cookies” banners are generally no longer considered valid consent. The fines and complaints cited are January 2014 figures.
As users, you will have seen those messages on every website and blog, showing a notice along the lines of: “This site uses cookies. If you keep browsing, we take it that you accept the use of cookies.” There are usually two buttons: one to accept the cookies and close the message so you don’t see it again next time you visit the site, and another one, “more information”, that sends you to the legal terms for the use of cookies. Nobody usually reads that notice, at least not on this blog, which gets about eight visits, and six of those are probably mine.
99.9999% of websites and blogs use cookies, because it is no longer just services such as Google Analytics (visitor analytics and statistics) and Google AdSense (advertising) that use them; even a simple Facebook “share” button may be using them.
Spanish law now requires every blog or website to include this notice, fully visible, so users know that a site uses cookies, when users ought to know that practically every site uses some kind of cookie. These notices shouldn’t waste the time of website and blog owners, or take up space on the page, since most of us (yours truly included) don’t have the legal and technical knowledge to apply the cookie policy to the letter.
Users should know that by the time they see the notice that a site uses cookies, some of them have, as a rule, already been installed. What’s more, when you go to Google, Twitter and Facebook, you have already been invaded by cookies, unless you have blocked cookies in your browser beforehand. If you do that, you will run into errors and a “degraded” user experience on many services you use regularly online.
You can even put your online security at risk, since many of these cookies help detect suspicious activity on your account when someone logs in from another computer.
It would have been quicker to have a TV announcement saying: “All social networks, blogs and websites install cookies on your device.” And if a website that doesn’t use cookies existed, it could show off with a full-colour banner saying: “It fills me with pride and satisfaction (as King Juan Carlos used to say in his Christmas speeches) to inform our users that NO COOKIES ARE USED HERE.”
Of course, knowing users, they would say: “What a crap website. I’m off to one that has cookies.”
But in Spain it’s a problem.
Nobody wants to be the next one penalised for not displaying a cookie notice. In fact, in Spain (how could it be otherwise), several sanction proceedings have already been opened against site owners for not displaying this notice, with fines that could reach 30,000 euros and even 150,000 euros depending on the severity.
The Spanish Data Protection Agency (AEPD) has even imposed its first fine, of 3,500 euros, on an online jewellery store for not displaying the cookie notice. At that point (January 2014), the AEPD was already investigating another 19 complaints against other sites that did not warn about installing cookies.
After reading lawyer Pablo Fernández Burgueño’s article on what any website must do to comply with the cookie rules to the letter, one obvious question comes up: “Have we all lost our minds?”
Now anyone who is bored and has nothing better to do can open sanction proceedings against any site that doesn’t include the required notice, or whose notice and legal text are not adequate. Maybe this new regulation is just one more way to bring down websites and blogs, maybe it is just a way to raise revenue through fines, or maybe it is just a way for some people to earn a bit of extra money by reporting sites, something that tends to work in Spain.
In any case, the way this law is applied in Spain unmistakably bears the Spanish stamp: forcing people to do something useless that, in the end, is just one more way of being a pain in the neck.
Users, who sometimes visit sites with pop-up ads or full-screen interstitials, now also have to close the cookie notice on one site after another, after another. On every page they visit.
Imagine you go shopping and every time you are about to walk into a shop, right before you go in, someone appears and tells you:
“Before entering, you should know that you accept our policy. If you walk through the door, we take it that you accept our group policy. Are you sure you want to come in, or would you like more information about our policy?”
When was the last time you read a cookie policy?
Featured image: kembelwong, CC BY 2.0, via Wikimedia Commons.
