The legal framework for the use of cookies is defined in Spain by Law 34/2002, Services of the Information Society and E-Commerce (LSSI), as well as by Regulation (EU) 2016/679 of the European Parliament and the Council of April 27, 2016 (General Data Protection Regulations) and the Organic Law on Data Protection and Digital Rights Guarantee (LOPDGDD, Law 3/2018 of December 5).
In relation to the use of cookies, the second section of article 22 of the LSSI establishes the following:
“2. Service providers may use data storage and retrieval devices in terminal equipment of the recipients, provided that they have given their consent after they have been provided with clear and complete information about their use, in particular, about the purposes of data processing, in accordance with the provisions of Organic Law 15/1999, of December 13, on the Protection of Personal Data.
When technically possible and effective, the consent of the recipient to accept the processing of the data may be facilitated by using the appropriate parameters of the browser or other applications, provided that it must proceed with its configuration during installation or update through an active action for that purpose.
The foregoing shall not prevent the possible storage or access of a technical nature for the sole purpose of transmitting a communication through an electronic communications network or, as far as is strictly necessary, for the provision of a service of the information society expressly requested by the recipient. “
In the RGPD, cookies are mentioned in recital 30, prior to the articles of the aforementioned Regulation:
“(30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them”.
In this way, when cookies can identify an individual, they are considered personal data, just like an IP address.
The LOPD establishes in its article 6.1, in relation to the consent for the treatment of personal data:
“1. In accordance with the provisions of Article 4.11 of Regulation (EU) 2016/679, the consent of the affected party is understood to be any expression of a free, specific, informed and unequivocal will for which they accept, either through a declaration or a clear affirmative action, the processing of personal data that concern them.”