A sanction of €1,600 was imposed on a restaurateur for the use of non-essential cookies without prior consent, the absence of a refusal option, and insufficient information, with the procedure being closed after rapid compliance and voluntary payment of the fine.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against BEGIN RESTAURANTES, S.L. (including the imposition of a €1,600 fine) for breaches related to the use of cookies on its website.

The case originated from a complaint filed by an individual on May 27, 2023, concerning several breaches, notably the impossibility to refuse cookies and their installation before obtaining consent.

Reasons for the decision

• Obligation to obtain consent before placing non-essential cookies (Article 22.2 of Spanish Law 34/2002): Inspections conducted by the authority on September 20 and October 18, 2023, revealed that initially, non-technical cookies were placed on the user's device from their first visit to the site, before any action on their part. Furthermore, the information banner did not offer a simple mechanism to refuse these cookies, only the option to accept them. The authority concluded that this practice violated the requirement for prior and informed consent, constituting a minor infringement under Article 38.4 g) of the same law.

Authority's decision

Consequently, the authority imposed a fine of €2,000, reduced to €1,600 after applying a reduction for voluntary payment. The payment of this amount by the company on November 16, 2023, before the final resolution, led to the closure of the procedure.

Lessons learned

This decision confirms that:

• The absence of a refusal mechanism for cookies as easy to use as the acceptance mechanism vitiates the user's consent.
• The placement of non-essential cookies on a user's device before obtaining their consent constitutes an infringement, even if browsing continues.
• Cooperation with the authority and rapid compliance of non-compliant measures are mitigating factors that can lead to a reduction of the sanction and early closure of the procedure.