Would you like to pay in cash or with personal data?

In order to update the Spanish guidelines on cookies to the recent recommendations of the European Data Protection Board (hereinafter, ‘EDPB’), the AEPD released its latest version of the Guide on the Use of Cookies, which entered into force on 11th January.  

The aim of this new Guide is to align the standpoint of the Authority with the recommendations of the EDPB on dark patterns, to remind that the use of confusing and ambiguous wording and interfaces when collecting consent is not fully compliant with the general data protection principles. 

However, the Guide has also opened the back door to the use of cookie paywalls. These ‘cookie paywalls’ are mechanisms whereby the user is offered the following choice: consent to the use of cookies or pay for the services. 

To picture why this has happened, it must be explained that, in general terms and in a very broad sense, when a website uses cookies that are not necessary, like advertising cookies, it needs the consent of the user. 

In previous guidelines, the AEPD specified that for this consent to be freely given, the alternative offered could not be the refusal to access the service. In other words, ‘consent or out’ mechanisms (commonly known as ‘cookie walls’), where the user has to choose to either consent to the use of cookies, or not access the website at all, are not valid. These mechanisms indirectly force the user to consent to cookies, and insofar this consent lacks validity. 

To offer a free choice, the platform should provide a feasible alternative to the use of cookies, other than the refusal to access the service. The crucial query here is, must this alternative be free of charge? This is where the new Guide has introduced a change, by clarifying that platforms can ask users to pay as an alternative to the use of cookies. 

With this clarification, the AEPD opens the door to cookie paywalls and joins the trend of EU data protection authorities as the French one (known as ‘CNIL’). It also follows the interpretations of the Court of Justice of the European Union in its judgement C-252/21 Meta Platforms v. German Supervisory Authority. 

On these grounds, Spain woke up on 11th January, the day the new Guide entered into force, to a flock of cookie paywalls, implemented in every major Spanish press website. To this day, these websites offer a monetary alternative to consent, that varies from 36 to 132 € per month. The number of users who gave their consent under these conditions is likely vast. 

To answer the obvious question: Yes, following the standpoint of the AEPD it is lawful to use these cookie paywalls. However, as with any change of criteria, until the AEPD or the Courts release further clarifications in this respect, patience is the best policy.  

Even if these paywalls are lawful in theory, they could be ruled out as disproportionate based on the amount that the user has to pay for the services, which would make the collected consent invalid and the processing of data unlawful. Moreover, we will wait for the official stance of the EDPB, which discussed this matter recently in a plenary meeting.