- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Online Services – €10,000 Fine (Spain, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The operator of the online store banderacatalana.cat was fined EUR 10,000 for improperly handling the personal data of young newsletter subscribers. This is important because it shows that businesses must get proper consent from parents when dealing with children's data.
What happened
The operator allowed children under 16 to subscribe to a newsletter without obtaining parental consent.
Who was affected
Children under 16 who attempted to subscribe to the newsletter on the website.
What the authority found
The authority found that the operator violated GDPR by not obtaining necessary parental consent for processing children's personal data.
Why this matters
This case highlights the need for online businesses to have clear policies for handling the personal data of minors. Companies should ensure they have parental consent before collecting data from children.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) fined the operator of the online store banderacatalana.cat. EUR 10,000 for a violation of Art. 13 GDPR. The operator stated on its website privacy notices that a minimum age of 13 or sufficient legal capacity was required to subscribe to the newsletter. It was also stated that filling out the newsletter subscription form would be considered as consent to the processing of personal data. This constitutes a violation of the GDPR, as according to Art. 8 GDPR, the processing of personal data of under-16-year-olds requires the consent of the holder of parental responsibility over the child.
Related Enforcement Actions (0)
No other enforcement actions found for Online Services in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
15 December 2020
Authority
Agencia Española de Protección de Datos
Fine Amount
€10,000
About this data
Cite as: Cookie Fines. Online Services - Spain (2020). Retrieved from cookiefines.eu
Last updated: