- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA UNIPERSONAL – €30,000 Fine (Spain, 2020)
Iberia was fined for not allowing users to reject cookies on their website. Users were forced to accept cookies to continue browsing, which goes against privacy rules. This case highlights the importance of giving users clear choices about their data.
What happened
Iberia placed cookies on its website before obtaining user consent and did not provide an option to reject them.
Who was affected
Website visitors using Iberia's website who were tracked by cookies without the option to refuse.
What the authority found
The Spanish DPA ruled that Iberia violated the ePrivacy Directive by not allowing users to reject cookies and by providing unclear information about them.
Why this matters
This ruling emphasizes that companies must respect user choices regarding cookies. Website operators should ensure they provide clear options for users to accept or reject cookies.
Source checks
Linked-source text retrieved.
Automated check recorded — 4 April 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A user of the website of Iberia, an airline, lodged a complaint before the Spanish DPA (AEPD) saying that they had not been given an option to reject the cookies when using the website, and that they had been obliged to accept them to keep browsing. During the investigation, the AEPD also found that cookies were placed before obtaining consent. Additionally, they found that the information about cookies was incomplete and misleading. The AEPD concluded that Iberia had infringed Article 22(2) of the Spanish law on cookies (LSSI), as transposed from the e-Privacy Directive. The DPA considered that the airline should have allowed users to reject cookies in the second layer at once, instead of granularly, and that it should not had installed cookies without allowing users to exercise their choice. The airline should have also informed users about third party cookies and the storage period, as well as more clear information about the purpose of cookies. For this, the Spanish DPA fined Iberia €30,000.
Violations (3)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Related Enforcement Actions (0)
No other enforcement actions found for IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA UNIPERSONAL in ES
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
16 October 2020
Authority
Agencia Española de Protección de Datos
Fine Amount
€30,000
GDPRhub ID
gdprhub-3698About this data
Cite as: Cookie Fines. IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA UNIPERSONAL - Spain (2020). Retrieved from cookiefines.eu
Last updated: