D.A.A.A – €18,000 Fine (Spain, 2019)

The data subject complained to the DPA that it was impossible to purchase an airline ticket from the controller's website without accepting cookies and consenting to receive advertisements. The controller, Vueling Airlines S.A., had a box in its checkout procedure indicating consent to receive ads, but, contrary to the data subject's complaint, it was possible to purchase a ticket without checking the box. The controller's cookie policy allowed users to revoke consent to non-essential cookies by unchecking two pre-ticked boxes, one for "performance cookies" and one for "targeted cookies." However, some third-party cookies were incorrectly categorized as essential, so even when users unchecked the relevant boxes or clicked "reject all," non-essential cookies remained. The DPA found that the controller's consent banner violated Article 22.2 of the Spanish Law on Services of the Information Society and Electronic Commerce (Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico - LSSI) which requires service providers to obtain consent before installing non-essential cookies. The use of pre-ticked boxes is not a valid basis for consent, and the impossibility to reject cookies miscategorized as essential is not legal either. For these violations, the DPA ultimately fined the controller €18,000; an inital €30,000 fine was reduced by 40% because the controller voluntarily acknowledged responsibility for the infractions and agreed to pay the fine before final resolution of the sanctioning procedure.