Adevinta Spain, S.L. – Dismissed (Spain, 2024)

In January 2021 a data subject accessed a website operated by Adevinta Spain, S.L. (the controller) which had a cookie banner. In the data subject’s view, the cookie banner did not offer a reject button in the first layer, used colors and contrasts to nudge user to consent and did not provide an option to withdraw consent that would be as easy to use as the option to give consent. The data subject, represented by noyb (European Centre for Digital Rights), lodged a complaint with the Austrian DPA in August 2021. The Austrian DPA determined that the controller was Spanish and forwarded the case to the Spanish DPA (AEPD), which received it in June 2023. The AEPD found no violations and issued a decision archiving the complaint on 8 November 2023. First, it agreed with the controller’s argument that providing one button to accept cookies and another to further configure settings in the first layer of the cookie banner, which then permitted you to reject cookies in the second layer of the banner, complied with the AEPD’s 2020/2022 Guidance on the use of cookies. Second, the AEPD noted that this guidance did not specify color or contrast settings. Though the updated 2023 guidance addressed dark patterns, it did not come into effect until 11 January 2024 and thus was not at issue in this case. Third, the AEPD observed that the panel to disable cookies was permanently located at the footer of the webpage and thus found that the option to withdraw consent was always accessible. Finally, based on its own investigation of the webpage, the AEPD determined that the webpage did not install any cookies prior to obtaining consent and verified their proper uninstallation once consent was withdrawn. On 11 December 2023, the data subject filed an internal appeal (recurso de reposición) making five key arguments. First, it claimed that a procedural GDPR violation had occurred, arguing that the Austrian DPA transferred the complaint to the AEPD when pursuant to Article 60(8) GDPR, the Austrian DPA should have been the DPA to adopt and notify the resolution. Second, the data subject argued that the AEPD failed to properly examine the facts raised in the complaint. Rather than considering the data subject’s experience with the platform, the AEPD considered only its own examination of the webpage, which it made more than two years after the data subject’s website visit occurred. Third, the data subject restated its argument that the controller had installed cookies without obtaining valid consent. Because this implicates processing of personal data, the data subject argued, the GDPR applies. Fourth, the data subject emphasised that the GDPR and ePrivacy Directive both make clear that a controller must permit rejection of consent in the first layer of the cookie banner. The AEPD’s cookie guidance should be interpreted according to this legal obligation, not the other way around. In addition, nudging users through colors, contrast, design and size was said to be unfair and not transparent. Finally, the data subject pointed out that the AEPD maintained contradictory criteria regarding the rejection of cookies in the first layer of the cookie banner. On 22 April 2024 the AEPD dismissed the appeal, concluding that only the Spanish [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758 LSSI] (Spain’s implementation of the ePrivacy Directive) applies in this case – not the GDPR. First, the AEPD rejected the data subject’s argument that the decision should have been issued by the Austrian DPA. Instead, it determined that only the LSSI applies in this case. Since there is no collaboration mechanism in the ePrivacy Directive as there is under the GDPR, the AEPD concluded that it is the only competent authority in this case. As a result, the AEPD rejected the data subject’s argument about the GDPR being applicable. The AEPD subsequently determined that no LSSI violations could be found in this case because its statute of limitations had been exceeded. Pursuant to Article 45 LSSI, very serious infractions expire after three years, serious infractions expire after two years and minor infractions expire after six months. The AEPD considered that, at the time it was hearing the appeal, three years would have passed since the commission of any alleged violations. As a result, it concluded, it would no longer be possible for the AEPD to examine the merits of the case. Finally, the AEPD noted that the website was updated since the time of the complaint’s filing and was now compliant with cookie banner requirements. It cited Article 65(6) of the [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 LOPDGDD], Spain’s law implementing the GDPR, which authorises the AEPD to archive cases in which the controller has taken measures to comply with the GDPR.