Cookies and GDPR: CJEU case law and application in Spain
Analysis of CJEU case law on cookies and consent: Planet49, Orange Romania, IAB TCF rulings and their application by Spain's AEPD.
# Cookies and GDPR: CJEU Case Law
The 2019-2025 Case Law Revolution
Key CJEU rulings have transformed cookie law:
Planet49 (1/10/2019): Pre-ticked checkboxes are not valid consent. Consent must be active (opt-in). Cookie duration information is mandatory.
Orange Romania (11/11/2020): Consent cannot be a condition for service delivery when processing is not necessary for that service. Strengthens free consent.
IAB TCF (2/3/2023): The most widely used adtech consent management framework was found non-compliant. The TCF generated opaque processing uncontrollable by users.
Spain's AEPD Application
Spain's data protection authority updated its Cookie Guidelines (2023): cookie walls require an alternative access option; granular rejection by category is required; a reject button must be at the same level as the accept button; own analytics cookies may be treated differently.
Try Lexiel free · 28 days
Use code LEX-BLOG for double the standard trial period. Cancel anytime, no commitment.