The second section of article 22 of Law 34/2002, of July 11, on Services of the Information Society and Electronic Commerce (hereinafter, LSSI-CE), establishes the following:
Service providers may use data storage and retrieval devices on recipients’ terminal equipment, provided that they have given their consent after they have been provided with clear and complete information on their use, in particular, on the Data processing purposes, in accordance with the provisions of Organic Law 15/1999, of December 13, on the Protection of Personal Data.
When it is technically possible and effective, the consent of the recipient to accept the treatment of the data may be provided by using the appropriate parameters of the browser or other applications, provided that it must proceed to its configuration during its installation or update through an action express to that effect.
The foregoing shall not prevent the possible storage or access of a technical nature for the sole purpose of carrying out the transmission of a communication over an electronic communications network or, insofar as it is strictly necessary, for the provision of an information society service. expressly requested by the recipient.
According to the “Guide on the use of cookies”, published by the Spanish Agency for Data Protection (hereinafter, AEPD) in 2013, the LSSI-CE is applicable to any type of file or device that is downloaded in the terminal equipment of a user in order to store data that can be updated and retrieved by the entity responsible for its installation. The cookie is one of those widely used devices, which is why, from now on, we will generically refer to these devices as cookies.
Cookies used for any of the following purposes are exempt from compliance with the obligations established in article 22.2 of the LSSI-CE:
- Only allow communication between the user’s computer and the network.
- Strictly provide a service expressly requested by the user.
