Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Spain: AEPD publishes guide on audience measurement cookies

On January 11, 2024, the Spanish data protection authority (AEPD) published a guide on the use of cookies for audience measurement tools. In particular, the guide highlights that audience measurement cookies may be used to collect traffic or performance statistics. Notably, the guide clarifies that cookies used to obtain traffic and performance statistics may be exempt from consent under certain conditions, although such cookies must have a purpose strictly limited to the exclusive measurement of the audience of the site or application. Further, the cookies must only be used to produce anonymous statistical data.

In addition, to be exempt from consent, the guide provides that such cookies must not result in the data being compared with other processing operations or be transmitted to a third party, and such cookies must also not allow for aggregate tracking of the browsing of the person who uses different applications or browses other websites. The guide also states that analytics and audience measurement cookies that reuse data for other purposes do not fall within the exemption to consent. The guide provides a list of audience measurement cookies that are strictly necessary and are exempt from consent to include:

  • audience measurement, page by page;
  • the list of pages from which a link has been followed to request the current page, whether internal or external to the site;
  • determination of device type, browser, and screen size of visitors;
  • page load time statistics;
  • statistics on time spent on each page;
  • statistics on user actions; and
  • statistics on the geographical area of origin of the requests.

However, the guide notes that where audience measurement cookies are used that are exempt from the obligation to obtain consent, the following minimum guarantees must be implemented:

  • users are informed of the use of such cookies or similar technologies considered exempt, through the privacy policy or mobile app;
  • the use of the cookies will be limited to a period that allows meaningful comparison of audiences over time, and not extended by new visits;
  • the information collected is kept for a maximum period of 25 months; and
  • the retention period above is subject to a periodic review to limit cookies retention to what is strictly necessary.

You can read the guide, only available in Spanish, here.