The Spanish data protection authority (AEPD) has updated its Guidelines on the use of cookies (unfortunately, available in Spanish only). Below is a summary of the key changes – and beware, it is the AEPD’s view that parental consent is now needed!

• Additional requirements for children: in the case of websites or online services specifically targeted at children, additional precautions need to be taken, such as using more clear and simple language. The guidance also makes clear the AEPD’s position that, for children under the age of 14, parental consent is needed (using “reasonable efforts” for verification and taking a risk-based approach). Examples are given here also. The AEPD says that where cookies are used for analytical purposes only, verifiable parental consent may be obtained by including a simple notice in the cookie banner that children U14 should tell their parent or guardian to accept or reject the cookies, thereby avoiding gathering additional data from either the parent or the child. But, where cookies are used e.g., for personalisation, you should first ask the user to confirm if they are 14+ and, if not, include a message in the banner for the parent or guardian to accept or reject the cookies on their behalf.
• Reject button on the first layer: the cookie banner needs to include both an “accept” and “reject” button or similar in the same level.
• Design requirements: the buttons must be of equal prominence and appeal and the colour or contrast must not be obviously misleading for users (basically, do not push the user to accept cookies). Helpfully, the guidance provides some examples of suitable cookie banners.
• More choice: there should also be a clearly visible third button or similar mechanism to allow the user to accept or reject the cookies in a granular way (i.e., depending on its purpose).  
• Cookie walls: the AEPD seems to suggest that cookie walls (i.e., where the user can choose to use a website without cookies for a fee) may now be permitted. “There may be certain cases in which not accepting the use of cookies prevents access to the website or the total or partial use of the service, provided that the user is adequately informed and an alternative, not necessarily free of charge, access to the service is offered without the need to accept the use of cookies”.