Hello, I'm Pardip, legal advisor from the Fearfisher Silicon Valley office, and I'm joined by Andrea,

senior associate within our team. We're going to talk about the recent guidance issued by the Spanish

Data Protection Authority on Oakhis. So to start things off and for context, under the EU and UK cookie rules, only strictly necessary cookies are exempt from the requirement to obtain prior consent from users.

Analytics cookies are not considered strictly necessary.

Therefore, companies are required to provide website users with information, as well as obtain the user's consent.

Now, Andrea, can you guide us through the recent guidance issued by the Spanish Data Protection Authority and what it changes?

Thanks, Pradip, yes, of course.

So firstly, it's worth noting that the European Data Protection Board, which replaced the Article 29 Working Party,

published last November a draft report reflecting the work

undertaken by the Cookie Banner Task Force.

This report refers to an older opinion from the Article 29 Working Party from 2012

that already argued that an additional exemption should be created within the cookie rules

for cookies

that are strictly limited to first-party anonymized and aggregated statistical purposes,

which present limited privacy risk.

Some European Data Protection Authorities, in particular in France, Italy, and Luxembourg,

have already supported this additional exemption when certain conditions are met,

and the Spanish DPA is the latest to support it with its recent guidance issued last month.

And Andrea, what are the conditions to qualify for the exemption under the Spanish guidance?

So under the Spanish guidance for cookies used for the purpose of obtaining traffic or

performance statistics to be exempted from consent, firstly, they have to be strictly

limited to the exclusive measurement of the audience of the website or application.

...