GDPR for E-commerce: Cookies, Profiling and Automated Decisions

The LSSI distinguishes between technical cookies (no consent required) and non-technical cookies (consent required). Technical cookies include: those necessary for functioning, user preferences, and session cookies. Non-technical cookies include: analytics, advertising, personalisation, social media. Non-technical cookies require prior, free, specific and informed consent, and consent must be withdrawable at any time.

Common bases are: consent (Art. 6(1)(a)) if the user explicitly accepts profiling; legitimate interest (Art. 6(1)(f)) if profiling is necessary to personalise the experience and does not disproportionately invade privacy; contract (Art. 6(1)(b)) if profiling is necessary to execute a contract (e.g. product recommendations). The choice depends on the type of profiling and the impact on the data subject. The data subject may object to legitimate interest (Art. 21(1)).

Art. 21(1) GDPR allows the data subject to object to processing based on legitimate interest (Art. 6(1)(f)), including profiling. If the data subject objects, the controller must stop processing the data unless it demonstrates a prevailing legitimate interest or that the processing is necessary for the exercise of a right. Art. 21(2) allows objecting to processing for direct marketing, without justification.

Art. 22 GDPR applies when the e-commerce makes decisions based solely on automated processing (including profiling) that produce legal effects or significantly affect the data subject. Examples: automated service refusal, pricing decisions with exclusionary effect, automatic selection for offers. In that case, an exception is required (contract, legal authorisation, explicit consent) and additional safeguards (human intervention, information, right to express a point of view).

The AEPD fined SEAT €20,000 (reduced to €12,000) in 2024 for deploying non-technical cookies without consent and no consent withdrawal (PS/00284/2024). The AEPD has also published guides on cookies, safe online shopping and privacy policies. The EDPB has published the Cookie Banner Taskforce report (2023) with recommendations to improve cookie banner implementation.

Not per se. Purchase and behaviour data (products viewed, purchased, time on page) are not special categories under Art. 9 GDPR. However, they may become special categories if they reveal information about health, religion, ethnicity, sexual orientation or other sensitive data. For example, if a health product e-commerce collects data revealing medical conditions, Art. 9 applies and a specific legal basis is required.

The use of manipulative techniques (dark patterns) to obtain consent or influence decisions may violate the fairness principle of Art. 5(1)(a) GDPR (lawfulness, fairness and transparency). If dark patterns use AI, they may be a prohibited practice under Art. 5(1)(a) AI Act (subliminal manipulation). The AEPD and the EDPB have published guidance on valid consent and cookies, requiring that consent be free and not induced.

The AEPD supervises the GDPR and the LSSI in Spain. At European level, the EDPB coordinates enforcement between Member States. The AEPD has published guides on cookies, safe online shopping, and a decalogue for privacy policies. The EDPB has published guidelines on social media targeting and the Cookie Banner Taskforce report.