Andorra: Adopted Updated Guidelines on the Use of Cookies, Privacy Policy, and Legal Notice

On 24 January 2024, the Andorran Data Protection Agency (APDA) updated its guidelines titled "Use of Cookies, Privacy Policy, and Legal Notice" to incorporate the European Data Protection Board (EDPB) Guidelines on Deceptive Design Patterns in Social Media Platform Interfaces and Guidelines on the Technical Scope of Article 5(3) of the ePrivacy Directive. The amendments emphasise the restriction of cookie storage time to a maximum of 25 months, provide conditions for obtaining consent from minors under 16, and offer recommendations for designing cookie banners. The guidelines also state that not including a reject button or pre-selected boxes for users to customise their choices does not constitute valid consent. The APDA has emphasised that failure to comply with the conditions for consent outlined in Articles 7 and 8 of the Law of Personal Data Protection may result in financial and administrative sanctions ranging from EUR 30'001 to EUR 100'000.