Croatia: Issued Agency for the Protection of Personal Data ruling in the investigation into gambling and betting platforms over alleged illegal processing of personal data through cookies

On 14 September 2023, the Agency for the Protection of Personal Data fined two gambling and betting companies EUR 20’000 and EUR 30’000, for violating data protection regulations by illegally processing personal data through cookies without a legal basis. The companies failed to obtain proper consent for cookie usage, breaching Article 6 of the General Data Protection Regulation (GDPR). Additionally, they violated Article 7 by not allowing users to give or withdraw consent for each cookie type separately and Article 13 by inadequately informing users about data processing.