OPEN BANK, S.A.

AEPD (Spain) case PS-00037-2022, decided 2022-07-18. EUR 30,000.

What the regulator decided

openbank.es presented an initial cookie banner with an "Accept" button but no equivalent option to reject non-strictly-necessary cookies at the same interaction level, requiring users to navigate to a "Cookie settings" panel to refuse - the asymmetric design fell short of the unambiguous and freely-given consent standard required by Article 22.2 LSSI in line with Article 4(11) and 7 GDPR.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.aepd.es/documento/ps-00037-2022.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20240127061511/https://www.aepd.es/documento/ps-00037-2022.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Cite alongside CNIL SAN-2022-031 (Meta Facebook) for symmetry-of- refusal as a pan-EU principle, not a French-only quirk. AEPD has been explicit since at least 2020 that "Accept" without a same-level "Reject" is non-compliant under LSSI Article 22.2.

Verification trail

Verified by: donal
Verified at: 2026-05-26
Review due: 2026-11-26

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-aepd-ps-00037-2022,
  author       = {{ConsentMark}},
  year         = {2022},
  title        = {AEPD (Spain) PS-00037-2022 - OPEN BANK, S.A.},
  howpublished = {\url{https://www.consentmark.com/precedent/aepd-ps-00037-2022}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2022, July 18). AEPD (Spain) PS-00037-2022 - OPEN BANK, S.A.. Methodology v1.3. https://www.consentmark.com/precedent/aepd-ps-00037-2022

Markdown

[AEPD (Spain) PS-00037-2022 - OPEN BANK, S.A. - ConsentMark](https://www.consentmark.com/precedent/aepd-ps-00037-2022)

Plain text

AEPD (Spain) PS-00037-2022 - OPEN BANK, S.A. - ConsentMark, 2022-07-18, methodology v1.3, https://www.consentmark.com/precedent/aepd-ps-00037-2022