Yes, cookies can be placed without consent if they do not collect/ use personal data and do not identify the data subject. If the cookies collect personal data, the dispositions of the Personal Data Protection Act N° 25,326 ("PDPA") will be applicable and consent would be needed. Please note that consent is the only valid legal basis for processing personal data, and therefore for using cookies which collect personal data.
The PDPA does not specifically regulate cookies. However, if cookies process personal data, then data protection regulations will apply to the use of cookies.
PDPA does provide exemptions for consent, but they shall not be applicable to cookies if personal data is collected. However, if the data subject is not identifiable, consent will not be required.
i. Analytics cookies can only be placed automatically for statistical purposes if data subjects cannot be identified or with the data subject’s consent.
ii. Advertising cookies can be placed to establish profiles. However, please note that according to the PDPA, collected information cannot exceed the purposes of collection. In this sense, please bear in mind that the collection should be limited to the minimum possible amount. However, if the data subject is identifiable, consent must be provided before processing. This would mean that automatic placement of cookies would be illegal.
iii. Social media cookies cannot be automatically placed. Social media cookies tend to identify a user and can also reflect several aspects of sensitive data, such as ethnicity, political preferences. Therefore, social media cookies should not be automatically placed.
If the placement of cookies results in the identification of an individual, consent cannot be gained without ticking "I accept" as a positive action. In this sense, consent cannot be implied, as according to Argentine regulations, consent must be express and informed in order to be valid.
The PDPA does not require a specific Cookie notice, however, if cookies process personal data, the Company must inform the data subject on how this information is being collected and for what purposes by means of a privacy notice or privacy policy.
Provided that the data subject has been informed on how cookies are placed, and has expressly consented to such terms, a cookie banner should not be mandatory. However, Argentine regulation states that processing of personal data should be kept to a minimum. In this sense, if data subjects can provide less data and still enjoy a website, they should be given the chance.
A cookie wall could be set when the data subject has been correctly informed of the consequences of not providing the required personal data, and provided that the denied personal data are essential for the use of the platform. Otherwise, when the withheld data are not essential, the service may not be denied.
There are no specific cookie regulations in Argentina. However, the dispositions of the PDPA are applicable and the local DPA might put into place enforcement measures when unlawfully processing personal data collected by means of cookies.
No, we are not aware of any.
As in Europe, there is a regional tendency to protect data subject’s personal information. Thus, we expect heavier regulation in the future.
