How to review cookies on a restaurant website: accept, reject, and withdraw consent (AEPD guidance explained for 2023)

Reviewing cookie management on a restaurant website means checking purposes, the interface, and what actually happens: can customers accept or reject just as easily, which components stop working after they make a choice, and how can they withdraw consent later? Closing a pop-up is only a visible change; it does not replace these checks.

On 2023-7-11, the AEPD announced an update to its guidance: accept and reject options for cookies should be equally prominent; technical cookies needed for a language that users actively choose, and not used for any other purpose, may be exempt from consent. The update had to be implemented by 2024-1-11 at the latest. This article explains existing guidance and does not treat the announcement date as the effective date of a new law.

Identify the purpose and maintainer of each component

Go from the homepage to the menu, reservations, and checkout, and list both your own pages and external services. The names of map, video, reservation, or marketing components do not reveal everything they do. Ask your website provider whether they receive device information, why they need it, and who is responsible for configuring and updating them.

• Component and provider: List the services actually in use, rather than simply copying the installation inventory.
• Specific purpose: Record separately whether each component is used to fulfill a customer request, save preferences, collect analytics, or serve ads. If it has multiple purposes, document them separately.
• Loading conditions: Specify when information is requested or stored, and what activity should stop after rejection.
• Maintenance responsibility: Name a contact and identify who will review the component if its purpose or settings change.

Actively choosing a language is not the same as a website inferring a preference

The consent exemption described in the 2023 announcement applies when users choose preferences such as a language themselves and the related technical cookies are not used for anything else. The same conclusion cannot automatically be applied when a website infers preferences from information it has obtained. Ad retargeting cannot be broadly classified as an essential function just because it shares a component with the menu.

A qualified privacy adviser should assess specific exemptions and consent requirements in light of actual use. Do not classify all analytics tools as either essential or requiring consent across the board. If a tracking component has no real purpose and no one maintains it, consider removing it.

Review the interface and post-selection behavior separately

• First visit: On phones and computers, check that the accept, reject, and settings options are clear and unobstructed, and that rejecting does not involve extra steps.
• After rejection: Ask the technical provider to show, in a controlled browser environment, which requests and storage activity stop. A screenshot showing only that the pop-up has closed is not enough.
• Individual choices: Check each purpose against what actually loads, and confirm that the interface options really control the corresponding activity.
• Changing choices and withdrawing consent: Explain how customers can return to the settings, and how behavior changes after they update their choices. Do not leave them with an option that cannot be saved.

Accept and reject options should be equally clear in every language, and customers decide for themselves which to choose. If the menu or reservations stop working after customers reject advertising, ask the person responsible for maintenance to investigate; do not conceal the fault by making customers accept everything again. Seek professional advice separately if special service conditions apply.

Update your checks when providers change

When you replace a reservation, map, or advertising service, existing notices and choices may no longer match. The person responsible should ask the provider to update the component inventory, purposes, and effects of customer choices, and to identify any behavior that has not yet been verified and who will follow up. Keep the necessary evidence of internal checks, but do not request unrelated browsing data from customers’ devices.

Cookie management does not cover all responsibilities relating to reservation contact details, membership information, or payment data. Review each of these purposes separately. Staff can provide help with inquiries or ordering, and legal questions should go to the appropriate person in charge. Do not claim that installing a particular tool guarantees permanent compliance.