Depending on the entity that manages the computer or domain from which cookies are sent and treat the data obtained, we can distinguish:

• Own cookies: those sent to the user’s terminal equipment from a computer or domain managed by the editor itself and from which the service requested by the user is provided.
• Third party cookies: those sent to the user’s terminal equipment from a computer or domain that is not managed by the editor, but by another entity that treats the data obtained through cookies.

In the event that cookies are served from a computer or domain managed by the editor itself, but the information collected through them is managed by a third party, they cannot be considered as own cookies if the third party uses them for their own purposes (for example, the improvement of the services it provides or the provision of advertising services in favor of other entities).

There are a lot of purposes to use cookies. Depending on the purpose for which the data obtained through cookies are processed, some of the purposes may be:

• Technical cookies: Those allowing the user to navigate through a website, platform or application and the use of the different options or services that exist in it, including those that the editor uses to enable the management and operation of the website and enable its functions and services, such as, for example, control traffic and data communication, identify the session, access parts of restricted access, remember the elements that make up an order, make the buying process of an order, manage the payment, control fraud linked to the security of the service, make the application for registration or participation in an event…Also belonging to this category, due to their technical nature, are those cookies that allow the management, in the most efficient way possible, of the advertising spaces that, as another element of design or “layout” of the service offered to the user, the editor has included in a web page, application or platform based on criteria such as the edited content, without collecting information from users for other purposes, such as personalizing that advertising content or other content. The technical cookies will be exempt from complying with the obligations established by article 22.2 of the LSSI when they allow us to provide the service requested by the user, as in the case of the cookies listed in the previous paragraphs. However, if these cookies are also used for non-exempt purposes (for example, for behavioral advertising purposes), they will be subject to these obligations.
• Preference or personalization cookies: those allowing remembering information so that the user accesses the service with certain characteristics that may differentiate his experience from that of other users, such as, for example, the language, the number of results to be displayed when the user performs a search, the appearance or content of the service depending on the type of browser through which the user accesses the service or the region from which he accesses the service, etc. If it is the user who chooses these characteristics (for example, if he or she selects the language of a website), cookies will be exempt from the obligations of article 22.2 of the LSSI, as they will be considered a service expressly requested by the user, provided that the cookies obey exclusively to the selected purpose. These preference cookies will not necessarily have to be session cookies, since asking the user to determine his or her preferences for this purpose each time a website is visited, or an application is accessed may be annoying and may cause fatigue to the user. However, in order for these cookies to be considered exempt, their use must be limited to what is necessary for their purpose, and the information that may be obtained from the user’s selection shall not be used for other purposes (for example, to personalize advertising content) or to create a profile of the user.
• Analysis or measurement cookies: are those allowing the party responsible for them to monitor and analyze the behavior of users of the websites to which they are linked, including the quantification of the impacts of advertisements. The information collected through this type of cookies is used in the measurement of the activity of the websites, applications, or platforms, in order to introduce improvements based on the analysis of the usage data made by the users of the service. Regarding the processing of data collected through analytics cookies, WG29 stated that, although they are not exempt from the duty to obtain informed consent for their use, they are unlikely to pose a risk to users’ privacy as long as they are first-party cookies, process aggregated data for strictly statistical purposes, provide information on their uses and include the possibility for users to express their refusal on their use.
• Behavioral advertising cookies: are those storing information on user behavior obtained through continuous observation of their browsing habits, which allows a specific profile to be developed to display advertising based on the same.

• Session cookies: These are designed to collect and store data while the user accesses a website. They are usually used to store information that is only relevant to the provision of the service requested by the user on a single occasion (e.g., a list of products purchased) and disappear at the end of the session.
• Persistent cookies: These are cookies in which the data remains stored in the terminal and can be accessed and processed for a period defined by the party responsible for the cookie, which can range from a few minutes to several years. When persistent cookies are installed, it is recommended to reduce to the necessary minimum their temporary duration according to the purpose of their use. To this effect, WG29’s 4/2012 Decision indicated that for a cookie to be exempt from the duty of informed consent, its expiration shall be related to its purpose. Therefore, session cookies are much more likely to be considered excepted than persistent cookies.