Legality of Cookies in Personalized Digital Advertising

(edited with ChatGPT assistance)

By Prof. Dr. Camilo Alfonso Escobar Mora
Founder of LEGADLLY – Professional Legal Clarity for Personalized Digital Advertising
🌐 legadlly.ca
📩 contact@legadlly.ca

Cookies and Consumer Consent in Digital Advertising

What are commonly known as cookies—technological mechanisms used to detect and analyze consumer behavior in digital environments—involve the processing of personal data related to an individual’s online activity.

From a legal perspective, the use of cookies in personalized digital advertising is valid only when consumer consent exists. Cookies allow companies to understand how consumers behave in a given digital market environment. However, this data-based tracking must always respect the consumer’s freedom and autonomy, which legally requires their consent.

This situation differs from digital advertising models that do not rely on the processing of personal data. For example:

• Advertising based on general consumer profiles
• Ads displayed according to contextual digital environments
• Generic advertising linked to the topic of the website or digital space being visited

In these cases, advertisements may still capture consumer attention and generate purchase interest without directly processing personal data.

Why Consent Is Legally Required for Cookie-Based Tracking

When advertising tracks a consumer through personal data, explicit consent becomes legally necessary.

This requirement exists because such data processing is not essential for the functioning of the service itself, but rather serves commercial purposes related to business profit-making activities.

While personalized advertising may indeed benefit consumers—especially when it aligns with their interests—this does not justify indiscriminate data tracking.

Some organizations attempt to justify tracking under a supposed “legitimate interest”, assuming an implicit or presumed consent from users. However, from a legal standpoint, this reasoning is problematic.

✔ Consent must be explicit.

In certain situations, consumer behavior may reflect tacit agreement—such as clearly accepting cookies through consent banners or platforms—but this acceptance must always reflect a clear and informed intention by the user.

Consent Management and Legal Validity

Many companies have implemented Consent Management Platforms (CMPs) to handle cookie permissions.

However, the key issue is not merely technological implementation. What truly matters is whether these systems are legally valid and compliant.

Legal compliance requires alignment with the fundamental structure of legal freedom, including both:

• The exercise of freedom
• The limits of freedom under law

The Legal Foundations Behind Cookie Regulation

The most significant legal questions surrounding cookies in personalized digital advertising can be resolved through the fundamental principles of law, rather than through endless technical regulation.

These foundational principles include:

• Good faith
• Loyalty
• Solidarity
• Human dignity
• Equality
• Anticipation and prevention
• Precision and clarity
• Effective communication of necessary information
• Legal maintenance and continuity of obligations

These principles represent the structural conditions of legal freedom.

In essence, law is universal:

• Rights and duties form a coherent unity
• Freedom and its limits operate together
• What is legally permitted and prohibited follows universal principles

Everything within legal relationships is interconnected.

Legal Responsibility in Personalized Digital Advertising

For personalized digital advertising campaigns to be legally valid, they must be structured around these foundational legal principles.

This applies to the legal relationships between companies and consumers, including:

• The company itself
• Third-party advertising representatives
• Consumers as individuals or organizations
• Actors in the private and public sectors
• National, foreign, and international contexts

When these relationships are properly structured, both parties can exercise their rights while fulfilling their respective legal duties, allowing their needs to be addressed appropriately in each specific case.

Preventive and Corrective Legal Responsibility

This framework reflects preventive legal responsibility—ensuring that advertising practices are legally sound before conflicts arise.

At the same time, it also enables corrective legal responsibility, which becomes relevant when disputes occur in relation to personalized digital advertising practices.

Why Legal Teams Must Be Trained in Digital Advertising Risks

Corporate legal teams play a critical role in understanding and applying these principles effectively.

Legal professionals must therefore be trained in the universal legal risks inherent to personalized digital advertising, including risks that are:

• Structural
• Cross-sectoral
• Inherent to digital advertising systems

When legal teams are properly trained, companies can:

✔ Develop valid self-regulation mechanisms
✔ Conduct legally compliant advertising campaigns
✔ Resolve conflicts decisively and efficiently

The Role of Law in the Future of Personalized Advertising

Law itself is sufficient to guide the legality of personalized digital advertising.

The challenge does not lie in the absence of regulation, but in the ability of legal teams and organizations to correctly understand and apply the foundations of law.

There is no need for a specific rule governing every element of personalized advertising technology.

The entire legal framework—the legal form of freedom—already provides the necessary guidance for how these activities must exist in general and therefore in each specific case.

Making this reality possible is the responsibility of companies, legal professionals, and institutions operating in the digital economy.