Tiger Media Inc., the controller, operated an advertising platform for publishers and advertisers of adult products and services
The platform acted as an ad network, connecting publishers offering advertising space with advertisers seeking to display ads on those websites.
Through this platform, the controller processed personal data of users visiting publishers’ websites where its ads were displayed. This included IP addresses, device and browser information, website URLs, referral URLs, clicks, impressions and cookie identifiers. According to the controller, the data were processed for ad delivery, fraud prevention, frequency capping, performance measurement and service improvement. The controller argued that it did not carry out behavioural advertising or profiling. It claimed that any targeting was limited to contextual factors, such as country and language. The controller relied mainly on legitimate interest as a legal basis and argued that publishers, as independent controllers of their own websites, were responsible for obtaining any consent required for cookies. The DPA investigated the controller’s platform and several Spanish websites using it. It found that cookies linked to the controller’s platform were installed on users’ devices without prior consent. These cookies were used for advertising-related purposes, including measuring ad performance, improving ad relevance, limiting frequency and detecting fraud. The AEPD also noted that the controller was not established in the EU. Although the controller stated that it had appointed a representative in Northern Ireland and was in the process of changing representative, the DPA considered that it did not have a valid representative established in the Union. Holding — The AEPD held that the controller violated Article 6 GDPR by processing personal data without a valid legal basis. The DPA emphasised that the LSSI, the Spanish law implementing the ePrivacy Directive require prior consent for storing or accessing information on a user’s device through cookies, unless an exemption applies. The DPA distinguished between the placement or reading of cookies, which is governed by the cookie rules, and the subsequent processing of personal data obtained through those cookies, which must comply with the GDPR. Since the cookies were installed without consent, the subsequent processing of the data collected through them could not be considered lawful. The AEPD rejected the controller’s reliance on legitimate interest under Article 6(1)(f) GDPR. It found that users had not received clear information and had not consented to the use of cookies. Moreover, users of the affected websites did not have a reasonable expectation that their browsing-related data would be processed by a third-party advertising network for advertising purposes. Therefore, the processing did not pass the balancing test required under Article 6(1)(f) GDPR. The DPA also held that the controller violated Article 27 GDPR. Since the controller was not established in the EU but processed personal data of users in Spain in connection with its advertising services, it was required to appoint a representative established in an EU Member State. A representative in Northern Ireland did not meet this requirement. The AEPD fined the controller €120,000 in total: €70,000 for the violation of Article 6 GDPR and €50,000 for the violation of Article 27 GDPR. Pursuant to Article 85 of the Spanish administrative Law 39/2015, the notice of initiation informed the controller of the possibility of acknowledging liability and making a voluntary payment of the proposed penalty, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the final penalty was set at €72,000, and its payment resulted in the termination of the proceedings. The AEPD also ordered the controller to adopt corrective measures within three months. In particular, the controller had to ensure compliance with Article 6 GDPR, ensure compliance with the Spanish cookie rules by the service providers using its cookies, appoint an EU representative and notify the AEPD of the measures adopted.
How it connects
Related across sources
Full text 6 findings
: EXP202405210 RESOLUTION TERMINATING THE PROCEEDINGS BY ACKNOWLEDGMENT OF LIABILITY AND VOLUNTARY PAYMENT Regarding the proceedings initiated by the Spanish Data Protection Agency and based on the following BACKGROUND: FIRST: On October 2, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against TIGER MEDIA INC. I. 00, taking advantage of the two reductions provided for in the aforementioned initial agreement. This implies acknowledgment of responsibility for the facts referred to in the initial agreement and their legal classification. 2 d) of the GDPR, which states that each supervisory authority may "require the controller or processor to ensure that the operations of treatment comply with the provisions of this Regulation, where applicable, in a specific manner and within a specified timeframe…”. es 22/24 Having acknowledged responsibility for the infringement, the imposition of the measures included in the initial agreement is warranted.
1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. " II Termination of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading “Termination in Sanctioning Procedures,” provides the following: “1. Once a sanctioning procedure has been initiated, if the offender acknowledges their responsibility, the procedure may be resolved by imposing the appropriate sanction. 2. When the sanction is solely pecuniary, or when a pecuniary sanction and a non-pecuniary sanction may be imposed but the impropriety of the latter has been justified, voluntary payment by the alleged offender, at any time prior to the resolution, will imply the termination of the procedure, except with regard to restoring the altered situation or determining compensation for damages caused by the commission of the infraction.
3. In both cases, when the If the sanction is solely monetary, the competent body for resolving the procedure will apply reductions of at least 20% to the proposed sanction amount, and these reductions are cumulative. These reductions must be specified in the notification initiating the procedure, and their effectiveness is conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. es 23/24 The percentage reduction provided for in this section may be increased by regulation. III Voluntary Payment and Acknowledgment of Responsibility In accordance with the provisions of Article 85 of the LPACAP, the notified initiation agreement informed the parties of the possibility of acknowledging responsibility and making voluntary payment of the proposed sanction, which would entail two cumulative reductions of 20% each. 00, and its payment would imply the termination of the proceedings, without prejudice to the imposition of the corresponding measures.
I. has acknowledged responsibility and voluntarily paid the penalty, taking advantage of the two reductions provided for. In accordance with section 3 of Article 85 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), the effectiveness of these reductions is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP, as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Therefore, in accordance with applicable legislation and having assessed the criteria for graduating the sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE the commission of the infringements and CONFIRM the sanctions determined in the operative part of the initial agreement transcribed in this resolution.
00. 00. The effectiveness of these reductions is conditional, in any case, upon the withdrawal or waiver of any action or appeal through administrative channels. SECOND: DECLARE the termination of procedure EXP202405210, in accordance with the provisions of Article 85 of the LPACAP. es 24/24 THIRD: ORDER TIGER MEDIA INC. to notify the Agency, within 3 months of this resolution becoming final and enforceable, of the adoption of the measures described in the legal grounds of the initiation agreement transcribed in this resolution. FOURTH: NOTIFY TIGER MEDIA INC. of this resolution. FIFTH: In accordance with the provisions of Article 85 of the LPACAP, which conditions the reduction for voluntary payment and acknowledgment of liability on the withdrawal or waiver of any action or appeal through administrative channels, this resolution will become final and fully enforceable upon notification.
In accordance with Article 50 of the LOPDGDD, this Resolution will be made public. Publication will take place once the resolution has been notified to the interested parties. 1 of the aforementioned Law. a) of the LPACAP, the final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. 4 of Law 39/2015, of October 1. They must also provide the Agency with documentation proving the effective filing of the administrative appeal. If the Agency does not receive notification of the filing of the administrative appeal within two months from the day following notification of this resolution, the precautionary suspension will be terminated. es