Why Spain Deserves Its Own Look

Spain is one of the largest audiences for Spanish-language publishers worldwide, and its data protection authority, the Agencia Española de Protección de Datos (AEPD), is one of the most active regulators in Europe. Like every EU country, Spain applies the GDPR, but the rule on cookies comes from national law implementing the ePrivacy Directive. For publishers, the AEPD’s cookie guidance is the most practical reference for how those rules are read in Spain.

This article summarises what that guidance means for a typical ad-supported site or app. It is a practical overview, not legal advice.

The Legal Basis: LSSI Article 22.2

The cookie rule in Spain sits in Article 22.2 of Law 34/2002 on information society services and electronic commerce, known as the LSSI. It requires that storing or accessing information on a user’s device be based on consent given after clear and complete information, with an exception for storage that is strictly necessary for a service the user has explicitly requested or for transmitting a communication.

When cookies are used to process personal data, the GDPR and Spain’s Organic Law 3/2018 (LOPDGDD) also apply, which is why the AEPD is the authority publishers deal with on cookie matters.

The AEPD Cookie Guide

The AEPD publishes a Guide on the use of cookies, prepared together with industry associations. It was updated in July 2023 to align with the European Data Protection Board’s work on cookie banners and deceptive design patterns, and organisations were given until January 2024 to adapt. The main points relevant to publishers are below.

Equal prominence for reject

The updated guide expects that, if the first layer of the banner contains a button to accept cookies, it also offers an equivalent way to reject them, presented at the same level and with similar visibility. A reject option hidden behind a “settings” link is not equivalent.

No consent by browsing

Scrolling, continuing to navigate or closing the banner do not count as consent. The user must take a clear affirmative action.

Clear information in layers

The guide accepts a layered approach: a short first layer identifying the publisher, the purposes, whether third parties are involved and how to accept, reject or configure; and a second layer with detailed information about each cookie, the parties involved and retention.

Granular choices

Users should be able to choose by purpose, and where useful by third party, rather than facing a single all-or-nothing switch.

Withdrawal

Users must be able to withdraw consent at any time, as easily as they gave it. A persistent link or icon that reopens the settings is the usual solution.

Consent duration

The guide recommends that consent be renewed periodically and suggests a maximum validity of 24 months, so users are asked again rather than having a choice stored indefinitely.

Access conditional on cookies

The guide discusses cases where access to a service is made conditional on accepting cookies. It indicates this may be acceptable in some circumstances, for example where the user is offered a genuine alternative to access the content without accepting cookies, which need not be free. Given the EDPB’s separate opinion on “consent or pay” models for large platforms, publishers considering this approach should take specific legal advice.

What This Means in Practice

For most publishers already running a TCF-based CMP across the EU, Spain requires few structural changes. The points that most often need attention are:

• First-layer reject. If your EU banner still uses “Accept” plus “Manage options” only, Spanish traffic is a reason to add a visible reject button.
• Spanish-language text. Purposes and third-party descriptions should be in clear Spanish for users in Spain, not machine-translated fragments mixed with English vendor names.
• Re-prompt schedule. Check that your CMP renews consent within the period you have chosen, and that changes to vendors or purposes trigger a new prompt.
• Cookie policy. Keep the second-layer information and your cookie policy consistent with what actually runs on the site.
• Pre-consent loading. Make sure no advertising or analytics cookies are set before the user decides. This remains the most common finding in cookie investigations everywhere.

Enforcement Context

The AEPD regularly publishes its resolutions, and cookie cases appear among them, often involving banners without a real reject option or cookies set before any choice. The amounts and outcomes vary by case, so the useful lesson is the pattern of findings rather than any figure: missing reject options, pre-consent tracking and unclear information are the issues that come up again and again.

A Spain-Ready Banner Checklist

1. Accept and reject offered at the same level in the first layer.
2. No cookies beyond strictly necessary ones before a choice.
3. Clear first-layer summary in Spanish, with a link to details.
4. Granular controls by purpose in the second layer.
5. Withdrawal available from every page.
6. Consent renewed within a defined period, recommended at no more than 24 months.
7. Cookie policy aligned with the tags actually loaded.

Key Takeaways

• Spain’s cookie rule is LSSI Article 22.2; the AEPD enforces it alongside the GDPR.
• The AEPD guide, updated in July 2023, expects reject to be as easy as accept in the first layer.
• Browsing or closing the banner is not consent.
• The guide recommends renewing consent at least every 24 months.
• Conditional access models need careful, case-specific legal review.