Cookie consent in Spain: LSSI Article 22.2 and the AEPD guide

What is the Spanish cookie law?

Spain transposed Article 5(3) of the ePrivacy Directive in Article 22.2 of Ley 34/2002 on information society services and e-commerce, known as the LSSI. It allows service providers to use devices that store and retrieve data on users' terminal equipment only if the users have consented after receiving clear and complete information about their use, in particular their purposes, in line with data protection law. Technical storage or access needed only to transmit a communication, and what is strictly necessary to provide a service the user expressly requested, are exempt.

The LSSI says consent can be expressed through browser settings where technically possible. The AEPD reads this narrowly: a browser setting only counts if it lets users consent in the way the GDPR requires, separately for each purpose and knowing who the controllers are, which ordinary browser settings do not.

The Agencia Española de Protección de Datos explains its reading in the Guía sobre el uso de las cookies, revised in 2019 after the GDPR, again after the EDPB's consent guidelines of May 2020, and since then to follow the EDPB's cookie banner task force report. The update announced on 11 July 2023 aligned the guide with the EDPB's Guidelines 03/2022 on deceptive design patterns and gave sites until 11 January 2024 to adapt. The current edition is dated May 2024 and adds a section on pay or consent models.

What must a cookie banner do in Spain?

The guide describes a first layer that names the publisher, explains the purposes of the cookies, says whether third parties use them, and lets the visitor accept, configure or reject. The points that matter most:

• Reject on the first layer. The option to reject must be offered on the same layer and at the same level as the option to accept, using a similar mechanism. If accepting is a button, rejecting must be a button too. Highlighting Accept over Reject, or giving Reject a smaller or different font, is not allowed.
• Active consent. Continuing to browse, scrolling, or opening the second layer and the settings is not consent.
• Granular choice. The settings panel must allow choosing by purpose, with nothing pre-ticked.
• Easy withdrawal. Withdrawing consent must be as easy as giving it, for example through permanent access to the cookie settings.
• Changes. If the use of cookies changes after consent, the cookie policy must be updated and visitors given a new choice.

How long is consent valid in Spain?

The AEPD considers it good practice that consent to a given cookie lasts no longer than 24 months, and that the visitor's choice is kept during that period so they are not asked again on every visit. This is longer than the 6 months the French and Italian authorities point to; a site that serves both countries usually asks again after 6 months everywhere.

Are cookie walls allowed in Spain?

Only with an alternative. The guide says access to services must not depend on accepting cookies, so cookie walls without an alternative to consent are not allowed. A site may deny access to visitors who refuse if it informs them properly and offers another way to access the service without accepting cookies. That alternative does not have to be free, but both options must be genuinely equivalent and the alternative must come from the publisher itself, not from another company. The May 2024 edition notes that the EDPB's Opinion 8/2024 on pay or consent concerns large online platforms specifically.

Do analytics cookies need consent in Spain?

Not always. Since January 2024 the AEPD has a separate guide on cookies for audience measurement tools. Analytics cookies are exempt from consent under Article 22.2 if they are used only to measure the audience of the site or app, on behalf of the publisher alone, to produce anonymous statistics. They must not be cross-referenced with other processing, passed to third parties, or used to follow a person across sites or apps, which rules out any tool that uses the same identifier on several sites. The guide lists the measurements it considers strictly necessary: audience page by page, referrers, device and browser type, load times, time on page and bounce rate, clicks, and geographic area, aggregated by page and by day or hour.

The exempt cookies must be mentioned in the privacy policy, last no more than about 13 months without automatic extension, and the data must be kept 25 months at most. Tools whose providers reuse the data for their own purposes, such as Google Analytics in its usual setup, need consent. See analytics without consent.

How much are the fines in Spain?

Using cookies without the information or consent Article 22.2 requires is a minor infringement under Article 38.4 g) of the LSSI, fined up to 30,000 euros under Article 39.1 c). A repeat of the same infringement, declared by a final decision within the previous three years, becomes a serious infringement under Article 38.3 i), with fines from 30,001 to 150,000 euros. The AEPD imposes the sanctions for these infringements, and the amount is set per breach, so a company with several non-compliant sites can be fined several times.

Some AEPD decisions under Article 22.2:

The Techpump decision shows how the per-site calculation adds up. The AEPD also opens many proceedings that end with a warning or a smaller fine after a voluntary payment, which reduces the amount.

How does Cookiequiet fit Spanish rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all and Accept all sit side by side on the first layer with the same size and weight by default, and visitors whose browser asks for Spanish get the banner in Spanish. Every choice goes into a consent log with its date and banner version. Geo-targeting is free on every plan; see pricing.