Spain requires opt-in consent before a website stores or reads any cookie that is not strictly necessary. The rule is Article 22.2 of the LSSI-CE, and the Spanish Data Protection Agency (AEPD) spells out how to apply it in its cookie guide, last updated in May 2024: a reject button at the same level as accept on the first layer, choices by purpose, and consent kept for no longer than 24 months before you ask again. A breach of Article 22.2 is a minor offence with fines up to EUR 30,000, and a repeat within three years becomes a serious one.
How Spanish law regulates cookies
Spain's cookie rules sit at the intersection of three legal instruments. The LSSI-CE (Ley de Servicios de la Sociedad de la Informacion y de Comercio Electronico, Law 34/2002) is Spain's transposition of the EU ePrivacy Directive. Article 22.2 of the LSSI-CE requires informed consent before storing or accessing cookies on a user's device, unless the cookie is strictly necessary for delivering a service the user has requested.
The LOPDGDD (Ley Organica de Proteccion de Datos Personales y Garantia de los Derechos Digitales, Organic Law 3/2018) complements the GDPR at national level. It sets the domestic penalty framework and establishes the AEPD (Agencia Espanola de Proteccion de Datos) as Spain's supervisory authority.
The GDPR itself applies directly, meaning any processing of personal data through cookies must satisfy its conditions for valid consent under Article 7.
The AEPD cookie guide, May 2024 edition
The AEPD's Guia sobre el uso de las cookies has been revised several times. Its update of July 2023 adapted it to the EDPB Guidelines 03/2022 on deceptive design patterns and gave sites until 11 January 2024 to adapt. The May 2024 edition added the AEPD's reading of EDPB Opinion 8/2024 on consent-or-pay models. As of October 2026, the May 2024 edition is the version the AEPD publishes.
Key positions in the guide include a two-layer information model for cookie banners, a reject option at the same level as accept, consent controls by purpose, consent that lasts no longer than 24 months before it is requested again, and specific rules on cookie walls and pay-or-consent models.
The guide calls the 24-month limit good practice. Within that time, the site should keep the visitor's choice rather than ask again on every visit.
Two-layer banner model
The AEPD requires cookie information to be presented in two layers. The first layer appears in the banner itself and must contain the identity of the site owner, a summary of cookie purposes, information about third parties that set cookies, an accept button, a reject button of equal prominence, and a link to the second layer.
The second layer - typically a full cookie policy page - provides detailed information about every cookie: its name, provider, purpose, category, and duration. This is where you list specifics such as _ga, _fbp, or PHPSESSID.
Both accept and reject options must be presented on the first layer. The AEPD does not recognise scrolling, continued browsing, or closing the banner as valid consent. Only a clear, affirmative action counts.
Granular consent by category
The guide requires that users can accept or reject cookies by purpose - for instance, accepting analytics cookies while refusing marketing cookies. Pre-ticked boxes are not allowed. Each category must default to off until the user actively opts in.
Cookie walls and pay-or-consent in Spain
The AEPD permits cookie walls under narrow conditions. The user must be fully informed, and an alternative way to use the service without accepting non-essential cookies must exist, though it need not be free. The two options must be genuinely equivalent, and the alternative must come from the same publisher - redirecting users to a different site does not satisfy this requirement.
Following EDPB Opinion 8/2024, pay-or-consent models face additional scrutiny. The AEPD's updated guide warns that the paid alternative must be genuinely equivalent, and the price must not be so high that it effectively coerces consent.
Spanish cookie penalties at a glance
| Infringement type | Legal basis | Maximum fine |
|---|---|---|
| LSSI-CE violation (cookies without consent): minor offence | Articles 22.2, 38.4(g) and 39.1(c), LSSI-CE | Up to EUR 30,000 |
| Repeat of that minor offence within three years: serious offence | Articles 38.3(i) and 39.1(b), LSSI-CE | EUR 30,001 to EUR 150,000 |
| GDPR breach (lower tier) | Article 83(4), GDPR / LOPDGDD | EUR 10,000,000 or 2% global turnover |
| Serious GDPR breach (invalid consent) | Article 83(5), GDPR / LOPDGDD | EUR 20,000,000 or 4% global turnover |
Cookie-specific fines under the LSSI-CE tend to be lower than those issued under the GDPR. In a case opened on 18 September 2024 (PS/00284/2024), the AEPD proposed a EUR 20,000 fine on SEAT S.A. for cookies its website set without prior consent. SEAT took both 20% reductions the procedure allows, for acknowledging liability and paying early, and the case closed on a payment of EUR 12,000.
Where cookie activity also involves unlawful personal data processing - for example, sharing behavioural profiles without a valid legal basis - the AEPD can apply the higher GDPR penalty thresholds.
How Spain compares to other EU member states
Spain's approach shares common ground with other major EU markets but has its own distinct flavour. France's CNIL similarly mandates equal-prominence accept and reject buttons, and was the first to issue significant fines for cookie violations. Italy's Garante published detailed cookie guidelines in 2021 with a comparable two-layer model. Germany's TDDDG requires opt-in consent for non-essential cookies, though enforcement has historically focused on GDPR rather than cookie-specific rules.
Portugal is the other Iberian market, with its own transposition of the ePrivacy Directive and its own authority, the CNPD. Sites targeting both Spanish and Portuguese users should check each country's rules rather than assume the AEPD's positions apply next door.
A constant across all these jurisdictions: pre-ticked boxes and implied consent through continued browsing are invalid. The global compliance hub covers the other countries your visitors may come from.
Checklist for Spanish websites
Use this checklist to check your site against the AEPD guide.
No non-essential cookies fire before the user gives affirmative consent
The cookie banner shows accept and reject buttons with equal visual prominence on the first layer
Users can select or deselect cookie categories individually (analytics, marketing, functional)
A link to the full cookie policy (second layer) is visible in the banner
The cookie policy lists every cookie by name, provider, purpose, category, and duration
Consent is asked again after no more than 24 months, and cookie lifetimes match their purpose
Consent is re-requested when new cookie purposes are added
Consent records are stored as evidence of each choice
Users can withdraw consent at any time through a persistent settings link or button
If a cookie wall is used, an equivalent alternative exists from the same publisher
Running a cookie scan is the fastest way to identify every cookie and tracker on your site before configuring your banner.
Strictly necessary cookies: what is exempt
Article 22.2 of the LSSI-CE exempts cookies that are technically required to deliver a service the user has explicitly requested. Session cookies like PHPSESSID that maintain a shopping cart or login state fall into this category. A cookie that remembers a language, currency or font size the visitor chose is exempt too: the guide treats it as a user-interface customisation the visitor asked for. A cookie that sets the language or content automatically, from what the site has observed about the visitor, needs consent.
Load-balancing cookies and cookies that remember a user's consent choice are also typically exempt. Analytics cookies are not: the guide notes that first-party cookies used for aggregated, strictly statistical purposes carry little privacy risk, but it does not exempt them from consent.
Short answers on the AEPD rules
Does the AEPD require a reject button on cookie banners?
Yes. The AEPD's cookie guide requires the reject option on the first layer, at the same level and with the same visibility as the accept option. Hiding the reject option behind a settings menu does not meet the guide.
How long does cookie consent last in Spain?
The AEPD considers it good practice for consent to last no longer than 24 months, and for the site to keep the visitor's choice during that time instead of asking on every visit. Cookie lifetimes themselves should match their purpose.
Are analytics cookies exempt from consent in Spain?
No. The AEPD guide says first-party analytics cookies processing aggregated data for statistical purposes are low risk, but they are not exempt from consent. Standard analytics setups using _ga or similar cookies require consent.
Can I use a cookie wall on a Spanish website?
Cookie walls are permitted only if the user is fully informed and a genuinely equivalent alternative exists from the same publisher, which need not be free. Redirecting users elsewhere does not satisfy this condition.
What fines can the AEPD issue for cookie violations?
Under the LSSI-CE, a cookie breach is a minor offence with fines up to EUR 30,000, and a repeat within three years is a serious offence with fines from EUR 30,001 to EUR 150,000. Where cookies involve unlawful personal data processing, GDPR penalties of up to EUR 20 million or 4% of global turnover may apply.
Does scrolling count as cookie consent in Spain?
No. The AEPD explicitly rejects scrolling, continued browsing, and closing the banner as forms of valid consent. Only a clear affirmative action - such as clicking an accept button - qualifies.
Set up a two-layer banner for Spanish visitors
Scan your site, review the cookies, and publish a banner with Reject all beside Accept all on the first layer. Kukie.io applies the region rules you set, records each consent choice and blocks scripts until visitors agree.
