In short: Spanish law requires every website to obtain prior, informed consent before using cookies that are not strictly necessary, under article 22.2 of the LSSI read together with the GDPR and the LOPDGDD. It applies to service providers established in Spain and to non-EU providers that specifically target Spanish users. The AEPD enforces it actively, with fines of up to €30,000 per cookie infringement under the LSSI, more if the breach is repeated, and GDPR fines on top when personal data is processed unlawfully.
LOPDGDD: what is it?
The LOPDGDD is Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights. It came into force on 7 December 2018. Its purpose, as stated in article 1, is to adapt Spanish law to the GDPR and complete its provisions, and to guarantee citizens' digital rights. It does not replace the GDPR: the GDPR applies directly, and the LOPDGDD fills in the details that EU law leaves to member states.
For cookies, the key text is a different law. Article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI), in force since 12 October 2002 and amended several times since, is Spain's transposition of the ePrivacy cookie rule. It allows service providers to use "data storage and retrieval devices" on users' equipment only if users have given consent after receiving clear and complete information about their use, in particular about the purposes of the processing.
The article still refers to Spain's former data protection law of 1999. The AEPD explains in its cookie guide that this reference must now be read as pointing to the GDPR, applicable since 25 May 2018, and to the LOPDGDD. In practice, then, the Spanish cookie regime works in three layers:
- LSSI article 22.2 decides when consent is needed;
- the GDPR and the LOPDGDD define what valid consent is, and govern any personal data collected through cookies;
- the AEPD cookie guide, last updated in May 2024, explains how the AEPD applies all of this to banners.
Territorial scope. The LSSI applies to information society service providers established in Spain, and to services offered through a permanent establishment in Spain. Under article 4, providers established outside the EU and the EEA that specifically direct their services to Spain are also subject to its obligations. The LOPDGDD follows the GDPR's material scope and applies to automated processing of personal data.
Who does the LOPDGDD apply to?
In practice, Spanish cookie rules concern:
- companies, freelancers, associations and public bodies that run a website or app from Spain;
- non-EU businesses that target Spanish users, for example with a Spanish storefront, prices in euros for Spain or advertising aimed at Spain;
- anyone whose cookies process personal data of people in Spain, who must also respect the GDPR and the LOPDGDD.
The AEPD guide is broad about what counts as a cookie. Article 22.2 covers any device used to store or retrieve data on a user's terminal (computer, phone, tablet), including local shared objects, web beacons and fingerprinting techniques. It protects any "recipient" of the service, whether an individual or a company, using it for personal or professional reasons.
Cookies also become personal data processing when the user is identified, for example as a logged-in customer, or when unique identifiers such as an advertising ID make it possible to single out and track individual users. In that case, the GDPR and LOPDGDD apply in full.
What the LOPDGDD requires for cookies and consent
Prior consent for anything that is not strictly necessary
Spain follows an opt-in model. Consent is required before any non-exempt cookie is used, and the AEPD guide states that cookies may only be used once the user has the required information and has given consent.
Exempt cookies are those used only to carry a communication over a network, or strictly to provide a service the user has expressly requested. Following the former Article 29 Working Party, the AEPD lists examples such as user input cookies (forms, shopping cart), session authentication cookies, user security cookies, media player session cookies, load balancing cookies, user interface customisation cookies and certain social plug-in cookies for logged-in users. No information or consent is required for these, although the AEPD recommends mentioning them in general terms in your cookie policy.
Every other cookie needs consent, whether first or third party, session or persistent. That includes analytics cookies: the AEPD says they are not exempt, while noting that first-party cookies used only for aggregated statistics, with clear information and an easy way to refuse, are unlikely to pose a privacy risk.
What valid consent looks like
Article 6 of the LOPDGDD repeats the GDPR definition: consent is a free, specific, informed and unambiguous indication of wishes, given by a statement or a clear affirmative action. It adds that where consent covers several purposes, it must be clear that it is given for each of them. The AEPD guide applies this to cookies:
- continued browsing is not valid consent, and mere inactivity never counts as consent;
- pre-ticked options in favour of accepting cookies are never acceptable;
- saving the settings panel without selecting anything equals rejecting all cookies;
- for users under 14, consent must come from a parent or guardian (article 7 of the LOPDGDD), and the AEPD expects reasonable efforts to verify this.
Duration, withdrawal and proof
Duration. The AEPD considers it good practice for consent to a given cookie to last no more than 24 months, keeping the user's choices during that period. If the purposes or the third parties change, you must update your cookie policy and ask again.
Withdrawal. Users must be able to withdraw consent at any time, and doing so must be as easy as giving it. The AEPD considers this met when users have simple, permanent access to the cookie settings. Browser settings alone are not enough as a way to refuse or withdraw consent.
Proof. Under article 7(1) of the GDPR, when processing is based on consent, the controller must be able to demonstrate that the user consented. Keeping a consent log with the date, the choices made and the banner version is the practical way to meet that duty.
A LOPDGDD-compliant cookie banner
The AEPD guide is one of the most detailed in Europe on banner design. Our complete guide to cookie banners covers the general principles; here is what the AEPD specifically expects.
The first layer must be shown before cookies are used and stay visible until the user acts. It should include:
- the identity of the publisher (the brand is enough if full details appear elsewhere on the site);
- the purposes of the cookies, and whether they are first or third party;
- generic information on the data collected if profiles are built, for example for behavioural advertising;
- how to accept, configure and reject cookies;
- a clearly visible link to a second layer with more detail.
Buttons. The AEPD expects three mechanisms on the first layer:
- an easy-to-see "Accept" button for all cookies;
- a "Reject" button similar to the accept button (if you use a button to accept, you must use a button to reject);
- a clearly visible button or link that leads directly to a settings panel where cookies can be accepted or rejected at least by purpose.
The option to reject must be offered at the same time, at the same level and with the same visibility as the option to accept, without sending the user to another layer.
Prohibited practices. The AEPD says a banner must not give the impression that accepting cookies is mandatory to browse the site, must not clearly push the user towards accepting, and must not use colours or contrast that are obviously misleading, such as a reject button whose text cannot be read. Overly granular choices (cookie by cookie within the same purpose) should also be avoided. These are the same dark patterns European regulators target, as our article on dark patterns in consent banners explains.
Cookie walls. Cookie walls that offer no alternative to consent cannot be used. Refusing access is only possible if users are properly informed and offered a genuinely equivalent alternative way to access the service without accepting cookies, which need not be free. Our article on cookie walls and their alternatives goes into more detail.
Penalties and enforcement
The AEPD (Agencia Española de Protección de Datos) supervises the GDPR and the LOPDGDD under article 47 of the LOPDGDD. Under article 43.1 of the LSSI, it is also the authority that sanctions cookie infringements.
Under the LSSI:
- using cookies without the information or consent required by article 22.2 is a minor infringement (article 38.4.g), fined up to €30,000 (article 39);
- repeating that minor infringement, when declared by a final decision within the previous three years, is a serious infringement (article 38.3.i), fined from €30,001 to €150,000;
- the AEPD can apply a lower scale when the company has diligently fixed the problem or acknowledged its fault (article 39 bis), or issue a warning instead of opening proceedings (article 39 ter);
- fines are graded according to intent, duration, recidivism, harm, profits obtained and the turnover affected (article 40).
When cookies involve personal data, the GDPR sanction regime also applies. Infringing the conditions for valid consent is listed as a very serious infringement in article 72 of the LOPDGDD, and article 83(5) of the GDPR sets fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. For AEPD fines above €1 million against companies, article 76.4 of the LOPDGDD requires publication in the Official State Gazette (BOE).
Real cases published by the AEPD:
- Iberia, €30,000 (PS/00032/2020). After a complaint that the airline's website forced visitors to accept cookies to keep browsing, AEPD inspectors found that users could not continue without clicking "accept" or "cookie settings", so there was no way to reject cookies, that the second layer did not allow rejecting all cookies at once, and that third-party cookies and retention periods were not identified. The AEPD fined Iberia €30,000 for infringing article 22.2 of the LSSI. (AEPD resolution)
- Grupo Massimo Dutti, €5,000 (PS/00051/2023). The complaint described a first-layer banner with no "reject all" option, a settings link styled as plain text next to a prominent "accept all" button, and no way to withdraw consent once given. During its own check, the AEPD found that the first layer did not give clear and complete information on purposes and that there was no permanent access to the settings panel to withdraw consent. It imposed a €5,000 fine for a minor infringement of article 22.2. (AEPD resolution)
Both cases show the AEPD's priorities: an equal reject option, honest button design and easy withdrawal.
Compliance checklist
- Audit your site to list every cookie, pixel, local storage item and fingerprinting script, with its provider, purpose and lifetime.
- Separate exempt cookies (technical, session, load balancing, cart) from those that need consent, including analytics.
- Block non-exempt cookies until consent is given, and check that nothing fires on page load.
- Show a first layer with Accept, Reject and Settings, the reject button matching the accept button in format and visibility.
- Remove dark patterns: no pre-ticked boxes, no "continue browsing means accept", no low-contrast reject button.
- Offer a settings panel by purpose that users reach in one click, with clear descriptions in Spanish.
- Add a permanent way to withdraw consent, such as a link or icon on every page.
- Keep proof of consent (date, choices, banner version) so you can demonstrate it under GDPR article 7.
- Renew consent within 24 months, and sooner if purposes or third parties change.
- Update your cookie policy to name third parties, purposes and retention periods.
How FlowConsent helps you comply with the LOPDGDD
FlowConsent gives you a banner built for the AEPD's expectations: Accept, Reject and Settings on the first layer with equal prominence, categories by purpose, and nothing pre-ticked. Scripts are blocked before consent, so analytics and advertising tags only run once a visitor opts in, and Google Consent Mode v2 is built in. The automatic scan lists the cookies on your site, and every choice is stored as exportable proof of consent, as described in our documentation on the proof report. Setup takes about ten minutes, data is hosted in Europe, and the plan is free up to 25,000 sessions per month (Pro is €14.99 per month up to 100,000 sessions). Check your site with our free scanner, then create your account.
Further reading
The articles below go deeper into the points the AEPD looks at most closely. Start with the 7 conditions for valid consent, then read about cookie walls, dark patterns, proof of consent and how to configure Google Analytics so that it respects Spanish rules.