ES EU member state
Cookie consent rules in Spain
What LSSI art. 22.2 and the AEPD expect from your cookie banner: when you need consent, how the reject option should look, and what has been enforced.
Sources checked 28 October 2026. Not legal advice.
Cookie law
Ley 34/2002 de servicios de la sociedad de la información y de comercio electrónico (LSSI), Article 22(2)
Official guidance
Banner languages
Spanish, Catalan, Galician, Basque
Asking again
The AEPD recommends that cookie consent stays valid for no more than 24 months.
What the rules say
- 'Accept' and 'reject' must be on the same layer with comparable prominence.
- Scrolling or continuing to browse isn't valid consent.
- Keep consent for at most 24 months before asking again.
- Non-exempt cookies must not be set before consent.
- You can't make access depend on accepting cookies unless you offer an alternative (which doesn't have to be free).
How PrivacyPill handles this
- Nothing optional runs before a choice. Google tags start with Consent Mode v2 set to denied; other scripts marked with data-pp-category wait until their category is allowed.
- Equal first-layer buttons. "Accept all" and "Reject non-essential" sit side by side with the same weight, and a settings button lets visitors withdraw consent at any time.
- Consent per purpose. Analytics, marketing and functional cookies can be allowed separately in the preferences panel.
- Ask again after 24 months. Set "Remember the choice for" in the customizer to 720 days or less.
- Languages. The banner ships in Spanish. Catalan, Galician, Basque aren't built in yet — rewrite the English texts in the customizer to show your own translation.
- Proof of consent. Every choice is logged pseudonymously with the banner version, exportable as CSV.
Frequently asked questions
Sources
This page summarises official sources checked on 28 October 2026. It isn't legal advice; regulators update guidance, so follow the links for the current text.