← ALL REGULATIONS
Cookie consent in Spain, under the LSSI and the AEPD guide.
Spain requires consent before a site uses cookies that are not strictly necessary, under article 22.2 of the LSSI. The AEPD’s cookie guide sets out how to ask, and since its July 2023 update rejecting has to be offered at the same level as accepting, and be no harder.
LSSI at a glanceOpt-in before tracking
- Applies to
- Providers established in Spain, and providers outside the EU that target Spain specifically
- Cookie rule
- LSSI (Law 34/2002), article 22.2
- Enforced by
- AEPD, the Spanish Data Protection Agency
- Guidance
- AEPD cookie guide, updated July 2023 and May 2024
- Penalties
- Up to €30,000 for a breach of article 22.2, and €30,001 to €150,000 for a repeat within three years of a final decision
WHAT LSSI REQUIRES
What the AEPD’s guide asks of a Spanish cookie banner.
THE RULEConsent before anything not strictly necessaryArticle 22.2 exempts only storage for transmitting a communication, or what is strictly necessary for a service the visitor asked for. Settings the visitor chooses, such as language or currency, count as technical.
WITH KATLAIn GDPR mode, the cookie guard refuses every cookie outside the functional category until the visitor chooses, and deletes any that were set before it ran.
THE RULEReject at the same level as acceptThe July 2023 update adopted the EDPB’s guidelines on deceptive design: accepting and rejecting must be offered on the same layer, at the same level and with the same visibility. Sites had until 11 January 2024 to adapt.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULEA narrow exemption for audience measurementThe AEPD exempts analytics used only to produce anonymous statistics for the site itself, on the publisher’s behalf alone, with no cross-site tracking and no data passed to third parties. Analytics services that reuse the data for other purposes do not qualify.
WITH KATLAKatla treats analytics as a consent category. If your measurement meets the AEPD’s conditions, you can reclassify that cookie as functional in Katla.
THE RULERenew consent within 24 monthsThe AEPD considers it good practice for a consent to last no more than 24 months, with the visitor’s choice kept in the meantime so they are not asked on every visit.
WITH KATLAKatla stores a choice for 12 months, well inside the AEPD’s 24.
THE RULEWithdrawal at any timeVisitors must be able to withdraw their consent at any time, and the site has to tell them how.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
LSSI questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- What changed in the AEPD’s 2023 cookie guide?
- It adopted the EDPB’s guidelines on deceptive design patterns: accept and reject must be presented prominently and at the same level, with rejecting no harder than accepting. It also clarified that the alternative offered to a cookie wall need not be free. Sites had until 11 January 2024 to comply.
- Is a cookie wall allowed in Spain?
- Only with an alternative. The AEPD accepts that refusing cookies can block access if visitors are told and offered a genuinely equivalent way in without accepting cookies, which need not be free and must come from the same publisher.
- Do analytics cookies need consent in Spain?
- Usually. The AEPD exempts only audience measurement limited to anonymous statistics for the site itself, without cross-site tracking or sharing with third parties. A standard analytics setup that reuses the data does not qualify.
- Who fines cookie breaches in Spain?
- The AEPD. The LSSI gives it the power to sanction breaches of article 22.2, with fines up to €30,000, rising to €150,000 for a repeat within three years. It can also issue a warning and a deadline to fix things instead of opening proceedings.
- Can the banner be in Spanish?
- Yes. Katla’s banner and generated policies are available in Spanish, and the widget can follow the visitor’s browser language.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.