Cookie Policy Spain (Política de Cookies)

A Cookie Policy Spain (Política de Cookies) is a mandatory legal disclosure document that explains to users of a website or mobile application which cookies and similar tracking technologies the site deploys, the purposes for which they are used, the third parties who may access the data collected, and how users can consent to or refuse cookies — governed principally by Article 22.2 of the Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI), which transposes Article 5(3) of the ePrivacy Directive 2002/58/CE into Spanish law, and by the Reglamento (UE) 2016/679 General de Protección de Datos (RGPD) and its Spanish implementing statute, the Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales (LOPDGDD).

Article 22.2 LSSI establishes the core rule: service providers may only store or access terminal equipment (including cookies) after obtaining the user's informed consent, except for cookies that are strictly necessary for the provision of a service expressly requested by the user (exempted technical cookies). The Agencia Española de Protección de Datos (AEPD) is the supervisory authority responsible for enforcing cookie compliance in Spain, and has published detailed guidelines — including the Guía sobre el uso de las cookies (2019, updated 2021) — setting out the standard of consent required and the information that must be provided.

The AEPD's Guía sobre el uso de las cookies establishes that valid consent for non-essential cookies must be: freely given (libre) — not conditioned on access to the service; specific (específico) — granted separately for each purpose and category of cookie; informed (informado) — given after the user has received clear and accessible information about the cookies; and unambiguous (inequívoco) — expressed through an affirmative act (a click or toggle), not through scrolling, continuing to browse, or pre-ticked boxes. This standard is stricter than the prior LSSI consent regime and aligns with the Tribunal de Justicia de la UE ruling in Planet49 (Case C-673/17, 1 October 2019).

Spanish cookie law distinguishes between cookies by purpose — technical cookies (técnicas), personalisation cookies (de personalización), analytical cookies (de análisis), advertising cookies (publicitarias), and social media cookies (de redes sociales) — and by duration — session cookies (de sesión) that expire when the browser is closed, and persistent cookies (persistentes) that remain for a defined period. The Política de Cookies must describe each category deployed on the site, name the specific cookies in each category (or at minimum provide a table of cookies), state their duration, and identify the responsible entity (whether first-party or third-party, such as Google Analytics, Meta Pixel, or LinkedIn Insight Tag).

Since 2021, the AEPD and the European Data Protection Board (EDPB) have treated Google Analytics as a cookie that transfers personal data to the United States, raising adequacy concerns following the Schrems II decision (Data Protection Commissioner v Facebook Ireland, Case C-311/18, 16 July 2020). The AEPD has issued warnings to Spanish websites using Google Analytics without adequate transfer safeguards. A Política de Cookies for Spanish websites must address international data transfers (transferencias internacionales de datos) and the legal basis for such transfers — whether under EU Standard Contractual Clauses (cláusulas contractuales tipo) approved by Decisión de Ejecución (UE) 2021/914, or under the EU-US Data Privacy Framework adopted in 2023.

A Cookie Policy Spain is legally required for any website or mobile application that uses cookies or similar tracking technologies and is accessible to users in Spain or the European Union.

A Política de Cookies is required for any e-commerce website (tienda online) operating under the Ley 34/2002 LSSI — whether selling goods, digital products, or services — that uses session cookies for cart management, analytical cookies for traffic measurement, or advertising cookies for remarketing campaigns.

The policy is required for any corporate website (web corporativa) of a Spanish sociedad limitada, sociedad anónima, or autónomo that deploys analytics tools such as Google Analytics, Adobe Analytics, or Matomo, or social media plugins connecting to platforms such as LinkedIn, Facebook, Twitter, or Instagram.

A Política de Cookies is needed for software-as-a-service (SaaS) platforms, mobile applications, and web portals that use cookies for session management, user authentication, A/B testing, or personalisation — even where the primary users are business customers (B2B), since the RGPD and LSSI apply whenever personal data of natural persons is processed.

The policy is required when a website uses third-party advertising networks — including Google Ads, Meta Ads, or programmatic advertising platforms — that deploy third-party cookies for interest-based targeting, conversion tracking, or cross-site audience building.

A Política de Cookies update is needed when a website adds new cookies, changes analytics providers, updates cookie durations, or changes the consent management platform (CMP) it uses — the AEPD expects the policy to reflect the current actual cookie deployment at all times, and outdated policies may be treated as non-compliant disclosures.

Parties in Spain should prepare a Cookie Policy Spain (Política de Cookies) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid Cookie Policy Spain under LSSI Article 22.2 and RGPD must contain the following essential elements to satisfy AEPD enforcement standards and avoid administrative sanctions.

Definition of Cookies: A clear explanation of what cookies are — small files stored on the user's terminal device (ordenador, tablet, teléfono móvil) by websites visited — and how they work, suitable for non-technical users as required by the RGPD transparency principle (Article 5.1(a) RGPD and Article 13 RGPD).

Cookie Table: A thorough table listing each cookie deployed on the website, specifying: cookie name, purpose, category, duration (session or persistent with exact expiry), and the entity responsible (first-party or named third-party provider). The AEPD Guía requires that the policy enable users to understand exactly which cookies are active on the site.

Cookie Categories: Clear categorisation of cookies by purpose, consistent with AEPD guidance: (1) Strictly necessary / technical cookies (cookies estrictamente necesarias / técnicas) — essential for the site to function, exempt from consent; (2) Functional / personalisation cookies (cookies de preferencias / personalización) — remember user settings; (3) Analytical / measurement cookies (cookies analíticas) — collect aggregated traffic data; (4) Advertising / targeting cookies (cookies publicitarias / de seguimiento) — for interest-based advertising; (5) Social media cookies (cookies de redes sociales) — enable sharing and social login.

Consent Mechanism: Description of the consent management platform (CMP — plataforma de gestión del consentimiento) used, including how users grant, refuse, or withdraw consent for each category. Under AEPD guidance, the consent banner must offer a clear option to reject non-essential cookies with equal prominence to the accept option — 'reject all' must be as easy to access as 'accept all'.

Legal Basis: For each cookie category, the legal basis under Article 6 RGPD — consent (Article 6.1(a)) for non-essential cookies; legitimate interest (Article 6.1(f)) may apply in limited cases but requires a balancing test documented in the company's Registro de Actividades de Tratamiento under Article 30 RGPD.

Third-Party Cookies: Identification of each third-party cookie provider with a link to their privacy and cookie policy. For providers based outside the EU (e.g. Google, Meta, LinkedIn), the international data transfer mechanism must be stated — Standard Contractual Clauses (cláusulas contractuales tipo) adopted under EU Decision 2021/914, the EU-US Data Privacy Framework, or other appropriate safeguards under Article 46 RGPD.

User Rights: A statement of users' rights under Articles 15 to 22 RGPD — access, rectification, erasure, restriction, portability, and objection to processing — and the procedure for exercising them through the company's data protection contact. Forms-legal.com provides this Cookie Policy Spain template as a practical starting point. The AEPD recommends that Spanish websites conduct a cookie audit (auditoría de cookies) before publishing the policy to confirm it accurately reflects all cookies deployed.

Under Spanish data protection and digital services law, the Agencia Española de Protección de Datos (AEPD) enforces RGPD and LSSI obligations and may impose fines of up to €20 million or 4% of global annual turnover under RGPD Article 83. The LOPDGDD (Ley Orgánica 3/2018) supplements the RGPD in Spain. The ePrivacy Directive (Directiva 2002/58/CE) and its Spanish transposition govern electronic communications privacy.

Additional compliance elements for a Cookie Policy Spain (Política de Cookies) used in Spain include: Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255. Forms-legal.com provides this template as a starting point for Spain-compliant documentation.