Cookies and online tracking: what Spanish websites must ask you

Key rules

• Consent first: Non-essential cookies must not be set until you have clearly agreed.
• Easy refusal: Rejecting must be as easy as accepting, with a button of similar prominence.
• Cookie renewal: A cookie choice should not be asked again more often than every 24 months, unless the cookies or purposes change.
• Scrolling: Scrolling or carrying on browsing is never valid consent.
• Complaints: Complain about private websites to the AEPD.

What a Spanish website must ask you

Spanish sites must get your informed consent before they set non-essential cookies. Refusing must be as easy as accepting. You can use that to say no to tracking.

Consent only counts if you give it freely and clearly, by an action such as clicking a button. Pre-ticked boxes, silence, scrolling and simply carrying on browsing do not count as consent.

Some cookies need no consent. These are the ones a site needs to work or to deliver something you asked for, such as login, shopping basket, security and load-balancing cookies.

What the first banner should show

The first layer of the banner should tell you:

• who runs the site
• what the cookies are for
• whether third parties are involved
• how to accept, reject and configure

There should be a "Reject all" button (or equivalent) at the same level and with similar prominence as "Accept all". Non-essential cookies must not be set before you choose. A settings panel should let you switch purposes on or off one by one.

Closing the banner with an X counts as a refusal only if the banner clearly says so. If it does not, choose reject yourself.

Changing your mind

Withdrawing consent must be as easy as giving it. Look for a permanent link or icon, usually in the footer, that reopens the settings.

A site should not ask for your choice again more often than every 24 months, unless the cookies or purposes change. This covers refusals too, so a site should not nag you on every visit.

"Accept or pay" walls

A site cannot simply block you until you accept non-essential cookies. It may offer a real alternative, such as the same service with a paid, tracking-free option. The price must be fair and the alternative must not be a burden. If there is no genuine alternative, your consent is not considered freely given.

Reducing tracking beyond banners

Banners only cover sites you visit. You can also:

• block third-party cookies in your browser
• use a browser with built-in tracking protection
• switch on Global Privacy Control or "Do Not Track". Sites are not legally bound to obey these.
• use a content blocker
• clear cookies and site data regularly
• limit the advertising ID on your phone

The checklist below sets out the steps.

If a site ignores the rules

Complain to the Spanish data protection agency, the AEPD. You can file through its online office with a digital certificate or Cl@ve, or by post or in person at a registry office. Describe the site and what happened, and attach screenshots. Contacting the site owner first is good practice but not required.

The regional agencies in Catalonia and the Basque Country only cover public bodies, so private websites go to the AEPD. If the site is based in another EU country, the AEPD may pass your complaint on to that country's authority.

Choosing between options

What do you choose when a Spanish website shows a cookie banner?

• Reject all: You want no tracking. The site must offer this button at the same level and with similar prominence as Accept all, and must not set non-essential cookies before you choose.

• Set your own preferences: You want some purposes, for example a site feature, but not advertising. Use the settings panel, which the site must provide, and switch on only what you want.

• Accept all: You are happy with every purpose listed and the third parties named on the banner. You can change this later from the permanent settings link.

Refusing must be as easy as accepting, and only essential cookies, such as login, shopping cart and security, can run without your consent. If the choice is not clear and equal, pick reject or the settings panel.

Timeline and deadlines

• Make your first choice on the banner, before any non-essential cookies are set: on your first visit to a site

• Reopen the cookie settings from the footer link or icon to change or withdraw your choice: at any time

• Your choice, including a refusal, should not be asked again on every visit; a new request should not come more than every 24 months: for up to 24 months after you choose

• Expect a new request if the cookies or their purposes change: earlier than 24 months, when the site changes what it uses

Checklist

• Look for a "Reject all" button on the first layer of the banner, at the same level and as prominent as "Accept all".

• Click reject, or open the settings panel and switch off every optional purpose, instead of just scrolling or carrying on browsing, which does not count as consent.

• Find the permanent link or icon, usually in the footer, that reopens the cookie settings so you can change or withdraw your choice.

• Turn on built-in tracking protection in a browser that offers it, such as Firefox, Brave or Safari, and switch on the Global Privacy Control signal.

• Install a content blocker such as uBlock Origin or Privacy Badger.

• Clear cookies and site data regularly, or set your browser to clear them when you close it.

• Reset or limit the advertising ID on your Android or iPhone.

Frequently asked questions

Can a website block me if I refuse non-essential cookies?

Usually only if it offers you a real alternative, such as the same content through a fairly priced paid subscription without tracking. If there is no genuine alternative, your consent is not considered freely given. A site that blocks you with no alternative is worth reporting.

Does closing the cookie banner with an X count as refusing?

It counts as refusing only if the banner clearly says that closing it means rejection. Otherwise a site cannot treat the X as consent. Use the Reject button or the settings panel if you want to be sure.

Do websites have to obey the Do Not Track or Global Privacy Control signal?

No, the Do Not Track signal is not legally binding, so a site can ignore it. Turn it on anyway as an extra layer, and still answer the banner or use your browser's blocking tools.

Who do I complain to about a website that ignores the cookie rules?

Complain to the AEPD, Spain's data protection agency, through its online office with a digital certificate or Cl@ve, or by post or in person at a registry. Describe the website and what happened, and attach screenshots.