Cookie fines in Spain: what the AEPD penalises and how to get a compliant banner in 2026

Setting analytics or advertising cookies without the user's consent can cost up to 30,000 euros per infringement in Spain. This is not a theoretical risk: every year the Agencia Española de Protección de Datos (AEPD, the Spanish data protection authority) fines websites and apps for banners that do not let users refuse, for pixels that fire before anyone clicks, and for cookie policies copied from another site. The good news is that almost every breach follows the same pattern and can be spotted in ten minutes. This guide explains what the law says, how much you could pay, which mistakes get penalised and how to check your own website. It applies to any business whose website or app targets users in Spain, wherever the company is based.

What the law says: article 22.2 LSSI

The key provision is art. 22.2 of Ley 34/2002 on information society services and e-commerce (LSSI), Spain's transposition of the ePrivacy Directive. It allows cookies and similar technologies (pixels, local storage, fingerprinting) only if the user has consented after receiving clear and complete information about their use and, in particular, their purposes, on the terms of the General Data Protection Regulation (GDPR). The only exception covers cookies that are strictly necessary to transmit the communication or to provide a service expressly requested by the user: the session cookie, the shopping cart, load balancing or the cookie that remembers whether the user accepted or refused.

Everything else (Google Analytics, the Meta pixel, Hotjar, Google Ads remarketing, embedded YouTube videos that drop third-party cookies) requires prior consent. And the authority that enforces this is the AEPD: art. 43.1 LSSI expressly gives it the power to sanction cookie infringements.

How much is the fine for cookies

Using cookies without having informed the user or obtained consent on the terms of art. 22.2 is a minor infringement (art. 38.4.g LSSI), punishable by a fine of up to 30,000 euros (art. 39.1.c LSSI). The exact amount depends on the criteria in art. 40 LSSI: intent, how long the infringement lasted, repeat offences, the number of users affected, the profits obtained and the company's turnover, among others.

Two nuances are worth knowing. The first works in your favour: the AEPD may issue a warning instead of opening sanctioning proceedings and set a deadline to fix the problem (art. 39 ter LSSI), and once proceedings are open, admitting liability and paying voluntarily each reduce the fine by at least 20%, and the reductions can be combined (art. 85 of Ley 39/2015). The Vueling case illustrates this: in 2019 the AEPD fined the airline 30,000 euros because its banner did not allow users to refuse cookies (proceeding PS/00300/2019), and the fine came down to 18,000 euros with both reductions.

The second works against you: the LSSI fine is not the whole risk. Cookies that identify the user process personal data, and if the legal basis, the information or the handling of that data is also deficient, the GDPR comes into play, with fines of up to 20 million euros or 4% of worldwide turnover (art. 83.5 GDPR). Failing to publish the website owner's identification details (art. 10.1 LSSI, the so-called legal notice or aviso legal) is a separate minor infringement (art. 38.4.b LSSI). A neglected website usually racks up several.

In practice, many fines imposed on SMEs and startups have stayed at a few thousand euros. But the real cost is usually elsewhere: proceedings almost always start with a complaint from a user or a competitor, require you to answer formal requests and rebuild the banner in a hurry, and the decision is published with the company's name.

What the AEPD has spelled out in its cookie guide

The LSSI says little about what the banner should look like. The AEPD has filled the gap in its Guide on the use of cookies, updated in July 2020 and July 2023 to align it with the European Data Protection Board's criteria. These are the points that matter most in an inspection.

Refusing must be as easy as accepting. Since the 2023 update (applicable from 11 January 2024), the accept and refuse options must be presented in a prominent place and format, at the same level. A big coloured "Accept" button with the refusal hidden in a grey link or on a second screen is no longer acceptable.

"Continue browsing" is not consent. Since the 2020 update the AEPD considers that continuing to browse is never a valid way of giving consent. Neither is scrolling or a pre-ticked box: a clear affirmative action is required.

Nothing loads before the click. Cookies that need consent cannot be set when the page opens. This is the most common failure: the banner is well designed, but Google Analytics or the Meta pixel fire anyway because the tags in the tag manager do not wait for the user's answer.

Cookie walls only with an alternative. Access may be made conditional on accepting cookies only if users who refuse are offered a genuine alternative, and in 2023 the AEPD clarified that the alternative does not have to be free (the "consent or pay" model adopted by some publishers).

Withdrawing consent must be just as easy. Users must be able to change their mind at any time as easily as they gave consent (art. 7.3 GDPR), which in practice means a permanent "Cookie settings" link, usually in the footer. The guide considers it good practice not to keep consent for more than 24 months without asking again.

The mistakes that get penalised most

Reading the AEPD's decisions of recent years, the same reasons keep coming up. Banners with no refuse button on the first layer, or with a "Settings" option leading to a screen where every box is already ticked. Analytics and advertising cookies set before any interaction, even when the user then refuses. Websites that force users to accept in order to browse (as reported in 2024, the Audiencia Nacional upheld the 30,000-euro fine imposed on Iberia for this reason). And generic cookie policies that do not say which cookies there are, who owns them, what they are for or how long they last.

One underlying mistake explains almost all the others: treating the banner as a plugin you install and forget. Every time marketing adds a new tag, a chat widget, a map or an embedded video, the website changes and the banner stops reflecting it. That is why websites that complied on day one often stop complying a few months later.

How to check your website in ten minutes

1. Open your website in an incognito window and do not touch the banner. Using the browser's developer tools (Application or Storage tab, Cookies section), see which cookies are there. If you find _ga, _fbp, _gcl_au, _hjSession or similar before accepting, you have a problem.

2. Click "Refuse" and reload the page. Analytics and advertising cookies should not appear. If they do, the banner is decorative.

3. Look at the banner's first layer. Accept and refuse must be visible, at the same level and with the same visual weight, alongside a short explanation of what you use cookies for and a link to the policy.

4. Open the cookie policy. It should list the cookies your website actually uses, with their owner (first or third party), purpose and duration, and explain how to withdraw consent.

5. Look for the link to change your mind. There must be permanent access to reopen the settings.

6. Check the tag manager. If you use Google Tag Manager, every tag that sets cookies must depend on consent (Google's consent mode helps, but it does not replace configuring each tag correctly).

If any of these steps fails, switching plugins is not enough: you need to inventory the cookies, adjust the banner and rewrite the policy so that it says what the website really does.

Cookies are only one part of your legal texts

A website that sells or generates leads in Spain also needs, besides the banner and the cookie policy, a legal notice with the details required by art. 10 LSSI, a privacy policy with the information required by art. 13 GDPR and, if it sells to consumers, terms of sale with the pre-contractual information and right of withdrawal required by consumer law. We explain this in detail in which legal texts your website needs and, for online shops, in GDPR for your ecommerce. Texts copied from another website have the same problem as a badly configured banner: they describe a website that is not yours.

If your product runs on data, the analysis starts earlier

For a corporate website, the banner and the legal texts are enough. But if your business model depends on user data (an app with third-party SDKs, an advertising or affiliate platform, a product that profiles users or uses artificial intelligence, a health or financial service), cookies are the visible symptom of a broader question: whether what you want to do with that data is lawful and on what conditions. That question is best answered before building the product rather than after the first formal request. That is what our legal viability report does, from 650 euros + VAT, and we explain it for AI products in legal viability of an AI project.

What may change

On 19 November 2025, as part of the package known as the Digital Omnibus, the European Commission proposed moving the cookie rules from the ePrivacy Directive into the GDPR and making it easier for users to express their preferences automatically through the browser. At the time of publication the proposal is still going through the legislative process, with no final text, and it may change substantially. In the meantime, what applies and is enforced in Spain is art. 22.2 LSSI with the AEPD criteria described above. We will update this guide if the proposal is adopted.

Frequently asked questions

What is the fine for not having a cookie banner in Spain?

If the website sets non-essential cookies without informing users or asking for consent, it is a minor infringement under art. 38.4.g LSSI, with a fine of up to 30,000 euros. If the website only uses technical or strictly necessary cookies, it does not need a banner, although it is advisable to explain them in the cookie policy.

Do Google Analytics cookies require consent?

Yes. The exemption in art. 22.2 LSSI only covers cookies that are strictly necessary to provide the service the user has requested, and analytics is not. That is why Google Analytics must load after the user accepts.

Is a free cookie plugin enough?

It can work as a tool, but it does not make you compliant on its own. It has to be configured so that it actually blocks cookies until consent, refusing is at the same level as accepting and the policy reflects the cookies your website uses. Most of the breaches we see happen with a plugin installed.

Who is liable if the cookie belongs to Google or Meta?

The website owner. The cookie may belong to a third party, but you decide to insert its code in your page and you must obtain consent before it is set.

Can I block access for users who refuse cookies?

Only if you offer them a genuine alternative to access the content without accepting, which according to the AEPD may be paid. A cookie wall with no alternative is not valid.

How we handle it at Sonav Legal

We review your website or app the way an inspector would: which cookies are set before and after consent, how the banner is configured and what your legal texts say. We then draft or correct the legal notice, privacy policy, cookie policy and terms so that they describe what your business really does, with a fixed fee agreed before we start. If you are launching in Spain, website legal texts are included in our startup packages from 1,250 euros.