Cookies and consent: what the rules require and the most common mistakes on websites

The cookie banner is probably the most visible legal element on a website… and one of the worst applied. Two sets of rules sit behind it: Article 22(2) of Spanish Law 34/2002 (LSSI-CE), which regulates the use of cookies and similar technologies, and Regulation (EU) 2016/679 (GDPR), which defines what a valid consent looks like.

What counts as a “cookie” in legal terms

The rules are not limited to classic cookies: they cover any device that stores or retrieves information on the user’s equipment, such as local storage, tracking pixels, device identifiers or browser fingerprints. If your website stores or reads anything on a visitor’s terminal, you need to check whether consent is required.

Which cookies need consent and which do not

• Exempt (strictly necessary): those used for carrying out the transmission of a communication, or strictly necessary to provide a service the user has expressly requested: session, authentication, security, shopping basket, load balancing or remembering the language choice during the session.
• Prior consent required: analytics, non-essential personalisation, behavioural advertising, social networks and embedded videos that set third-party cookies.

The exemption is interpreted narrowly: a cookie being useful to you does not make it necessary for the user. And third-party analytics tools usually require consent.

What a valid consent looks like

The GDPR requires a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action (Art. 4(11)). Article 7 adds that you must be able to demonstrate it and that withdrawing it must be as easy as giving it.

The most common mistakes

1. Loading cookies before the user decides. If analytics or advertising scripts run as soon as the page opens, the banner is merely decorative.
2. Pre-ticked boxes or toggles switched on by default. Silence or inactivity is not consent.
3. Treating “keep browsing” or scrolling as acceptance. It is not an unambiguous affirmative action.
4. A prominent “Accept” button and a hidden reject option buried several clicks deep or in a tiny link. Rejecting must be as simple as accepting.
5. Generic or missing information: not saying which cookies are used, for what purpose, who sets them and how long they last.
6. Bundling every purpose into a single “Accept all” with no way to choose by category.
7. Making access to the site conditional on accepting without offering an equivalent alternative, which can undermine the freely given nature of consent.
8. No way to change your mind. Settings should be reachable at any time, for example through a permanent link in the footer.
9. Not keeping proof of consent (when, which version of the text, which choices).
10. An outdated cookie policy that does not match the cookies the site actually sets.

What your cookie policy should say

• What cookies are and which types your site uses.
• For each cookie (or family): name, owner (first or third party), purpose and duration.
• How to accept, reject or change your settings at any time.
• How to delete them from the browser.
• The link with your privacy policy when cookies involve processing personal data.

A quick check of your website

1. Open the site in a private window and, without accepting anything, look in the browser’s developer tools at which cookies and third-party requests are created.
2. Check that the reject button is as visible as the accept button.
3. Reject and verify that, after reloading, no non-exempt cookies are set.
4. Find the control for changing the choice and make sure it works.
5. Compare the real list of cookies with what your policy says.

Keep the text aligned with reality

A cookie policy changes every time you add a tool or a vendor. Managing it as a versioned document, with history, published from a single place — for example with LegalCloud — prevents the website text from falling behind what actually happens.

The AEPD publishes a specific guide on the use of cookies at aepd.es, and the European Data Protection Board has issued guidelines on consent at edpb.europa.eu. This article is for information only and is not a substitute for legal advice on your case.