Website legal texts in Spain: the checklist, and the cookie banner mistake

Almost every business website in Spain has legal texts. Almost none has them right. Not because they are missing, but because they were copied from a template in 2019, they name tools that are no longer in use, or they carry a cookie banner that looks correct and technically does nothing.

This is what the law actually asks for, with the official sources, plus the two mistakes I see most often when I review someone else's site.

The four texts, and what each one is for

Aviso legal (legal notice). Identifies who is behind the site: name or company name, NIF, address and a way to make contact. The LSSI requires it of any information society service provider, and that includes a corporate site that sells nothing online.

Privacy policy. Explains what data you collect, why, on what legal basis, how long you keep it, and how to exercise access, rectification and erasure rights. If you have a contact form, you collect personal data, and you need this page.

Cookie policy. Details which cookies your site sets, of what type, how long they last and who places them. This is where almost everyone fails, and we get to it in the next section.

Terms and conditions of sale. Only if you sell online. Prices, payment methods, delivery times, right of withdrawal and returns policy.

Your cookie policy has to describe your site, not a generic one

The most common failure is not a missing page. It is a page that no longer matches what the site actually does.

I have seen it on other people's sites and I had it on my own: a policy saying that "in the future we may implement Google Analytics" while Google Analytics had been running for months. The page existed, it was well written, and it was false.

Your cookie policy has to name the cookies you set, with their real technical names, their duration and their purpose. If you use Google Analytics, _ga and _ga_XXXXXXXXXX appear. If you run Google Ads with auto-tagging, _gcl_au appears. If you use a heatmap tool, its own cookies appear. A table with those names is what separates a real policy from a template.

Quick check: open your site in a private window, reject cookies, open developer tools and look at what cookies are there. If any analytics or advertising cookie shows up, your banner is not doing its job.

What the AEPD requires of the banner

The Spanish Data Protection Agency is explicit in its cookie guidance, and these are two rules that get broken constantly:

• Accept and reject are offered at the same time, at the same level and with the same visibility. A big "Accept" button with a small "Configure" link tucked underneath does not comply.
• Rejecting cannot be harder than accepting. If accepting is one click and rejecting is three screens, the consent is not valid.

The information is given before the cookies are installed, in a visible format, and it stays up until the person decides. Technical cookies strictly necessary for the site to work are exempt under article 22.2 of the LSSI, so none of this applies to them.

The technical mistake that leaves your banner with no effect

This is the one that appears in no agency guide, because it is a code problem rather than a legal one.

Many sites implement Google Consent Mode v2, which is the correct way for Google Analytics and Google Ads to respect the user's decision. The pattern Google documents is this:

function gtag(){dataLayer.push(arguments);}
gtag('consent', 'update', { analytics_storage: 'granted' });

What matters is that gtag() pushes the arguments object. If a plain array is pushed instead, Google silently ignores it. There is no console error, the banner closes, the visitor believes they accepted, and every signal stays at denied.

I had exactly this on solidaweb.com. The symptom that exposed it was the Google Tag Manager container diagnostic: "0% consent rate detected", with 100% of signals marked denied even though the acceptance was being stored correctly in the browser. The banner worked for the user and communicated nothing to Google.

How to check your own site: accept cookies, open the console and run dataLayer. The consent entries should appear as [object Arguments]. If they appear as [object Array], you have the same problem.

Does Google Analytics need consent in Spain?

There is a widespread confusion here: many people assume analytics cookies are exempt. It depends, and in practice they almost never are.

The AEPD publishes specific guidance for audience-measurement tools. The conditions for the exemption are cumulative: all of them have to hold at once. Among them, that the data is not transmitted to third parties and that it does not allow tracking a user across different websites. Any solution using the same identifier across several sites to cross-reference data falls outside.

Google Analytics 4 sends data to Google, which is a third party, and works with identifiers Google uses at scale. Reading the guidance as it stands, the prudent approach is to treat it as a cookie that does require consent, which is what we do here. A self-hosted analytics tool, with no third-party transfer and no cross-site tracking, is a different conversation.

Checklist before you publish

1. Legal notice with full identification and NIF.
2. Privacy policy naming the legal basis for each processing purpose.
3. Cookie policy with a table of the cookies you actually set, not the ones you plan to.
4. Banner with accept and reject at the same level and the same visibility.
5. Terms and conditions if you sell online.
6. Private-window test: reject, then confirm no analytics or advertising cookie is set.
7. Technical test: consent signals reach Google as arguments, not as an array.

Points 6 and 7 are what separate a site that looks compliant from one that is. And they are free: five minutes with the browser open.

If you want the rest of the compliance picture for a local business, Google's 2026 review rules cover the other half.

Sources

• AEPD, Guía sobre el uso de las cookies, May 2024 edition, aligned with European Data Protection Board guidelines (aepd.es/guias/guia-cookies.pdf), checked September 2026 [T1]
• AEPD, Guidance on cookies for audience-measurement tools (aepd.es/guias/guia-cookies-analiticas-externas.pdf), checked September 2026 [T1]
• BOE, Law 34/2002 on Information Society Services and Electronic Commerce, article 22.2, consolidated text [T1]
• Google, Consent Mode and the gtag.js consent API (developers.google.com), checked September 2026 [T1]