Cookies and consent in online stores: how to comply with GDPR and LSSICE

Cookies and other storage devices in the browser remain the principal point at which an ecommerce site earns — or loses — the trust of its visitors. They are also the front on which the AEPD (the Spanish Data Protection Authority) has issued the most concrete guidance in recent years, to the point that today placing a banner is no longer enough: what it says, how it looks, what it blocks and how it is renewed all matter.

This guide explains how to configure cookie consent for an online store in line with Art. 22.2 LSSICE (Spain's Law 34/2002 on Information Society Services), the GDPR (Regulation (EU) 2016/679) and the current AEPD Guide on the use of cookies, with emphasis on the aspects that most affect day-to-day practice: visual parity between accept and reject, management of social media pixels, consent expiry period and maintenance of the reconfiguration link.

Regulatory framework: two laws that apply at the same time

A frequent mistake in the sector is to think that cookies are governed solely by the GDPR. In reality, two regulatory frameworks converge on the same operation, with different legal bases and purposes:

• Art. 22.2 LSSICE: regulates the use of storage and retrieval devices on the user's equipment. It requires prior, informed and specific consent before installing any device that is not strictly necessary to provide the service the user has requested.
• GDPR: regulates the processing of personal data obtained through those cookies (behavioural profiles, unique identifiers, conversion metrics). When the device makes it possible to identify a natural person — directly or by aggregation — the GDPR applies to the resulting data with all of its consequences: legal basis, duty to inform, data subject rights, international transfers where relevant.

Cookie consent serves simultaneously as the basis under LSSICE and, when there is processing of personal data, as the legal basis under the GDPR via Art. 6(1)(a). It must therefore meet the strictest requirements of both regulations: freely given, specific, informed, unambiguous and granted by means of a statement or clear affirmative action.

Types of cookies and the regime for each

Not all cookies require consent. The operational classification followed by the AEPD distinguishes four categories with different treatment:

The exemption criterion for strictly necessary cookies is narrow: it only applies to those without which the service requested by the user could not be provided. The shopping cart fits; analytics to improve the business does not, even if it appears anonymous.

What the cookie banner should look like

The banner is the visible piece that activates consent. The AEPD has developed in its Guide a series of requirements whose breach has triggered repeated sanctions. These are the points that any ecommerce site should review:

• Three real options on the first level: accept all, reject all and configure by categories. It is not acceptable to offer only accept and configure and force users into the configurator in order to reject.
• Visual parity between accept and reject. Both buttons must have the same size, the same contrast and the same visual hierarchy. Rendering the accept button in a vivid colour and the reject button as a small grey link is considered a dark pattern that vitiates consent.
• Loading blocked by default for all non-essential cookies until the user makes a choice. Loading first and blocking afterwards is precisely the opposite of what LSSICE requires.
• Clear, summarised information in the banner itself: who is the controller, which purposes require cookies and a visible link to the full cookie policy.
• Granularity by category in the configurator: the user must be able to accept analytics and reject marketing, or vice versa, not just choose all or nothing.
• Continued browsing ≠ consent. Years ago this was considered acceptable; today it is a practice expressly rejected by the AEPD. Consent must be an affirmative action.
• Closing the banner without choosing is not consent either. If the user closes with the X, it must be understood as a rejection of non-essential cookies.

Meta, TikTok and Google Ads pixels: today's battleground

Art. 22.2 LSSICE is not limited to cookies in the strict sense. It covers any storage and retrieval device on the user's equipment, which includes tracking pixels, browser-property fingerprinting, identifiers in local storage and session storage, and SDKs that load these elements via tags on the site.

This means that an ecommerce site that fires the Meta pixel, the TikTok pixel or the Google Ads pixel from the first page load, without prior consent, is in breach of LSSICE, even if its consent manager "claims" to be properly configured for cookies. The critical point is to verify technically that:

• Before marketing is accepted, the pixels send no events and load no secondary scripts.
• If the user rejects, the pixels remain entirely inactive throughout the session.
• If the user changes their mind via the configuration link, activation/deactivation is also applied immediately without requiring a full page reload.

The usual way to comply is to integrate the consent manager with Google Tag Manager or another tag system that fires the pixels only when the user has expressly ticked the corresponding category. For services that do not use standard tags, the code must be manually wrapped in conditions that check the consent state.

Consent expiry and the permanent configuration link

Consent is not perpetual. The AEPD Guide recommends a reasonable period that should not exceed twenty-four months, after which consent must be requested again. In practice:

• If the user accepted more than twenty-four months ago and has not interacted with the settings since, the banner must be shown again.
• If they rejected, the record of that rejection must also be managed and, once the period has elapsed, they may be asked again, always respecting the user's freedom (without insisting on every visit).
• If they change their decision via the footer configuration link, the change is applied immediately and recorded.

The permanent configuration link in the website footer is mandatory. The user must be able to modify their decision at any time from an always-accessible point, without having to search in secondary menus. The typical link labelled "Configure cookies", "Cookie preferences" or "Manage cookies" fulfils this function.

Recording consent: the evidence many ecommerce sites do not have

Art. 7(1) GDPR requires the controller to be able to demonstrate that the data subject consented. In practice, this means maintaining a technical log that stores at least:

• Anonymous session identifier (it is not necessary to associate the consent with the user's name).
• Date and time of consent.
• Version of the banner and cookie policy that were displayed.
• Categories accepted and rejected.
• Source of consent: first banner level, configurator, footer link.

Without such a log, in the event of a complaint or inspection, there is no way to demonstrate that the visitor accepted. Most commercial consent managers on the market offer this log out of the box; bespoke developments must implement it explicitly.

Checklist before pushing the banner to production

• An up-to-date map of all cookies, pixels and SDKs loaded by the site, grouped by category.
• Real technical blocking by default of anything that is not strictly necessary, verified with network inspection tools.
• Banner with three parity options (accept, reject, configure) and free of dark patterns.
• Cookie policy linked from the banner and the footer, with a detailed table and a last-updated date.
• Permanent configuration link accessible from the footer of every page.
• Consent log with identifier, date, version and categories selected.
• Automatic renewal of consent after twenty-four months without further user action.
• Periodic verification that no new integration adds scripts without going through the consent manager.

Frequently asked questions

This content is for informational and educational purposes only and does not constitute legal advice. Applying the regulation to each specific case requires individual analysis. Regional sectoral regulations may extend or modify time limits and requirements.