Almost every corporate website loads more than its own code: analytics to measure visits, an embedded map, a video, social media buttons, campaign pixels. Each of those elements usually leaves a trace in the visitor's browser, and that is where the cookie policy and consent come into play. It is not a decorative formality: it is the layer of transparency that Spanish and European regulations require before a company can track the behaviour of those who visit its website.
This guide explains, for a company with its own website, what the cookie policy is, what its legal basis is, what types of cookies exist and which require consent, how the banner must look in accordance with the AEPD's Guide on the use of cookies and which mistakes recur most frequently. The approach is operational and without alarmism: understanding the logic of the rule in order to apply it well from the design stage, not to react out of fear.
What is the cookie policy?
The cookie policy is the informational document that describes all the storage and data-retrieval devices that a website uses on the user's equipment. It is one of the three legal pieces that usually accompany any site, alongside the legal notice and the privacy policy, and it fulfils its own function: to give the visitor clear information about what is installed in their browser, for what purpose, for how long and how they can manage or withdraw it.
It is worth separating two concepts that are often confused:
- The cookie policy is a static document, permanently accessible from a link in the website footer. It informs. It usually includes a table with each cookie identified.
- The cookie banner or notice is the interactive mechanism that appears on entering the website and collects the user's decision (accept, reject or configure) before installing the non-exempt cookies.
Both elements work together, but they respond to different obligations: the policy satisfies the duty to inform, and the banner implements consent. A website can have an impeccable cookie policy and still fail to comply if its banner loads analytics before the user has chosen.
This article addresses the cookie policy of any corporate website. If the specific case is an online shop, with its campaign pixels and its integration with Google Tag Manager, it is also worth reviewing the specific guide on cookies and consent on an online store.
Legal basis: art. 22.2 of the LSSICE and GDPR consent
A frequent error is to think that cookies are governed only by the GDPR. In reality, two regulatory frameworks converge on the same operation:
- Art. 22.2 of Law 34/2002 (LSSICE): it is the rule that specifically regulates the storage and data-retrieval devices on the user's equipment. It requires the service provider to have obtained the user's prior, informed and specific consent before installing any device that is not strictly necessary to provide the service expressly requested. Cookies fit here, but so do pixels, fingerprinting, identifiers in local storage or session storage and third-party SDKs.
- GDPR (Regulation (EU) 2016/679): it applies to the personal data obtained through those cookies when they allow a natural person to be identified, directly or indirectly. Consent relies on art. 6.1.a GDPR as the lawful basis for the processing, and it must meet the conditions of art. 7 GDPR and the definition of art. 4.11 GDPR: a freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or a clear affirmative action.
The practical consequence is that cookie consent has to meet the requirements of both rules at the same time. And as an interpretative reference, the Guide on the use of cookies of the Spanish Data Protection Agency (AEPD) translates those principles into concrete criteria on how the banner must look, how it is rejected, what can be loaded before consent and when it must be requested again. It is the reference the authority itself uses to assess whether an implementation is valid.
Types of cookies: which are exempt and which require consent
Not all cookies need consent. The dividing line is drawn by art. 22.2 LSSICE itself: only those strictly necessary to provide the service the user has requested are exempt. Everything else requires their prior consent. This is the usual operational classification:
| Category | Typical examples | Consent? |
|---|---|---|
| Strictly necessary technical | Session, authentication after login, security, load balancing, requested media player, language selector, consent management. | No (exempt) |
| Preferences / personalisation | Light/dark mode, region or language chosen voluntarily, remembering form data without profiling. | Yes (except in limited cases) |
| Analytics / measurement | Google Analytics, Matomo in standard mode, Hotjar, Microsoft Clarity, heatmaps. | Yes |
| Marketing / behavioural advertising | Meta pixel, TikTok pixel, Google Ads, retargeting, advertising fingerprinting, social buttons that track. | Yes (always) |
The point that generates the most confusion is analytics. Even if the controller perceives it as harmless or even essential for its business, it is not strictly necessary to provide the service the user has requested (reading a page, filling in a form). That is why, except in very specific cases of first-party aggregated measurement under strict conditions, analytics requires prior consent. The art. 22.2 exemption is interpreted strictly: it refers to what is essential for the requested service, not to what is convenient for the company.
How the consent banner must look under the AEPD Guide
The banner is the piece where valid consent is implemented —or lost. The AEPD's Guide on the use of cookies develops a series of criteria whose breach has been reproached repeatedly. These are the ones any company should verify on its website:
Accept and reject, on equal terms
The action of rejecting must be as simple as that of accepting. The first level of the banner must allow accepting all, rejecting all and configuring by category, without forcing the user to enter the configurator in order to be able to say no. Painting the accept button in a prominent colour and leaving rejection as a grey link of smaller size is considered a deceptive pattern (dark pattern) that vitiates the free consent of art. 4.11 GDPR.
Granularity by category
The user must be able to accept some purposes and reject others: for example, to admit analytics and reject marketing, or the other way around. An all-or-nothing banner, without configuration by category, does not respect the specificity of consent.
No abusive cookie walls
Cookie walls that block access to the content unless the user accepts all cookies vitiate the freedom of consent. The Guide admits equivalent access alternatives only in very limited scenarios and under strict conditions; not as a general formula to force acceptance. A consent obtained under the threat of not being allowed to browse is not valid.
Consent by affirmative action
Continuing to browse is not consenting. The practice of understanding that continuing on the website amounts to acceptance was ruled out: consent requires a clear affirmative action. Likewise, closing the banner without choosing cannot be interpreted as acceptance either; in the absence of a decision, the non-exempt cookies must remain blocked.
Withdraw consent with the same ease
The user must be able to change or withdraw their decision at any time with the same ease with which they gave it (art. 7.3 GDPR). This is resolved with a permanent link in the website footer —something like "Configure cookies" or "Cookie preferences"— always accessible, without hiding it in secondary menus.
What the cookie policy must include
The cookie policy, as a document, has to offer the user the information needed to understand and control what happens in their browser. A reasonable minimum content includes:
- What a cookie is and other storage devices, in accessible language.
- Who the owner of the website and person responsible for the use of cookies is, and who the third parties are that install cookies through the site (analytics, advertising, social media).
- Detailed cookie table: each cookie identified by its technical name, its owner (first-party or third-party), its purpose, its duration and its type (session or persistent).
- Categories and purposes: grouping by necessary technical, preferences, analytics and marketing, explaining what each group is for.
- Legal basis: consent for the non-exempt ones; technical necessity for the strictly necessary ones.
- International transfers, when a third party (for example, a provider with servers outside the EU) processes data outside the European Economic Area, indicating the applicable safeguard.
- How to manage, accept, reject or delete cookies: from the website's own configuration panel and from the browser settings.
- Date of last update of the document and of the cookie list.
A detail that is often neglected: the table must also include the pixels, SDKs and fingerprinting techniques, not just cookies in the strict sense. Art. 22.2 LSSICE speaks of any storage and data-retrieval device, not only those formally called "cookies".
Common mistakes that turn a correct banner into a breach
Most problems are not in the text of the policy, but in the technical behaviour of the website. These are the failures that recur most:
- Loading cookies before consent. This is the most common and the most serious error: analytics, the Meta pixel or the embedded map fire on the first page load, before the user has touched the banner. The principle is the opposite: blocking by default of everything non-exempt until the user chooses.
- Hidden rejection. A visible and eye-catching accept button; rejection relegated to a small link or available only after entering "configure".
- A merely informational banner. Notices of the type "we use cookies, if you keep browsing you accept them" that offer no real rejection option. They do not collect valid consent.
- An outdated cookie policy. The table does not match the cookies the website actually loads, because new integrations were added without reviewing the document or the consent manager.
- Not being able to withdraw consent. The permanent configuration link in the footer is missing, so those who accepted have no simple way to change their mind.
- Not keeping proof. Art. 7.1 GDPR requires the controller to be able to demonstrate that the user consented. Without a record of consent (session identifier, date, banner version and categories ticked), there is no way to prove it in the face of a complaint.
Many of these failures originate in the design and development phase of the website: where the third-party scripts are loaded, whether the consent manager really blocks before the click, whether new integrations pass through it. Fixing it with the website already published costs more than anticipating it from the start; that is why it is worth integrating the cookie layer into the site's own architecture, as detailed in the checklist of legal requirements for a website.
"Most of the cookie banners we see do not fail because of what they say, but because of what they do before the user says anything. The text is correct and, meanwhile, the analytics has already loaded. Consent is not a screen that is shown: it is a decision that is respected."
Mario P. Talamillo · Managing Partner, Certix®
Checklist of a compliant cookie policy and banner
- An up-to-date map of all the cookies, pixels and SDKs the website loads, grouped by category.
- Real blocking by default of everything that is not strictly necessary, verified with network inspection tools.
- A banner with three options at the first level: accept all, reject all and configure by category.
- Visual parity between accept and reject, without deceptive patterns.
- A configurator with real granularity by category (accept some, reject others).
- No cookie walls that make access conditional on accepting everything.
- Neither "continuing to browse" nor closing the notice is interpreted as acceptance.
- A permanent configuration link in the footer of every page to modify or withdraw consent.
- A cookie policy with a detailed table (name, owner, purpose, duration) and update date.
- A record of consent as proof: identifier, date, banner version and categories ticked.
- Renewal of consent after a reasonable period without a new expression of the user's wishes.
Frequently asked questions
What is the cookie policy and how does it differ from the consent banner?
The cookie policy is a permanent informational document, accessible from the website footer, that describes what cookies the site uses, who they belong to, what they are for, how long they last and how to manage them. The banner is the interactive mechanism that collects the user's decision (accept, reject or configure) before installing the non-exempt cookies. The policy informs; the banner collects consent. A compliant website needs both pieces: art. 22.2 LSSICE requires informing and obtaining consent, and the AEPD Guide details how to do it.
Which cookies can my website use without asking for consent?
Only those strictly necessary to provide the service the user has requested: session cookies, authentication cookies after logging in, security cookies, load-balancing cookies or those of the consent manager. Art. 22.2 LSSICE exempts only these. Analytics, advertising, retargeting and commercial personalisation do not fall within the exemption —which is interpreted strictly— and require the user's prior consent before being installed.
Can the banner have only an Accept button?
No. The AEPD's Guide on the use of cookies requires that rejecting be as easy as accepting. The first level of the banner must offer accepting all, rejecting all and configuring by category, with visual parity between accept and reject. A banner with only Accept, or with rejection hidden under a small link, does not meet the requirement of free consent under art. 4.11 GDPR. In addition, until the user chooses, the non-exempt cookies cannot be loaded.
Can I make access to the website conditional on the user accepting cookies?
As a general rule, no. Cookie walls that prevent access to the content unless all cookies are accepted vitiate the freedom of consent, which must be freely given under arts. 4.11 and 7 GDPR. The AEPD's Guide admits equivalent access alternatives only in very limited scenarios and under strict conditions, not as a general formula to force acceptance.
References and resources to go deeper
- Complete guide to the LSSICE (Law 34/2002)
- Legal requirements for a website in Spain: GDPR, LSSICE and checklist
- Cookies and consent on an online store compliant with the GDPR and the LSSICE
- Certix data protection consultancy
Does your website's cookie policy reflect what your website really does?
At Certix we review your website's consent with a data protection expert. No commercial intermediaries, no generic templates.
Speak to an expertThis content is purely informational and educational; it does not constitute specialised legal advice in any case. The application of the regulations to each specific case requires individual analysis.