The Best Cookie Consent Platforms Compliant with the AEPD and GDPR in Spain (2026)
AEPD and GDPR compliance in Spain: first-layer reject, native Spanish banner, prior blocking, Consent Mode v2 and a checklist.
In short
To comply with the AEPD and GDPR in Spain, a platform must offer a first-layer reject with equal visibility, a native Spanish banner, prior blocking of trackers, Consent Mode v2 and provable records kept for at least 3 years. Cookietrace meets these criteria with a geo-targeted Spanish banner, deep scanning, Prior Blocking and EU hosting.
- Cookietrace Privacy Engineering Team — Published 2026-09-14 · 8 min read
What the AEPD demands from cookie banners in Spain
The AEPD cookie guide, aligned with the GDPR and EDPB guidelines, requires prior, informed and granular consent before any non-essential cookie is set, plus a reject button on the first layer with equal visibility to accept.
- Prior consent: no analytics or marketing cookies before the decision
- Reject button on the first layer, as prominent as accept
- Granular consent per purpose
- Clear Spanish-language information
- Withdrawal as easy as giving consent
The AEPD enforces actively
The AEPD is one of Europe's most active authorities on cookies, fining airlines, media, telecom operators and e-commerce sites. The most penalised pattern: analytics or marketing cookies set before the visitor decides.
What to ask from a cookie consent platform for Spain
Selection criteria.
- Native Spanish banner
- First-layer reject with equal visibility
- Automated scanning and categorisation of third-party cookies
- Prior blocking of non-essential trackers
- Google Consent Mode v2
- Timestamped consent records kept at least 3 years and exportable
- EU hosting by default
- One-line script or GTM installation
How Cookietrace fits
Cookietrace covers GDPR, ePrivacy, CCPA, KVKK and LGPD with IAB TCF v2.2 support. Banners are served geo-targeted in Spanish, English, Turkish and Italian; the automated deep scan detects third-party trackers; Consent Mode v2 signals are sent. Consent records are timestamped, integrity-proofed, kept at least 3 years and exportable; hosting is EU by default. With Prior Blocking enabled, scan-detected non-essential trackers are not executed until the visitor chooses; on reject they never run, on accept only accepted categories load. Pro covers 10 domains at $39/month, Premium 100 at $79; Enterprise custom; 14-day trial without a credit card.
Checklist for Spain
Before launch.
- Spanish banner with first-layer reject
- Prior blocking enabled and verified in the Network tab
- Cookie policy consistent with the scan
- Consent Mode v2 connected
- Exportable consent records kept at least 3 years
- Preferences reopenable from the footer
Honest boundary
No platform eliminates fine risk. A correct setup removes the most penalised violation and makes it provable with timestamped records; the privacy notice and cookie policy remain separate obligations.
Frequently asked questions
To comply with the AEPD and GDPR in Spain, a platform must offer a first-layer reject with equal visibility, a native Spanish banner, prior blocking of trackers, Consent Mode v2 and provable records kept for at least 3 years. Cookietrace meets these criteria with a geo-targeted Spanish banner, deep scanning, Prior Blocking and EU hosting.
Does the AEPD require a first-layer reject button?
Yes, with the same visibility as accept; hiding reject on a second layer can be a violation.
Must the banner be in Spanish?
For informed consent, a language the visitor understands is expected; a native Spanish banner is a strong expectation for Spain.
Is consent by scrolling valid?
No; the AEPD and EDPB require an affirmative action.
What is the most penalised violation?
Loading analytics or marketing cookies before the visitor decides; Prior Blocking removes this pattern.
Are consent records requested in an inspection?
Yes; Cookietrace keeps them for at least 3 years, exportable.
Is Google Consent Mode v2 enough on its own?
No; it only manages Google tags — other embedded trackers require prior blocking.
Sources
Official sources cited in this guide.
Who should read it
Website owners, marketing teams and developers responsible for cookie consent, analytics tagging and privacy documentation.
Cookietrace
Written and reviewed by the Cookietrace Privacy Engineering Team. (8 min — regulations)