Privacy

Cookies, GDPR, and how to keep measuring

There is a way out almost nobody mentions: if you do not use cookies that need consent, you do not need a banner. And you can still measure.

appnweb Published 18 August 2026 Reviewed 8 October 2026 6 min read

The short answer

In Spain you need consent for any cookie that is not strictly necessary to deliver the service the user asked for, and that consent has to be a clear affirmative action. In practice: rejecting must be as easy as accepting and must be in the first layer, nothing may load before the person decides, and continuing to browse is not consent. The cleanest alternative for a small business is not to use cookies that need consent at all: there is analytics that measures without them, and then the banner disappears.

What it actually requires

The Spanish rule that governs here is Article 22.2 of the LSSI, and the standard for what counts as consent comes from the GDPR. Between them they ask three things: that the person knows what is going to be installed and why, that they accept it by a clear act, and that they can decline just as easily.

That is where the daily errors come from. A banner with "Accept" on a large button and "Reject" hidden behind "Settings" does not comply, because it is not equally easy. Loading analytics before the person presses anything does not comply, because you already installed it. And a pre-ticked box has not complied for years.

Technical cookies — the session, the basket, the chosen language, load balancing — need no consent. They are the ones required for what the user asked for to work.

Reject in the first layer, as visible as accept
Nothing loads before the person decides
Continuing to browse is not consent
Withdrawing consent as easy as giving it

The way out almost nobody mentions

The obligation does not arise from measuring: it arises from storing or reading information on the person’s device. If you use an analytics tool that installs no cookies and creates no persistent identifier, there is nothing to consent to and no banner is needed.

For a small business that is usually the better deal in every respect. You avoid the banner, which irritates people and hurts both speed and CLS. You avoid the compliance folder. And you measure better, because you do not lose everybody who declines — and plenty decline.

What you lose is remarketing and demographic reports. If your business does not live on paid advertising, you probably were not using them anyway.

If you genuinely need cookies

There are cases where you do: paid campaigns with conversion tracking, a third-party chat widget, embedded video from a platform. Then the banner is mandatory and it is worth getting right first time.

The minimum is: two equally visible buttons in the first layer, a second layer by category where some can be accepted and others declined, nothing loading before the decision, a record of what each person consented to and when, and a permanent link to change their mind.

And it is worth consulting the cookie guidance published by the Spanish data protection authority before accepting a plugin as sufficient: several of the most popular ones ship default settings that do not meet the Spanish criteria, even where they meet other countries’.

Where the figures come from

Article 22.2 of the Spanish LSSI-CE requires user consent to store or retrieve information on their terminal equipment, except for what is strictly necessary to provide an expressly requested service.

Source Law 34/2002 on information society services (BOE)
Consent under the GDPR must be freely given, specific, informed and unambiguous, by a statement or a clear affirmative action.

Source Regulation (EU) 2016/679, Article 4(11) (EUR-Lex)

Related services

Compliance

Accessibility in e-commerce

Sectors

Keep reading

Web speed: what Google measures and what to fix
LCP, INP and CLS explained without jargon, with the five fixes that genuinely move the number.
Your online shop has to be accessible
What the EAA requires of e-commerce, who is genuinely exempt, and the eight fixes that cover most of it.
Local SEO for a neighbourhood business
The four things that decide whether you appear on the map, and the per-neighbourhood page trap that sinks whoever uses it.

Common questions

If your question isn’t here, write to us and we’ll answer it. Contact

Does Google Analytics need consent?

Yes, in its usual configuration, because it uses cookies and identifiers. There are reduced-collection modes, but the practical answer for a small business remains that installing it means needing a banner.

Can I block the site to anyone who declines?

So-called cookie walls are slippery ground and depend heavily on the specific case; the European position requires a genuine equivalent alternative. For a small business the risk is not worth it, and it frightens off visitors besides.

What happens if I use cookies with no banner?

It is a breach with penalties attached, and the usual route it arrives by is not an inspection but a complaint from a user or an advocacy organisation. It is not a theoretical risk.

How do I measure without cookies?

With analytics that counts visits and pages without identifying the visitor across sessions. You lose the ability to follow one person over time and gain the real number rather than the number of people who accepted. For deciding which pages work, that is more than enough.

Our sites carry no banner

We measure without cookies by default, so there is nothing to consent to. If your business needs tracked campaigns, we build the consent layer properly.

Or directly: hola@appnweb.site; Monday to Friday, 09:00 – 18:00 (CET)