What must an online store's cookie banner look like according to the Spanish data protection authority?
The banner is not legal decoration: if consent is invalid, none of the cookies installed are valid either. The basis is article 22.2 of the LSSICE and the Spanish authority's cookie guidance.
Short answer
- No non-essential cookie may be installed before the user gives consent.
- The reject button must appear on the first layer, with the same prominence as accept.
- Continuing to browse or scrolling is not valid consent.
- Users must be able to accept some categories and reject others, without digging into submenus.
- Withdrawing consent must be as easy as giving it, through a permanent link on the site.
What the first layer must offer
- An «Accept all» and a «Reject all» button with the same visual weight.
- Access to per-category settings: analytics, personalisation, advertising.
- Identification of the controller and a short explanation of what the cookies are used for.
- A link to the cookie policy listing the cookies and their retention periods.
Essential and non-essential cookies
What requires consent in a store
| Cookie | Purpose | Consent? |
|---|---|---|
| Shopping cart | Keep the added products | No |
| User session | Keep the user signed in | No |
| Analytics | Measure visits and behaviour | Yes |
| Advertising pixels | Remarketing and campaigns | Yes |
| Third-party videos and maps | Embedded content | Yes |
Common mistakes
- Loading analytics as the page opens and showing the banner afterwards.
- Styling «Accept» in colour and «Configure» in grey, with no direct reject option.
- Blocking access to the store for anyone who rejects non-essential cookies.
- Copying a generic cookie policy that does not match what is actually installed.
- Forgetting embedded videos and maps: they also install third-party cookies.
How 4shopy helps
- The store runs on technical cookies: the cart and checkout do not rely on trackers.
- Analytics and marketing tools are enabled by configuration, so you know exactly what is running.
- The cookie and privacy policies are dedicated pages, linked from the footer.
- Since third-party videos are not embedded by default, there are few cookies to declare.