Cookies in 2026: AEPD guide, Consent Mode v2, lawful analytics

In 2026, having analytics on your website without breaking the law comes down to three rules: the banner must offer "Reject" at the same level as "Accept", no non-technical cookie may load before the person decides, and if you use Google Analytics or Ads you must pass that decision on through Consent Mode v2. What follows explains where each rule comes from, which cookies are exempt and how to set it up without losing the data you really need.

What the AEPD requires from the cookie banner

The reference in Spain is the Guide on the use of cookies by the Spanish Data Protection Agency (AEPD). Its last major update, on 11 July 2023, incorporated the European guidelines on deceptive design patterns and gave until 11 January 2024 to adapt. Since then, what the AEPD expects from your website is:

• Accept and reject in the same place, format and level. No giant green button to accept and a grey "configure" link to reject. The guide gives examples on colour, size and placement.
• Nothing loads before the decision. Except technical cookies, everything else (third-party analytics, advertising, social media, embedded videos with tracking) waits for consent.
• Continuing to browse is not consent. Scrolling or closing the banner without choosing does not count as acceptance.
• Granular choice. The person can accept analytics and reject advertising, and the site has to honour that for real, not just visually.
• Cookie walls only with an alternative. You may make access conditional on accepting cookies only if you inform the user and offer an alternative; the guide clarifies that the alternative does not have to be free, but it has to exist.
• Withdrawing consent must be as easy as giving it. A permanent link in the footer ("Cookie settings") is the usual way.

Which cookies need no permission

Technical cookies (session, cart, user-chosen language, security, load balancing) are exempt. Personalisation cookies are too when the choice is made by the user (for example, the language); if the website makes it based on user data, it already requires consent.

And analytics? Here is the nuance almost nobody gets right. In January 2024 the AEPD published a specific guide on audience-measurement cookies that allows using them without consent only if they meet all of these conditions: their purpose is limited to measuring the site's audience, the processing is done exclusively on behalf of the publisher, they only produce anonymous statistics, the data is not cross-referenced with other processing or passed to third parties, they do not allow tracking the person across different websites (nor using the same identifier on several) and the cookie's lifetime is limited. In plain terms: a first-party analytics tool, or one configured in strictly anonymous mode, can fall within the exemption; Google Analytics 4 as it comes out of the box cannot, because it cross-references data with the Google ecosystem.

Consent Mode v2: what it is and why you need it if you use Google

Google's consent mode is how your website tells Google's tags (Analytics, Ads, Tag Manager) what the person has decided. It works with four signals, each with a value of granted or denied:

• analytics_storage: measurement cookies.
• ad_storage: advertising cookies.
• ad_user_data: sending user data to Google for advertising (new in v2).
• ad_personalization: personalised advertising (new in v2).

The correct sequence is: before loading anything, declare the default state as denied for all four; when the person chooses in the banner, update the state on that same page; and the tags honour that state. Google has required the two new signals since March 2024 for anyone using its advertising services in the European Economic Area. There are two modes: basic, where the tags do not load until there is consent, and advanced, where they load but send cookieless pings and Google models the missing conversions. For a small business that does not want arguments with the AEPD, basic is the safe option.

How to have useful analytics without breaking the rules

1. Decide what you need to measure. Visits per page, traffic source, forms submitted and calls tapped. None of that needs user profiles or remarketing.
2. Consider cookieless or anonymous analytics. Tools that do not identify the person and aggregate data can fit within the AEPD exemption, and they give you 100 % of visits instead of the 40 % who accept the banner.
3. If you stay with GA4, do it properly: Consent Mode v2 with everything denied by default, Tag Manager loaded only after acceptance (or basic mode), IP anonymisation and a cookie policy that genuinely lists the ones you use.
4. Measure the events that matter from your own server. A submitted form or a tap on "call" can be counted without third-party cookies.
5. Test the banner in a clean browser. Open your site in incognito, accept nothing and check the developer tools to see which cookies were created. If there is any _ga before accepting, you are non-compliant.

That is how our own website is built: consent is stored in a technical cookie, Consent Mode v2 starts with everything denied and Google Tag Manager only loads if the person accepts analytics. It is the same scheme we apply to the web projects we deliver.

Frequently asked questions

Can I use Google Analytics without a cookie banner?

Not with the standard setup: GA4 sets cookies and cross-references data with Google, so it needs prior consent. Only strictly anonymous, first-party analytics can rely on the AEPD exemption.

Is a banner with "Accept" and a "more information" link enough?

No. Since January 2024 the AEPD requires that rejecting be as easy as accepting: a button at the same level, same size and same visibility.

How often do I have to ask for consent again?

Keep it for a reasonable period and ask again if you change the purposes or the providers. And always offer a link to change one's mind.

If you are not sure whether your website complies or you want to measure without headaches, write to us and we will review it with you.