Data Protection Monitor
Global Privacy & Data Protection Intelligence

Spain (ES) · Module Detail

Spain: AdTech & Commercial Privacy

← Full Spain overview Build report with Spain Request deeper dive

#

Cookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signals, clean rooms, cross-context advertising) lack a direct EU/ES analogue and were not evidenced in this pass.

Primary frameworkLey 34/2002 (LSSI) Art 22.2 + GDPR + AEPD Guía sobre el uso de las cookies
Supervisory authorityAgencia Española de Protección de Datos (AEPD)
Traffic-light rationale — AmberCookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signals, clean rooms, cross-context advertising) lack a direct EU/ES analogue and were not evidenced in this pass.

Sub-modules (6)

Cookies And TrackersGreen

AEPD's cookie guide requires prior, informed, valid consent for non-exempt cookies, with accept/reject options presented with equal prominence and at the same level.

Claims (1):

  • For non-exempt cookies, valid consent must be obtained from the user, freely and informedly given, with the options to accept and reject cookies offered simultaneously, at the same level and with equal visibility.

Dark PatternsGreen

AEPD updated its cookie guide in 2023 to incorporate EDPB Guidelines 03/2022 on deceptive patterns, requiring accept/reject actions to be equally easy to select.

Claims (1):

  • AEPD updated its cookie guide in July 2023 to align with EDPB Guidelines 03/2022 on deceptive patterns, incorporating the criterion that accept/reject actions be presented in a prominent location and format at the same level, with rejection no more complicated than acceptance.

Opt Out SignalsAmber

No AEPD-specific recognition of a Global-Privacy-Control-equivalent browser signal was identified in this research pass.

Absence provenance: unavailable. Searched: AEPD Global Privacy Control señal navegador.

Clean Rooms And DcrAmber

No AEPD guidance on data clean rooms/data collaboration rooms was identified in this research pass.

Absence provenance: unavailable. Searched: AEPD clean room datos colaboración publicidad.

Cross Context AdvertisingAmber

The EU/ES consent-based ePrivacy model does not use the CPRA 'sale'/'share' framework; cross-context advertising is instead governed through the GDPR/LSSI cookie-consent regime.

Absence provenance: unavailable. Searched: AEPD publicidad cross-context venta datos.

Direct MarketingAmber

Electronic commercial communications are regulated via Ley 34/2002 (LSSI), which complements GDPR consent requirements for direct marketing by electronic means.

Claims (1):

  • Ley 34/2002 (LSSI) complements GDPR guarantees applicable to information-society services, including electronic direct-marketing communications.
Category narrative58 words

AEPD's Guía sobre el uso de las cookies (last major update aligning with EDPB Guidelines 03/2022 on deceptive patterns) governs cookie/tracker consent, mandating equal prominence for accept/reject options. No Spain-specific opt-out-signal (GPC-equivalent), clean-room, or CPRA-style 'sale/share' framework was identified — these concepts do not map directly onto the EU consent-based model, which instead relies on ePrivacy/LSSI consent requirements.

no periodic updates on record for this sub-brief

Sources and claims (3)
  1. ConfirmedAgencia Española de Protección de Datos — For non-exempt cookies, valid consent must be obtained from the user, freely and informedly given, with the options to accept and reject cookies offered simultaneously, at the same level and with equal visibility.observed
  2. ConfirmedAgencia Española de Protección de Datos — AEPD updated its cookie guide in July 2023 to align with EDPB Guidelines 03/2022 on deceptive patterns, incorporating the criterion that accept/reject actions be presented in a prominent location and format at the same level, with rejection no more complicated than acceptance.observed
  3. ProbableAgencia Española de Protección de Datos — Ley 34/2002 (LSSI) complements GDPR guarantees applicable to information-society services, including electronic direct-marketing communications.observed