--- title: "Spain — AdTech & Commercial Privacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/spain/adtech-and-commercial-privacy/ source_html: /jurisdictions/spain/adtech-and-commercial-privacy/index.html description: "Spain — AdTech & Commercial Privacy: adtech_and_commercial_privacy AdTech & Commercial Privacy 6 sub-modules 3 claims Amber ▾ # Cookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signal" generated_at: 2026-10-25T04:46:50Z content_sha256: 262330f59ff95cdf5962794a12304a1b3954a294b3bac9e5843df6bf39cd83db generator: "fe-fleet/md-twin@1.0" --- # Spain — AdTech & Commercial Privacy | Data Protection Monitor ### D7AdTech & Commercial Privacy6 sub-modules3 claimsAmber▾# Cookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signals, clean rooms, cross-context advertising) lack a direct EU/ES analogue and were not evidenced in this pass. Primary framework Ley 34/2002 (LSSI) Art 22.2 + GDPR + AEPD Guía sobre el uso de las cookies Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Amber Cookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signals, clean rooms, cross-context advertising) lack a direct EU/ES analogue and were not evidenced in this pass. #### Sub-modules (6) #### Cookies And TrackersGreen AEPD's cookie guide requires prior, informed, valid consent for non-exempt cookies, with accept/reject options presented with equal prominence and at the same level. Claims (1): - For non-exempt cookies, valid consent must be obtained from the user, freely and informedly given, with the options to accept and reject cookies offered simultaneously, at the same level and with equal visibility. #### Dark PatternsGreen AEPD updated its cookie guide in 2023 to incorporate EDPB Guidelines 03/2022 on deceptive patterns, requiring accept/reject actions to be equally easy to select. Claims (1): - AEPD updated its cookie guide in July 2023 to align with EDPB Guidelines 03/2022 on deceptive patterns, incorporating the criterion that accept/reject actions be presented in a prominent location and format at the same level, with rejection no more complicated than acceptance. #### Opt Out SignalsAmber No AEPD-specific recognition of a Global-Privacy-Control-equivalent browser signal was identified in this research pass. Absence provenance: unavailable . Searched: AEPD Global Privacy Control señal navegador. #### Clean Rooms And DcrAmber No AEPD guidance on data clean rooms/data collaboration rooms was identified in this research pass. Absence provenance: unavailable . Searched: AEPD clean room datos colaboración publicidad. #### Cross Context AdvertisingAmber The EU/ES consent-based ePrivacy model does not use the CPRA 'sale'/'share' framework; cross-context advertising is instead governed through the GDPR/LSSI cookie-consent regime. Absence provenance: unavailable . Searched: AEPD publicidad cross-context venta datos. #### Direct MarketingAmber Electronic commercial communications are regulated via Ley 34/2002 (LSSI), which complements GDPR consent requirements for direct marketing by electronic means. Claims (1): - Ley 34/2002 (LSSI) complements GDPR guarantees applicable to information-society services, including electronic direct-marketing communications. Category narrative 58 words AEPD's Guía sobre el uso de las cookies (last major update aligning with EDPB Guidelines 03/2022 on deceptive patterns) governs cookie/tracker consent, mandating equal prominence for accept/reject options. No Spain-specific opt-out-signal (GPC-equivalent), clean-room, or CPRA-style 'sale/share' framework was identified — these concepts do not map directly onto the EU consent-based model, which instead relies on ePrivacy/LSSI consent requirements. no periodic updates on record for this sub-brief Evidence 3 Sources and claims (3) - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/17-internet-y-redes-sociales/FAQ-1707-importancia-de-las-cookies-en-la-proteccion-de-datos) — For non-exempt cookies, valid consent must be obtained from the user, freely and informedly given, with the options to accept and reject cookies offered simultaneously, at the same level and with equal visibility.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/aepd-actualiza-guia-cookies-para-adaptarla-a-nuevas-directrices-cepd) — AEPD updated its cookie guide in July 2023 to align with EDPB Guidelines 03/2022 on deceptive patterns, incorporating the criterion that accept/reject actions be presented in a prominent location and format at the same level, with rejection no more complicated than acceptance.observed 2026-08-03 - Probable[Agencia Española de Protección de Datos](https://www.aepd.es/guias/orientaciones-analitica-web-aapp.pdf) — Ley 34/2002 (LSSI) complements GDPR guarantees applicable to information-society services, including electronic direct-marketing communications.observed 2026-08-03