Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Spain. Sectoral rules (healthcare, banking, employment) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- Art 7 Child consent age — set at 14 (lower than GDPR's default 16)
- Art 22 Video surveillance — public/employer use proportionality and signage requirements
- Art 34 DPO — list of activities triggering mandatory designation beyond GDPR Art 37
- Art 87–91 Employee digital rights — privacy in devices, geolocation, video surveillance, digital disconnection
- Art 71–78 Sanctions — three-tier infraction regime (leves/graves/muy graves) with statute of limitations
- Art 22.2 Cookies — informed prior consent for non-strictly-necessary storage/access on terminal equipment
- Art 21 Email/SMS commercial communications — prior consent required (soft opt-in narrow)
- Art 38 Sanctions — up to €600,000 for very serious infringements
- Art 20.3 Employer monitoring — adequate, necessary and proportional measures with prior employee information
- Art 20 bis Reference to LOPDGDD digital rights — privacy in devices, geolocation, video surveillance
Regulators
Supervisory authorities that interpret and enforce privacy law here.
State / Land DPAs · 3 authorities
| Land / state | Authority | Note | |
|---|---|---|---|
| Catalonia | APDCAT | Autoritat Catalana de Protecció de Dades — competent for Catalan public bodies and entities providing public services in Catalonia | site ↗ |
| Basque Country | AVPD | Datuak Babesteko Euskal Bulegoa — competent for Basque public administration | site ↗ |
| Andalusia | CTPDA | Consejo de Transparencia y Protección de Datos de Andalucía — competent for Andalusian public bodies (transparency + data protection) | site ↗ |
Coordination body
- 2020-07-28 · Cookies guidance v2 — AEPD 'Guía sobre el uso de las cookies' — alignment with EDPB 5/2020; 'continue browsing' deemed insufficient as consent.
- 2023-01-11 · Cookies guidance update — AEPD updated cookie guidance — explicit alignment with EDPB Cookie Banner Taskforce report (Jan 2023): equal-prominence reject button, no pre-ticked boxes, no deceptive design.
- 2024-09 · Pay-or-OK / Consent-or-Pay — AEPD position aligned with EDPB Opinion 08/2024 — large platforms cannot rely solely on binary 'pay or accept' to obtain valid GDPR consent.
Notable enforcement
Spain is consistently the EU member state with the highest *number* of GDPR sanctions, although individual fines tend to be smaller than the largest German, French or Irish cases. AEPD's enforcement profile is volume-driven and procedurally fast: many decisions concern banks (CaixaBank, BBVA), telecoms (Vodafone, Orange), retail/employment (Mercadona, Glovo) and standard cookie/transparency violations. Fines are frequently appealed to the Audiencia Nacional and reduced; AEPD adopted a voluntary-payment discount mechanism (up to 40 %) which closes a large share of cases without litigation.
-
CaixaBank AEPD · Art 6, 13, 14 stood
Lawful basis and transparency failings around customer data processing for marketing and profiling. Largest Spanish GDPR fine at the time.
-
BBVA AEPD · Art 13, 14 stood
AEPD sanction for transparency failings around how personal data is provided to the customer (PS/00070/2020). One of the largest AEPD fines on a Spanish bank to that date and a recurring reference for transparency expectations. (Verify procedural number against AEPD final resolution.)
-
Vodafone España AEPD · Art 5, 32 stood
Security and onboarding controls — part of a multi-action enforcement run against Vodafone España totalling tens of millions of euros across several proceedings.
-
Mercadona AEPD · Art 5, 6, 9, 35 settled
Facial-recognition deployment in supermarket stores without an adequate legal basis or DPIA. Originally proposed at a higher amount, settled at €170,000 with corrective measures.
GA4 status
GA4 is usable in Spain with prior, informed, granular consent under LSSI Art 22.2 (cookie layer) plus a valid GDPR Art 6 basis for the subsequent processing. AEPD aligns with the EDPB baseline rather than pursuing French- or Italian-style GA-specific enforcement; transfers to Google's US servers are accepted while Google LLC remains DPF-certified. Without consent, GA4 deployments are non-compliant under AEPD cookie guidance.
| DPA | Stance |
|---|---|
| AEPD | EDPB-baseline — explicit consent under LSSI Art 22.2 + DPF for US transfers; no GA-specific bans. |
| APDCAT | Catalonia — same baseline as AEPD; competent only for Catalan public-sector deployments. |
| AVPD | Basque Country — aligned with AEPD; jurisdiction limited to Basque public administration. |
| CTPDA | Andalusia — public-sector only; aligned with AEPD on private-sector analytics expectations. |
Cross-border transfers + Schrems II
AEPD aligned with the EDPB baseline on international transfers. Post-DPF (10 Jul 2023) the AEPD accepts DPF-certified US importers as adequate while certification is live; for non-DPF recipients, Transfer Impact Assessments and supplementary measures remain expected. Compared with CNIL or Garante, AEPD's posture is moderate — it has not pursued GA4-specific transfer enforcement actions of the kind seen in France or Italy.
EU 2021/914 SCCs are the standard fallback for non-DPF transfers. AEPD has issued generic guidance (Listado de comprobaciones) but has not published Spain-specific addenda. Module 2 (controller-processor) onward-transfer clauses receive normal scrutiny without the heightened review applied by some northern EU DPAs.
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 12 · 6 green · 5 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Cookieless by design. EU-routed via Cloudflare. No DPA required for Lite tier (no PII). | |
| GREEN | Self-hosted on your infrastructure. Full data control, configurable IP anon. Meets every jurisdiction with cookieless config. | |
| GREEN | EU-hosted with cookieless mode available. With cookies disabled qualifies for §25(2) exception in Germany. | |
| GREEN | German-hosted, cookieless, GDPR-aligned by design. | |
| GREEN | EU-hosted, no cookies, no PII processed. ePrivacy-exempt for cookieless tracking. No banner required. | |
| GREEN | Open-source, cookieless, fully self-hostable. Default-green when self-hosted. | |
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | Default config sends data to US infrastructure. Needs Consent Mode v2 + IP anonymization + DPF active + signed DPA + reject-all banner. Server-side EU proxy moves to green. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Identifies users by default — needs config. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Tag managers · 1 · 0 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Container only — verdict depends on which tags fire and when. Block until consent. Server-side GTM in EU recommended. |
Session replay · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Full session capture — highest-risk category. Explicit consent + DPIA + strict retention. | |
| RED | Session replay — high-risk processing per EDPB Guidelines 3/2019. DPIA + explicit consent required. Cannot run pre-consent. | |
| RED | Session replay + Microsoft tracking. DPIA + explicit consent required. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics legal in Spain in 2026?
How strict is AEPD compared with the CNIL or Garante?
What does LOPDGDD add on top of GDPR?
Are there autonomous-region DPAs in Spain?
Must my privacy notice be in Spanish?
What is the Spanish equivalent of France's Bloctel?
What is the child consent age in Spain?
Do I need a Spanish Article 27 representative?
Does Schrems II still affect transfers from Spain post-DPF?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Spain's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.