Cookie banners and measurement: what the AEPD requires and how to keep seeing your results

Yes, you can comply with cookie regulations and still measure your campaigns. What changes is the quality of the data: with valid consent, fewer users will be measured directly and more of the picture will be estimated. That is why it pays to understand what the rules require and plan your measurement for that scenario, rather than waiting for the banner to stop being “a nuisance”.

What does the law actually require of a cookie banner in Spain?

There are two pieces. The first is article 22.2 of Law 34/2002 (LSSI), which requires you to inform users and obtain their consent before storing or reading information on their device, unless it is strictly necessary to provide the service. The second is Regulation (EU) 2016/679 (GDPR), which defines consent as a freely given, specific, informed and unambiguous indication of wishes. The authority that supervises this in Spain is the Spanish Data Protection Agency (AEPD).

The AEPD’s guide on the use of cookies turns those principles into practice. In short, a compliant banner usually meets the following:

• Accept and reject at the same level: if there is an accept-all button on the first layer, there must be an equally visible one to reject, or a clear way into the settings.
• Nothing is activated before the user decides: non-technical cookies cannot load until the user has made a choice.
• Continuing to browse is not consent: scrolling or clicking elsewhere on the page is not considered a valid action.
• Clear information: which cookies are used, what they are for, who manages them and how long they last.
• Withdrawing consent is as easy as giving it: with a permanent way to change the decision.

Which cookies need consent and which do not?

Technical cookies, the ones that make navigation, the basket or the session work, are exempt. Analytics, personalisation and advertising cookies generally are not. This includes measurement cookies and campaign pixels, because the LSSI refers to any technology that stores or accesses information on the user’s device, not just “cookies” in the strict sense.

A common mistake is to assume that because analytics “only counts visits”, there is no need to ask for permission. The AEPD guide does not treat it as exempt as a general rule. If you have doubts about a specific case, check with your legal adviser or your data protection officer: this article is for information only and does not replace their judgement.

What happens to my data when the user rejects cookies?

What you would expect: you do not collect it in the usual way. In Google Analytics and Google Ads, the tool that lets you adapt how tags behave according to consent is Consent Mode. According to Google’s documentation, when the user denies consent, tags stop using cookies and may send signals without identifiers that are used to estimate conversions. It is a model, not an exact count.

That has practical consequences:

• Platform figures stop being absolute truth. They mix observed and estimated data.
• Comparing them with last year is misleading. If you previously did not ask for consent, or your banner was more permissive, a drop may be a measurement issue and not a business one.
• Your own data carries more weight. The orders, calls or enquiries you record in your CRM, on the appropriate legal basis, are the most reliable cross-check.

A compliant banner does not destroy your measurement: it makes it honest about what it knows and what it estimates.

How do I review my setup without launching a huge project?

A sensible review fits into a few hours and can be done in this order:

1. Open your website in a private window and, before clicking anything, look at which cookies and third-party requests load. If analytics or advertising is already active, you have a problem.
2. Reject everything and check again. No non-technical cookies should appear.
3. Check that rejecting takes the same effort as accepting and that you can change your decision afterwards.
4. Check that each tag (analytics, Meta or TikTok pixels, remarketing) genuinely depends on consent and not just “on the banner”.
5. Define which figures will be your reference: sales, enquiries and calls recorded in your own systems, and what role each platform has as a complementary indicator.

That review covers both the website and the campaigns. If you manage investment in advertising and lead generation, whoever optimises the campaigns should know which share of conversions is estimated before moving budget.

What if my current banner is just a formality?

Then you face two risks at once: a regulatory one, because the AEPD can penalise breaches of the LSSI and the GDPR, and a business one, because you are making decisions with data collected on shaky foundations. Fixing it usually involves redesigning the banner, organising your tags and documenting what is measured and on what basis.

If you would like us to review how your measurement is set up and which figures you can trust, start with our analytics and market service: we work on measurement and conversions so that your decisions rest on data you can explain.