Shopify privacy law · Spain
Shopify cookie consent in Spain
Spain's AEPD is one of the top-3 EU regulators by fine volume. Cookie-specific enforcement is aggressive: banners must include a 'Reject All' with equal prominence to 'Accept All', and the AEPD publishes updated 'Guía sobre el uso de las cookies' guidance annually.
Governing law: GDPR + LSSI-CE (Ley de Servicios de la Sociedad de la Información)
Enforcement reality
The Agencia Española de Protección de Datos (AEPD) is consistently among the most active EU regulators — it issued more fines by count than any other DPA in 2023 and 2024. The AEPD's Guía sobre el uso de las cookies (updated annually, most recently January 2026) requires: (1) Accept All + Reject All buttons of equal visual weight on the first layer, (2) a visible 'Configure' or 'Preferences' option to reach granular controls in one click, (3) no dark patterns (colour, size, positioning tricks), and (4) a renewed consent request no more than every 24 months. Fines for cookie-specific violations against SMBs have ranged €5,000–€30,000, with larger fines (€100K+) reserved for banner dark-patterns and consent-recording failures.
Recent enforcement actions
- Vodafone España·2024·€200K
Cookie banner lacked equal-prominence Reject option and used pre-ticked marketing checkbox
- Openbank (Santander)·2023·€2.5M
Unlawful data-sharing across group entities without valid consent
- Google LLC·2022·€10M
Sending user data to third parties without consent basis
What Shopify merchants must do in Spain
- Accept All and Reject All buttons with visually equal weight (LSSI-CE + AEPD 2026 guidance)
- Configure/Preferences link within one click of the first-layer banner
- No dark patterns — colour, size, or positioning tricks are enforcement triggers
- Consent renewed no more than every 24 months (AEPD default)
- Privacy policy in Spanish for Spanish-language storefronts
- Named third-party recipients — generic labels like 'socios' (partners) are insufficient
- DSAR response within 30 days, free of charge
- Data breach notification to AEPD within 72 hours
How Consentico handles Spain
Consentico's geo-targeting detects Spain visitors at the edge and applies the right banner — opt-in posture for EU/UK rules, with Google Consent Mode v2 signals and a per-decision audit log. The banner survives Shopify theme switches and uninstalls cleanly.
Related concepts
- GDPREU regulation governing how organisations process personal data of EU/EEA residents. Applies to any Shopify store with EU visitors.
- ePrivacy DirectiveEU directive (2002/58/EC, amended 2009) requiring opt-in consent for cookies and similar storage. Enforced together with GDPR.
- Consent (GDPR)Freely given, specific, informed, and unambiguous indication of agreement. No pre-checked boxes, no implied consent from continued browsing.
- DSARData Subject Access Request — when an EU/UK resident asks you for a copy of, or deletion of, their personal data.
Compliant in Spain — in five minutes.
Free for stores under 5,000 banner views per month. No code, no theme edits.