In short. Spain's LSSI Article 22(2) requires informed consent for device storage and access unless the transmission or strictly necessary requested-service exception applies.
Definition: Article 22(2) of Spain's Law 34/2002 requires consent after clear and complete information before using devices that store or retrieve data on a user's terminal. It provides exceptions for technical storage or access solely for transmitting a communication, or strictly necessary for a service expressly requested by the user.
Key facts
- The consolidated Spanish law makes information about the purposes of data processing part of the consent requirement in Article 22(2).
- The Spanish Data Protection Agency, AEPD, explains in its May 2024 cookie guide that the rule also covers similar technologies, including device fingerprinting, which takes a digital fingerprint of a device.
- The AEPD's cookie FAQ requires acceptance and rejection options at the same time, at the same level and with the same visibility.
What information and consent does the law require?
The LSSI is Spain's Law 34/2002 on information society services and electronic commerce. In the BOE consolidated text, whose latest published update is dated 23 January 2025, Article 22(2) permits storage and retrieval devices on recipients' terminal equipment subject to informed consent. The information must be clear and complete, particularly about why the data is processed.
The same article allows consent through appropriate browser or application settings where that is technically possible and effective.
Which cookies fall within the exceptions?
The AEPD guide gives user-input cookies as an example: these can track items selected for a shopping basket. It also lists session cookies for user authentication and session cookies for load balancing.
Purpose determines the exemption. A cookie serving several purposes can qualify for an exception for one purpose while another remains subject to Article 22(2). The guide applies the information and consent duties to cookies outside the exceptions, whether they belong to the website publisher or a third party.
For exempt cookies, the AEPD says Article 22(2) requires neither information nor consent for their use. It nevertheless recommends a general explanation in the cookie or privacy policy for transparency.
How should acceptance and rejection appear?
The AEPD FAQ says valid consent must be freely given and informed for the cookies it describes. Those cookies can process personal data about pages visited, consumption preferences or behaviour. Its requirement for equally visible acceptance and rejection options applies when those choices are presented to the user.
Related terms
- Which website cookies fall within the ePrivacy consent exemption?
- Does an AI referral change analytics cookie consent requirements?
- GDPR lawful basis for web data
FAQ
Do you need consent just because a cookie comes from a third party?
The AEPD guide applies the exceptions to both publisher and third-party cookies. You must assess the purposes for which the cookie is used.
Can you collect consent through browser settings?
Yes. Article 22(2) permits appropriate browser or other application settings where technically possible and effective.
Sources
- Boletín Oficial del Estado, "Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico", consolidated update 23 January 2025
- AEPD, "Guía sobre el uso de las cookies", May 2024
- AEPD, "¿Por qué son importantes las cookies para la protección de datos personales?", undated
Check how a page reads to answer engines. Open the GEO score analyzer