There's a widespread myth: that complying with data protection and cookie rules forces you to give up your website analytics. That if you respect the law, you're left with no idea how many people visit or where they come from. It's false. You can comply with GDPR, respect cookie rules and still measure what matters. You just have to do it properly, and in 2026 the Spanish Data Protection Agency (AEPD) has set the bar fairly clearly.
What the law requires, in plain terms
Two frameworks coexist here. The GDPR (European) governs how you handle your users' personal data. The cookie rules, developed in Spain through the LSSI and the AEPD's cookie guidance, govern what you can store or read on your visitor's device.
The golden rule for cookies is simple: aside from those strictly necessary for the site to work, you cannot activate any cookie without prior consent. And that consent has to be real: informed, freely given and unambiguous.
The cookie banner: the dos and don'ts
Most of the scares come from the banner. These are the points the AEPD makes clear:
- Accept and reject on equal footing. The "Reject" button must be as easy and visible as "Accept". No hiding the reject option behind three clicks.
- No abusive cookie walls. Forcing acceptance to browse at all, with no alternative, isn't freely given consent.
- Dark patterns are out. Deceptive colours, pre-ticked boxes or tiny text for the reject option don't cut it.
- No cookies until the yes. You can't load analytics or advertising cookies "just in case" while the user decides. They activate after acceptance.
One detail many forget: withdrawing consent must be as easy as giving it. You need a link or panel that's always accessible for people to change their minds.
So how do I measure without losing everything?
Here's the good part. You have several routes, and they're not mutually exclusive:
- Set up consent properly (Consent Mode). Tools like Google Analytics 4 can adjust their behaviour based on what the user accepts. When someone rejects, anonymous, aggregated signals are collected instead of full data. You lose granularity, not visibility.
- Consider cookieless analytics. There are solutions (server-side or "cookieless") that measure aggregate traffic without identifying the person and therefore carry lighter consent requirements. For many businesses, knowing trends and traffic sources is more than enough.
- Optimise the banner itself. A clear, honest, well-designed banner gets higher acceptance rates than a deceptive one, which is illegal on top of that. Transparency, here, also converts.
Beyond cookies: your GDPR obligations
Cookies are the tip of the iceberg. GDPR also asks you for things worth having in order:
- A clear privacy policy explaining what data you collect, what for and for how long.
- A record of processing activities if it applies to you.
- Correct legal bases for each processing activity (consent, contract, legitimate interest and so on).
- Reasonable security measures: encryption, access control, backups.
- Data processor agreements with your providers (the hosting, the email marketing tool and so on).
It's not bureaucracy for its own sake: most penalties come from basic oversights, not from convoluted cases.
Mistakes that get expensive
The three most common we run into: banners that load cookies before consent (the classic), contact forms with no checkbox or privacy notice, and newsletters sent to contacts who never gave clear permission. Any of the three can end in a complaint to the AEPD. The good news is that all three are relatively easy to fix.
Complying and measuring aren't at odds
If one idea sticks, let it be this: privacy done well builds trust, and trust sells. A user who sees an honest banner and a clear policy feels more comfortable handing over their data. Complying with the law isn't the enemy of your analytics; the enemy is doing it halfway and leaving yourself exposed.
At Social Digital we review your site top to bottom: a compliant cookie banner, a privacy policy, properly configured consent and analytics that still give you the information you need to decide. If you're not sure your site complies, book a diagnostic session and we'll tell you plainly what's fine and what needs adjusting. This is practical guidance and doesn't replace a legal adviser's judgement for your specific case.