Cookie banner — AEPD guidance, in practice

What the AEPD requires of a cookie banner, and how the Cookie Policy miniterms generates pairs with your consent tool.

If your site sets non-essential cookies, you need a banner that asks for consent before they are set. The AEPD has fined sites for getting this wrong in ways that are easy to fix. miniterms does not generate the banner itself — that comes from your consent tool (a consent management platform, or CMP, or your own implementation). What miniterms generates is the matching Cookie Policy your banner links to, built to the current AEPD guidance.

What AEPD guidance requires

The current AEPD "Guía sobre el uso de las cookies" sets out the practical floor. The headline rules:

  1. No cookies before consent for any cookie that is not strictly necessary. The banner must appear and the user must act before non-essential cookies are written.
  2. Reject must be as easy as accept. A banner that has a prominent "Accept" button and a buried "Reject" link is not compliant. The AEPD has been explicit about this.
  3. Granular by category. The user must be able to accept or reject by category (functional, analytics, marketing) — accepting all is fine as a shortcut, but blanket-accept-only is not.
  4. Withdrawable. The user must be able to change their mind later, with effort no greater than the initial consent.
  5. Documented. You must be able to demonstrate, per visitor, what they consented to and when. This is the part most easily forgotten.

The legal basis sits on the e-Privacy Directive (2002/58/EC art. 5(3)) plus [GDPR art. 7] on consent quality. The AEPD enforces it in Spain.

Responsibility notice on generated Cookie Policies

The draft Cookie Policy that the cookie scanner generates is in English and begins with this responsibility notice:

Your responsibility — This cookie policy is built to current GDPR requirements and European Data Protection Board (EDPB) guidelines from public regulatory and supervisory-authority sources, and kept up to date as the law changes. It is only as accurate as the information you provided: you are responsible for ensuring your answers are truthful and that this document reflects how your business actually collects and uses data. It is not individualised legal advice. Having a lawyer review it is optional, not required.

The notice is part of the document text, so it is included in the ZIP export and in share links. Keep it when you publish. The document is built to current regulatory sources, but it is only as accurate as the inputs you provide — so the notice makes clear that you own the truthfulness of those inputs and that the finished policy matches how your site actually uses cookies. A lawyer review is optional, not required.

What miniterms generates

The Cookie Policy is one of the four document types miniterms produces. It lists:

  • Each cookie category (strictly necessary, functional, analytics, marketing)
  • Within each category, the specific cookies (name, provider, lifetime, purpose)
  • A statement on third-country transfers if any of the cookies originate from outside the EEA

The cookie scanner (Cookies in the dashboard) can draft that list for you: it fetches a URL you provide, detects the cookies and scripts visible without running JavaScript, and drafts a Cookie Policy section for each category it finds. Review the draft and add anything it missed before you publish.

Pairing the Cookie Policy with your consent tool

The banner comes from your consent tool; the Cookie Policy comes from miniterms. To keep the two consistent:

  1. Choose a consent tool that meets the five points above — no non-essential cookies before consent, reject as easy as accept, a choice per category, easy withdrawal, and a stored consent record per visitor
  2. Use the same categories in the banner as in your Cookie Policy, so both say the same thing
  3. Publish the Cookie Policy on your own site (download it from Publish & sync in the dashboard) and link to it from the banner and from your site footer
  4. Load the consent tool in your site's <head>, before any tag manager or analytics tag

The order matters. The consent tool needs to run first so that it can hold back other scripts from setting cookies until the user has chosen. Tag managers (GTM, Tealium) read the consent tool's choice through their built-in consent mode.

What miniterms does NOT do

miniterms does not show a banner on your site, block cookies, or store your visitors' consent records. Those are your consent tool's job — and its consent record is the evidence point 5 above asks for. The cookie scanner is static, so it does not catch cookies that JavaScript sets after the page loads. When your analytics or advertising setup changes, rescan, update the Cookie Policy, and update your banner's categories so the two stay in sync.

Cross-site consent

If you run multiple subdomains, your consent tool decides whether the consent record applies site-wide or per subdomain. AEPD guidance is permissive about site-wide consent provided the user is informed about the scope at the time of consent.