Your cookie banner is illegal. AEPD compliance for 2026

1. The Visual Symmetry Rule

This is the most critical change. It is no longer valid to place a giant green “ACCEPT ALL” button and a tiny text link to “reject”.

The AEPD requires that the action of rejecting cookies be at the same level and with the same ease as the action of accepting them. The user should not have to make more clicks to say “no” than to say “yes”.

2. Google Consent Mode v2: The Technical Challenge

Google has updated its APIs to respect these decisions without losing all analytics data.

Implementation (Before loading GTM)

window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}

// 1. Set default state: ALL DENIED
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

// 2. Load GTM/GA4
// ...

Only when the user clicks “Accept”, you trigger the update:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'analytics_storage': 'granted'
  // ...
});

3. Accessibility: The Forgotten WCAG 2.1

Your banner must be accessible by keyboard and screen readers.

• Visible Focus: When tabbing, you must see where you are.
• Color Contrast: Gray text on black background must have a 4.5:1 ratio.
• Semantics: Use <button>, not <div onclick="...">.

4. Dark Patterns Audit

If your banner does this, change it now:

5. Frequently Asked Questions (FAQ)

For complete ethical data management, discover how to implement Global Privacy Control (GPC) and secure your technical assets under GDPR Technical Security.