Next.js Cookie Compliance in Spain: Privacy Evidence and Monitoring Checklist

Introduction

*Updated for 2026 compliance practices.*

If you run a Next.js website that serves visitors from Spain, cookie compliance isn’t just a box to tick—it’s an ongoing obligation under the GDPR and the Spanish Data Protection Authority’s (AEPD) strict interpretation of the law. This guide gives you a practical **Next.js cookie compliance Spain privacy evidence and monitoring checklist** so you can prove consent, catch gaps before regulators do, and keep your site trustworthy. We’ll walk through what the checklist means, how to implement it step by step, common mistakes, and how to validate everything with GDPRChecker’s scanner.

What Is Next.js Cookie Compliance Spain Privacy Evidence and Monitoring Checklist?

A **Next.js cookie compliance Spain privacy evidence and monitoring checklist** is a structured set of technical and documentation tasks that help you demonstrate GDPR compliance for cookies and trackers on a Next.js site targeting Spanish users. It’s not a one‑time audit; it’s a living process that combines:

• **Privacy evidence** – records of consent choices, cookie inventories, and banner configurations.
• **Monitoring** – regular scans to detect new trackers, pre‑consent data leaks, and configuration drift.
• **Checklist** – a repeatable workflow that covers consent defaults, tag manager triggers, policy disclosures, and post‑change verification.

Because Next.js can render pages on the server, at the edge, or in the browser, compliance challenges multiply. Server‑side rendering (SSR) might inject cookies before any consent banner appears. Static generation (SSG) can embed third‑party scripts that fire on load. Incremental Static Regeneration (ISR) can reintroduce old tracking code. A checklist forces you to inspect every rendering path.

Spanish authorities, guided by the European Data Protection Board, expect website owners to keep detailed records of consent and to monitor compliance continuously. The AEPD has fined companies for using pre‑checked consent boxes, for not providing a clear “Reject all” option, and for loading analytics scripts before consent. A checklist helps you avoid these pitfalls and produce the evidence an inspector would request.

Why Next.js Sites Need a Spain‑Specific Compliance Approach

Spain enforces the GDPR through the AEPD, which has issued some of the highest fines in Europe for cookie violations. The AEPD’s guidelines demand:

• **Granular consent** – separate choices for analytics, marketing, and functional cookies.
• **No cookie walls** – you cannot block access to content if a user refuses non‑essential cookies.
• **Easy withdrawal** – users must be able to change their consent as easily as they gave it.
• **Proof of consent** – you must keep a timestamped record of each user’s choice.

Next.js adds technical complexity. For example, if you use Next.js middleware to set a language cookie based on the `Accept-Language` header, that cookie is strictly necessary and doesn’t need consent. But if you set a cookie to track user preferences for a personalized dashboard, you need consent—even if the cookie is set server‑side. Your checklist must distinguish between these scenarios.

Moreover, many Next.js projects rely on Vercel’s analytics or third‑party services like Google Analytics. Vercel Analytics is privacy‑friendly and often doesn’t require consent, but Google Analytics does. If you use both, your checklist must verify that Google Analytics only loads after consent, while Vercel Analytics can load unconditionally.

Step‑by‑Step Implementation for Next.js Cookie Compliance

1. Inventory All Cookies and Trackers

Start by cataloguing every cookie, local storage key, and third‑party request your Next.js site makes. Use GDPRChecker’s scanner to crawl your site and generate an inventory. Pay special attention to:

• **Server‑set cookies** – check `Set-Cookie` headers in Next.js API routes, middleware, and `getServerSideProps`.
• **Client‑side scripts** – any `<script>` tag in `_document.js`, `_app.js`, or individual pages.
• **Third‑party modules** – npm packages that inject tracking pixels (e.g., `react-ga`, `next-seo`).

Classify each item as strictly necessary, functional, analytics, or marketing. Strictly necessary cookies (like session tokens or CSRF tokens) can be set without consent. Everything else must wait for consent.

2. Implement a Consent Banner with a CMP

Integrate a Consent Management Platform (CMP) that supports Google Consent Mode v2. GDPRChecker offers a managed consent banner on paid plans that handles this out of the box. If you build your own, ensure:

• The banner appears before any non‑essential cookies are set.
• It offers “Accept all,” “Reject all,” and “Customize” buttons at the same visual level.
• It stores consent choices in a cookie or local storage that your Next.js code can read.
• It integrates with Google Consent Mode v2 to signal consent status to Google tags.

In Next.js, you can conditionally load the CMP script using the `next/script` component with the `strategy="beforeInteractive"` prop to ensure it runs before any other scripts.

3. Configure Google Consent Mode v2

Google Consent Mode v2 lets you adjust how Google tags behave based on consent. For example, if a user rejects analytics cookies, Google Analytics 4 will still send cookieless pings for basic measurement, but it won’t set cookies. To implement:

1. Add the Consent Mode snippet to your `_app.js` or `_document.js`.
2. Set default consent states to `denied` for `analytics_storage` and `ad_storage`.
3. Update consent states when the user interacts with your banner.

Refer to Google’s official Consent Mode guide for the exact code. GDPRChecker’s scanner can verify that Consent Mode is active and that defaults are set correctly.

4. Block Pre‑Consent Network Requests

Even with a CMP, some scripts might fire before consent. In Next.js, this can happen if you import a module that self‑initializes. To prevent this:

• Use dynamic imports with `{ ssr: false }` for client‑only tracking libraries.
• Wrap third‑party script loading in a consent check.
• Use GDPRChecker’s runtime protection (available on paid plans) to automatically block requests until consent is given.

After implementing, run a GDPRChecker scan to see if any requests slip through. The scanner will flag pre‑consent requests to known tracking domains.

5. Update Your Privacy Policy

Your privacy policy must disclose:

• The types of cookies you use and their purposes.
• The third parties that set cookies through your site.
• How users can manage their consent.
• The legal basis for processing (consent for non‑essential cookies).

Link to your privacy policy from your consent banner and from every page footer. GDPRChecker’s scanner checks for the presence and accessibility of your policy link.

6. Keep Consent Records

For every user, store:

• The consent choices they made.
• The timestamp of consent.
• The version of your cookie banner and privacy policy at the time.

GDPRChecker’s paid plans include consent records that you can export if an authority requests them. If you build your own, use a secure database and associate records with a pseudonymous identifier.

7. Monitor and Re‑Scan Regularly

Compliance isn’t static. Every time you deploy new code, add a third‑party service, or update your CMP, run a GDPRChecker scan. Set up recurring scans to catch:

• New cookies or trackers.
• Changes in consent defaults.
• Broken banner behavior.
• Policy link rot.

Growth‑plan users can automate scans and receive alerts when something changes.

Common Mistakes and How to Avoid Them

Mistake 1: Setting Cookies in Middleware Without Consent Checks

Next.js middleware runs on every request. If you set a non‑essential cookie there, you’ll set it before any consent banner can appear. Always check consent status in middleware or move cookie setting to the client side.

Mistake 2: Ignoring Static Generation

Pages generated at build time can embed tracking scripts that fire immediately. Use client‑side consent checks even on static pages. Consider using Incremental Static Regeneration with a consent‑aware data fetching strategy.

Mistake 3: Not Testing the “Reject All” Flow

Many developers test only the “Accept all” path. But the “Reject all” flow is where most violations occur. After rejecting, no non‑essential cookies should be set, and Google Consent Mode should be in `denied` state. GDPRChecker’s scanner can simulate this flow.

Mistake 4: Forgetting About Spanish Language Requirements

If your site targets Spanish users, your consent banner and privacy policy must be available in Spanish. The AEPD has fined companies for not providing local‑language disclosures. GDPRChecker’s localization features (Growth plan) help you manage multi‑language banners.

Mistake 5: Relying on Implied Consent

Scrolling or continuing to browse does not constitute valid consent under the GDPR. You must obtain affirmative action—a click on “Accept” or “Reject.” Ensure your banner doesn’t disappear until the user makes a choice.

How to Validate with GDPRChecker

GDPRChecker’s scanner is built for exactly this kind of verification. Here’s how to use it as part of your checklist:

1. **Pre‑consent request check** – The scanner loads your site without consent and logs all network requests. It flags any that go to known tracking domains.
2. **Banner behavior test** – It verifies that your banner appears, that all buttons work, and that the banner doesn’t disappear without interaction.
3. **Consent mode diagnostics** – It checks that Google Consent Mode v2 is active and that default consent states are `denied`.
4. **Policy link detection** – It confirms that your privacy policy is linked and reachable.
5. **Post‑change re‑scan** – After you fix issues, re‑scan to confirm they’re resolved.

Paid plans add runtime protection that actively blocks unauthorized requests, consent records for evidence, and automated monitoring that alerts you to drift.

Implementation Checklist

Use this numbered checklist every time you deploy changes or review compliance:

1. Run a full GDPRChecker scan to inventory all cookies and trackers.
2. Classify each item as strictly necessary, functional, analytics, or marketing.
3. Implement a consent banner that offers “Accept all,” “Reject all,” and “Customize.”
4. Integrate Google Consent Mode v2 with default `denied` states.
5. Block all non‑essential cookies and scripts until consent is given.
6. Verify that no pre‑consent requests hit tracking domains (use GDPRChecker’s pre‑consent check).
7. Test the “Reject all” flow and confirm no non‑essential cookies are set.
8. Update your privacy policy to list all cookies, purposes, and third parties.
9. Ensure your privacy policy is linked from the banner and footer, and available in Spanish.
10. Store consent records with timestamps and banner versions.
11. Set up recurring GDPRChecker scans (weekly or after each deployment).
12. Review scan results and fix any new issues immediately.

Comparison: DIY vs. Managed Compliance

| Aspect | DIY Approach | GDPRChecker Managed (Paid Plans) | |--------|--------------|-----------------------------------| | **Cookie inventory** | Manual crawling or open‑source tools | Automated scanner with detailed reports | | **Consent banner** | Build from scratch or use a free CMP | Managed banner with Google Consent Mode v2 integration | | **Pre‑consent blocking** | Manual code checks and conditional loading | Runtime protection that auto‑blocks unauthorized requests | | **Consent records** | Must implement your own database and logging | Built‑in consent records, exportable for audits | | **Monitoring** | Ad‑hoc manual checks | Automated recurring scans with alerts | | **Localization** | Manual translation and management | Multi‑language banner and policy support (Growth plan) | | **Evidence for regulators** | You must compile and format everything | Dashboard with exportable compliance reports |

Real‑World Examples

Example 1: The SSR Analytics Leak

A Spanish e‑commerce site built with Next.js used `getServerSideProps` to fetch user data and, in the same function, initialized Google Analytics. Because the code ran on the server, the `_ga` cookie was set before any consent banner appeared. A GDPRChecker scan flagged the pre‑consent request. The fix: move analytics initialization to a client‑side `useEffect` that checks consent.

Example 2: The Static Page with Embedded YouTube

A marketing agency’s Next.js blog used static generation and embedded YouTube videos. The YouTube iframe set cookies as soon as the page loaded. GDPRChecker’s scanner detected the third‑party requests. The solution: replace the iframe with a consent placeholder that loads the video only after the user opts in to marketing cookies.

Example 3: The Missing Spanish Policy

A SaaS company had a perfect consent banner and cookie setup, but their privacy policy was only in English. A routine GDPRChecker scan noted the missing Spanish link. After adding a Spanish translation and linking it from the banner, they passed all checks.

FAQ

What is Next.js cookie compliance Spain privacy evidence and monitoring checklist? It’s a structured set of tasks to ensure your Next.js site meets Spanish GDPR requirements for cookies. It includes inventorying trackers, implementing a consent banner, blocking pre‑consent requests, keeping consent records, and regularly scanning for compliance gaps.

Do I need Next.js cookie compliance Spain privacy evidence and monitoring checklist for GDPR? Yes, if your Next.js site serves users in Spain. The AEPD enforces strict cookie rules, and you must be able to prove consent. A checklist helps you systematically meet those obligations and produce evidence if audited.

How do I implement Next.js cookie compliance Spain privacy evidence and monitoring checklist? Start by scanning your site with GDPRChecker to inventory cookies. Then integrate a CMP with Google Consent Mode v2, block non‑essential scripts until consent, update your privacy policy, and set up recurring scans. Follow the step‑by‑step guide above.

How can I verify Next.js cookie compliance Spain privacy evidence and monitoring checklist with a scanner? Use GDPRChecker’s scanner to check for pre‑consent network requests, banner behavior, Consent Mode defaults, and policy links. Run scans after every deployment and review the detailed reports to catch issues early.

What are common Next.js cookie compliance Spain privacy evidence and monitoring checklist mistakes? Common mistakes include setting cookies in middleware without consent checks, ignoring static pages that load trackers, not testing the “Reject all” flow, forgetting Spanish language requirements, and relying on implied consent like scrolling.

Which cookies and trackers should I check for Next.js cookie compliance Spain privacy evidence and monitoring checklist? Check all cookies, local storage keys, and third‑party requests. Pay special attention to analytics (Google Analytics), marketing (Facebook Pixel), and functional cookies that aren’t strictly necessary. GDPRChecker’s scanner automatically identifies them.

How often should I review Next.js cookie compliance Spain privacy evidence and monitoring checklist? Review your checklist and run a GDPRChecker scan at least monthly, and after every code deployment or third‑party service change. For high‑traffic sites, weekly scans are recommended to catch drift quickly.

What evidence should I keep for Next.js cookie compliance Spain privacy evidence and monitoring checklist? Keep records of consent choices (with timestamps), cookie inventories, banner configurations, privacy policy versions, and scan reports. GDPRChecker’s paid plans store and export this evidence for you.

Next Steps: Scan Your Next.js Site Today

Achieving and maintaining Next.js cookie compliance in Spain doesn’t have to be overwhelming. With the right checklist and a reliable scanner, you can build a defensible privacy posture. Start by running a free GDPRChecker scan to see where you stand. Then explore our paid plans for managed consent, runtime protection, and automated monitoring.

For more guidance, check out our related guides: - GDPR checklist for small businesses - Google Analytics GDPR compliance - Consent Mode v2 vs Google Certified CMP - Do I need a CMP if I do not run Google Ads? - Cookie banner requirements - Privacy policy requirements

> This guide is technical implementation guidance for website owners. It is not legal advice.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Next.js Cookie Compliance in Spain: Privacy Evidence and Monitoring Checklist", "description": "Practical guide to Next.js cookie compliance in Spain. Learn how to collect privacy evidence, monitor consent, and pass GDPR checks with our step‑by‑step checklist and scanner.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/next-js-cookie-compliance-in-spain-privacy-evidence-and-monitoring-checklist" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice