Webflow Cookie Compliance in Spain: Privacy Evidence and Monitoring Checklist

Introduction

*Updated for 2026 compliance practices.*

If you run a Webflow site that serves visitors in Spain, you need a clear, verifiable approach to cookie compliance. Spanish data protection law enforces the GDPR and the ePrivacy Directive, and the Agencia Española de Protección de Datos (AEPD) has published detailed cookie guidance. This guide gives you a practical **Webflow cookie compliance Spain privacy evidence and monitoring checklist**—a set of steps you can follow to configure consent, collect proof of compliance, and monitor your site over time.

We focus on what you can actually do inside Webflow and with the GDPRChecker scanner: check your cookie banner behavior, verify that tags don’t fire before consent, and confirm that your privacy disclosures are reachable. This is not legal advice; it’s a technical implementation guide for website owners who want to demonstrate compliance.

What Is Webflow Cookie Compliance Spain Privacy Evidence and Monitoring Checklist?

A **Webflow cookie compliance Spain privacy evidence and monitoring checklist** is a structured list of actions that help you:

• Configure a cookie consent banner that meets Spanish and GDPR requirements.
• Block non‑essential cookies and trackers until the visitor gives consent.
• Keep records that show how your consent setup works at a given point in time.
• Regularly scan your site to catch configuration drift, new tags, or broken consent flows.

Because Webflow doesn’t include a built‑in consent management platform (CMP), you must integrate a third‑party CMP and then verify that the integration works correctly. The checklist turns abstract legal obligations into concrete, testable steps.

Spanish Cookie Compliance Requirements at a Glance

Spain’s AEPD aligns with the European Data Protection Board (EDPB) guidelines. In practice, this means:

• **Prior consent**: Non‑essential cookies (analytics, marketing, social media) must not be set or read before the visitor gives affirmative consent.
• **Granular choice**: The banner must offer “Accept all,” “Reject all,” and a way to customize preferences. Pre‑ticked boxes are not valid consent.
• **Clear information**: The banner or a linked cookie policy must explain who places cookies, what they do, and how long they last.
• **Easy withdrawal**: Visitors must be able to change their mind as easily as they gave consent.
• **Evidence**: You need to be able to demonstrate that your setup respects these rules. Screenshots, scan reports, and consent logs are common forms of evidence.

For Webflow site owners, the technical challenge is making sure that third‑party scripts (Google Analytics, Meta Pixel, Hotjar, etc.) honor the consent signal that your CMP sends.

How to Implement Webflow Cookie Compliance Step by Step

1. Choose and Install a Consent Management Platform

Pick a CMP that can block tags before consent and that supports Google Consent Mode v2 if you use Google services. Install the CMP by adding its script in the Webflow site-wide custom code section (Site settings → Custom code → Head code).

**Verification**: After installation, open your site in an incognito window. The banner should appear immediately, and no analytics cookies should be present in the browser’s Application → Cookies view before you interact with the banner.

2. Configure the CMP for Spanish Requirements

• Set the banner language to Spanish (or auto‑detect based on browser language).
• Enable a “Reject all” button that is as prominent as the “Accept all” button.
• Link to your cookie policy and privacy policy from the banner.
• Set the consent duration (often 6–12 months) and configure the banner to reappear after that period or when the policy changes.

3. Block Tags Before Consent

Most CMPs provide a way to block scripts until consent is given. If you use Google Tag Manager (GTM), you can:

• Use the CMP’s GTM template to fire tags only on specific consent events.
• Configure Consent Mode v2 so that Google tags adjust their behavior based on consent state.

For scripts added directly in Webflow custom code, wrap them in a conditional that checks the CMP’s consent cookie. For example:

```javascript if (window.cmpConsent && window.cmpConsent.analytics) { // load analytics script } ```

**Verification**: Use the GDPRChecker scanner to check for pre‑consent network requests. The scanner will flag any requests that fire before the visitor gives consent.

4. Update Your Privacy and Cookie Policies

Your privacy policy must disclose:

• The identity of the data controller.
• The purposes of data processing.
• The legal basis (consent for non‑essential cookies).
• How to withdraw consent.
• A list of cookies with their provider, purpose, and duration.

Link to the privacy policy from your Webflow footer and from the consent banner. For more details, see our privacy policy requirements guide.

5. Test the Reject Flow

Many sites only test the “Accept” path. You must also verify that when a visitor clicks “Reject all,” no non‑essential cookies are set and no tracking requests are sent. Open a fresh incognito window, click “Reject all,” and then:

• Check the browser’s cookie storage.
• Run a GDPRChecker scan to see if any tracking requests were blocked.
• Navigate through several pages to ensure the rejection persists.

Common Mistakes and How to Avoid Them

Mistake 1: Banner Appears but Tags Fire Immediately

Some CMPs load asynchronously, and tags in the `<head>` may fire before the CMP has a chance to block them. To avoid this, place the CMP script as high as possible in the `<head>` and use the CMP’s blocking mechanism rather than relying on GTM triggers alone.

Mistake 2: Missing “Reject All” Button

A banner with only “Accept” and “Settings” does not meet the EDPB standard of “refuse as easily as accept.” Ensure a “Reject all” button is visible on the first layer of the banner.

Mistake 3: Consent Mode Misconfiguration

If you use Google Consent Mode v2 but don’t set the default consent state correctly, Google tags may still set cookies. The default should be `denied` for all non‑essential purposes until the user grants consent. Our Consent Mode v2 vs Google Certified CMP guide explains the technical differences.

Mistake 4: No Evidence of Compliance

A working banner today doesn’t prove it worked last month. Schedule regular scans and save the reports. If you ever face an inquiry from the AEPD, dated scan reports are strong evidence.

Mistake 5: Ignoring Third‑Party Embeds

YouTube videos, Twitter embeds, and other third‑party content often set cookies. Your CMP should block these until consent is given. Test pages with embeds specifically.

How to Validate with GDPRChecker

GDPRChecker scans your public website and reports on:

• **Pre‑consent network requests**: Any requests to known tracking domains that fire before consent.
• **Banner behavior**: Whether a consent banner is detected and whether it offers a reject option.
• **Policy links**: Whether a privacy policy link is present and reachable.
• **Cookie inventory**: A list of cookies set by your site, categorized by purpose.

To validate your Webflow site:

1. Sign up for a GDPRChecker account.
2. Enter your Webflow site URL.
3. Run a scan and review the report.
4. Fix any flagged issues and rescan.

On paid plans, you can also monitor your site continuously, manage your cookie inventory, and generate consent records. The scanner helps you close the gaps we discuss in this guide: the Consent Mode gap, the CMP gap, the cookie banner gap, and the privacy policy gap.

Implementation Checklist

Use this checklist to implement and verify **Webflow cookie compliance Spain privacy evidence and monitoring checklist** on your site.

1. Install a CMP that supports prior blocking and Google Consent Mode v2.
2. Configure the banner with Spanish language, “Reject all” button, and links to policies.
3. Set default consent state to “denied” for all non‑essential purposes.
4. Block all non‑essential tags (GTM, direct scripts, embeds) before consent.
5. Update your privacy policy with controller details, purposes, legal basis, and cookie list.
6. Link the privacy policy from the footer and the consent banner.
7. Test the “Accept all” flow: verify that analytics cookies are set only after consent.
8. Test the “Reject all” flow: verify that no non‑essential cookies are set.
9. Test the “Customize” flow: verify that only the chosen categories are activated.
10. Run a GDPRChecker scan and save the report as evidence.
11. Schedule monthly rescans and review the results.
12. Document your configuration (screenshots, CMP settings export) and store with scan reports.

Comparison: Consent Mode v2 vs. Traditional Blocking

Understanding the difference between Consent Mode and traditional blocking helps you choose the right approach for your Webflow site.

| Feature | Consent Mode v2 | Traditional Blocking | |---------|-----------------|----------------------| | How it works | Google tags adjust behavior based on consent state; no cookies for denied purposes | Tags are completely blocked until consent is given | | Data collection | Sends cookieless pings for modeling (if enabled) | No data sent at all before consent | | Implementation | Requires GTM or gtag.js with consent defaults | CMP blocks script execution | | Best for | Sites that want to recover some analytics data through modeling | Sites that want the strictest privacy‑by‑default approach | | Spanish AEPD view | Acceptable if properly configured and disclosed | Clearly compliant with prior consent requirement |

For most Webflow sites, a combination works well: use Consent Mode v2 for Google services and traditional blocking for other third‑party scripts.

Real‑World Examples

Example 1: Small Business Webflow Site

A Madrid‑based consultancy uses Webflow with Google Analytics and a LinkedIn Insight Tag. They install a CMP with Spanish language, set default consent to denied, and block both tags before consent. After implementation, a GDPRChecker scan shows zero pre‑consent requests. They save the scan report and schedule monthly rescans.

Example 2: E‑commerce Site with Multiple Tags

A Barcelona online store uses Webflow with Facebook Pixel, Google Ads, and Hotjar. They configure Consent Mode v2 for Google tags and use the CMP’s blocking for Facebook and Hotjar. During testing, they discover that the Facebook Pixel fires on page load despite the CMP. They fix this by moving the Pixel to a GTM tag that fires only on consent. A follow‑up GDPRChecker scan confirms the fix.

Example 3: Blog with Embedded Content

A Spanish travel blog embeds YouTube videos and Twitter posts. The CMP blocks the embeds until the visitor accepts marketing cookies. After consent, the embeds load and may set their own cookies. The blog owner adds a note in the cookie policy explaining that third‑party embeds may set additional cookies.

FAQ

What is Webflow cookie compliance Spain privacy evidence and monitoring checklist? It’s a practical set of steps to configure cookie consent on a Webflow site, collect proof that the setup works, and monitor the site for compliance with Spanish data protection law. The checklist covers banner configuration, tag blocking, policy updates, and regular scanning.

Do I need Webflow cookie compliance Spain privacy evidence and monitoring checklist for GDPR? Yes, if your Webflow site serves users in Spain, you must comply with the GDPR and the Spanish ePrivacy implementation. The checklist helps you meet the requirements for prior consent, transparency, and accountability by giving you a repeatable verification process.

How do I implement Webflow cookie compliance Spain privacy evidence and monitoring checklist? Start by installing a CMP, configuring it for Spanish requirements, and blocking tags before consent. Update your privacy policy, test all consent flows, and run a GDPRChecker scan. Save the scan report and repeat regularly. The full step‑by‑step is in the implementation section above.

How can I verify Webflow cookie compliance Spain privacy evidence and monitoring checklist with a scanner? Use GDPRChecker to scan your public site. It checks for pre‑consent network requests, banner presence, reject options, and policy links. After fixing issues, rescan and compare reports. Paid plans offer continuous monitoring and consent records.

What are common Webflow cookie compliance Spain privacy evidence and monitoring checklist mistakes? Common mistakes include tags firing before consent, missing “Reject all” button, incorrect Consent Mode defaults, lack of evidence, and ignoring third‑party embeds. Each mistake can be caught by testing and scanning as described in the common mistakes section.

Which cookies and trackers should I check for Webflow cookie compliance Spain privacy evidence and monitoring checklist? Check all non‑essential cookies and trackers: analytics (Google Analytics, Hotjar), marketing (Facebook Pixel, Google Ads), social media embeds, and any other third‑party scripts. Essential cookies (like session cookies for login) do not require consent but must be disclosed.

How often should I review Webflow cookie compliance Spain privacy evidence and monitoring checklist? Review your setup at least monthly, and after any site changes (new tags, updated CMP, design changes). Schedule regular GDPRChecker scans and keep dated reports. If you change your privacy policy or add new third‑party services, review immediately.

What evidence should I keep for Webflow cookie compliance Spain privacy evidence and monitoring checklist? Keep dated GDPRChecker scan reports, screenshots of your banner and consent flows, CMP configuration exports, and records of any updates. This evidence demonstrates your compliance efforts over time and can be crucial if you receive an inquiry from the AEPD.

Keeping Your Webflow Site Compliant Over Time

Compliance is not a one‑time project. Webflow sites evolve: you add new pages, embed new tools, or update your CMP. Each change can break your consent setup. By following this **Webflow cookie compliance Spain privacy evidence and monitoring checklist** and using GDPRChecker to verify your site regularly, you can maintain a strong privacy posture.

For more foundational steps, see our GDPR checklist for small businesses. If you use Google Analytics, our Google Analytics GDPR compliance guide covers specific configuration details. And if you’re unsure whether you need a CMP at all, read Do I need a CMP if I do not run Google Ads?.

Start your verification today: run a free GDPRChecker scan on your Webflow site and get a clear report on your cookie compliance status.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Webflow Cookie Compliance in Spain: Privacy Evidence and Monitoring Checklist", "description": "A practical guide to Webflow cookie compliance in Spain. Learn how to implement consent, collect privacy evidence, and monitor your site with a step-by-step checklist and GDPRChecker scans.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/webflow-cookie-compliance-in-spain-privacy-evidence-and-monitoring-checklist" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice