Your hotel website's cookie banner in 2026: what Spain, Portugal, Italy and Greece require

Updated: 9 November 2026

Almost every hotel website uses cookies that are not essential: analytics, embedded maps and videos, social media or advertising pixels. Those need the visitor's permission, and data protection authorities check how it is asked for. This is what their own guidance says (sources at the end). This is not legal advice: for a specific question, ask your adviser.

Which cookies need permission

Only cookies strictly necessary for the service the visitor requests (for example, remembering dates while booking or form security) can be used without consent. Advertising and social media cookies are not, and analytics cookies usually are not either. Consent is asked per purpose, and withdrawing it must be as easy as giving it.

What all the authorities ask for

A reject button as easy as the accept button: Spain's AEPD requires them to be 'at the same level' since 11 January 2024, and the Hellenic DPA asks for the same number of clicks from the same layer.
No pre-ticked boxes: they do not give valid consent.
Continuing to browse or scrolling is not consent.
No cookie wall (blocking the site unless cookies are accepted): in principle it is not valid.
Colours and wording that do not push towards accepting: contrast that makes the reject option unreadable is considered misleading.
A permanent link or icon to change your mind at any time.
'Legitimate interest' cannot be used to set cookies without permission.

Country specifics

Spain: article 22.2 of the LSSI applies, enforced by the AEPD, which has closed cases with a warning and a deadline to fix the site.
Italy: closing the banner with the X means reject, and the banner cannot reappear for 6 months once the visitor has chosen (Garante, 2021).
Greece: article 4(5) of law 3471/2006 applies; in 2022 the authority checked 30 high-traffic sites and gave them 15 days to comply, and it recommends buttons of the same size and colour.
Portugal: we found no specific guidance from the authority (CNPD); the same European rules apply.

If you use Google Ads or Google Analytics

Google requires advertisers to obtain consent from visitors in the European Economic Area and pass it on; if you run your own banner, it asks you to implement 'consent mode v2'. Ask whoever manages your website whether it is set up.

5-minute check

Open your site in a private window: does the banner show 'Accept' and 'Reject' on the first screen?
Click 'Reject' and see whether the Google map, videos or chat still load: if they set third-party cookies, they must be blocked until accepted.
Look for the link to change preferences (usually in the footer).
Check that the text says what each type of cookie is for and who sets it.

How iQuota helps

The official booking page iQuota creates for your property is designed to be read well by AI and travellers; your own website is still yours and should follow these rules. Nobody can guarantee that an AI will recommend you, but a clear, compliant website is a good base.

Want an official booking page AI can read and a connector with your real prices, commission-free? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Do I need a banner if I only use technical cookies?

If you really only use strictly necessary cookies, you do not need to ask for consent, although you should still describe them in your cookie policy.

Is a banner with only 'Accept' enough?

No. The authorities ask for an equally easy way to reject; Spain's AEPD and the Hellenic DPA, at the same level.

Can I use a free cookie plugin?

Yes, as long as it is set up to block non-essential cookies until the visitor accepts and shows the reject button on the first layer.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά