I checked 61 Marbella property websites. Four in ten track you before you say yes
25 of 61 sites set tracking cookies before the visitor agreed to anything
- 12No cookie banner at all
- 13Had a banner, tracked anyway
- 36No tracking before consent
On 7 October 2026 I went through 61 websites of estate agencies, law firms and tax advisers in Marbella, Estepona, Benahavís and San Pedro de Alcántara (44 agencies and 17 advisers). I opened each one from Spain as a first-time visitor, didn’t click anything, and then looked at what the site had already done and what its legal pages said.
I’m not naming anyone. Most of these problems are common and easy to fix, and singling out a few businesses wouldn’t help much.
The numbers
| What I checked | Sites |
|---|---|
| Set analytics or advertising cookies before the visitor agreed to anything | 25 of 61 (41%) |
| …and showed no cookie banner at all | 12 of 61 (20%) |
| Showed a cookie banner with no way to reject on the first screen | 7 of 41 banners (17%) |
| Got cookies fully right: a banner, a reject button, and no tracking before consent | 28 of 61 (46%) |
| No company tax ID (NIF/CIF) on the home page or any legal page it links to | 17 of 61 (28%) |
| Law firms that name their bar association on the home page or legal notice | 1 of 15 |
| Home page heavier than 5 MB | 20 of 61 (33%) |
Agencies and advisers came out almost the same, and the law firms did no better than the estate agents.
Tracking before asking
Under Spanish law (article 22.2 of the LSSI, read with the GDPR) a website needs your consent before it stores cookies that aren’t strictly necessary, and Google Analytics and the Facebook pixel don’t count as necessary.
25 of the 61 sites had already set Google Analytics, Google Ads or Facebook cookies by the time the page finished loading. Nine of them load the Facebook pixel. Two also dropped advertising cookies from Criteo and Bing, and one of those added LinkedIn.
Twelve of the 25 had no cookie banner, so the tracking simply runs. The other 13 had a banner, but the cookies were set anyway, which means the banner isn’t wired up to anything. I find those the more annoying ones, because somebody paid for a consent tool that isn’t doing its job.
Fixing it is usually quick. CookieYes, Cookiebot, Complianz, CookieScript and most other consent tools can hold analytics back until the visitor accepts, or put Google’s tags into consent mode. Often it’s one setting.
Rejecting should be as easy as accepting
The cookie guide from the Spanish data protection agency (AEPD, updated in 2023) says you have to be able to reject cookies as easily as you accept them, on the same first screen. An “Accept” button next to a “Settings” link doesn’t meet that.
41 sites showed a banner and 34 of them got this right, with “Reject all”, “Decline” or “Necessary only” next to “Accept”. The other seven only offered “Accept”, “I agree”, “OK” or a link to settings.
Who owns the site?
Article 10 of the LSSI says any business website in Spain has to show who is behind it: name, tax ID (NIF or CIF), address, a contact email and, for companies, the registry details. In Spain this goes in the aviso legal.
On 17 of the 61 sites I couldn’t find a tax ID anywhere, either on the home page or on any legal, privacy, terms or cookie page linked from it. One still had the template’s “B-xxx” where the number should be.
If you’re about to send a deposit on a flat, or hire a lawyer, you’re entitled to know which company you’re dealing with. And a half-empty legal notice is an easy thing for a competitor or an unhappy client to point at.
Lawyers have an extra line
For regulated professions, article 10 also asks for the professional body the practitioner belongs to and their professional title. For a Spanish lawyer, that’s the colegio de abogados.
Only one of the 15 law firms names its bar association on the home page or in its legal notice. Two more mention it elsewhere, on a team or about page. It’s one line of text, and for a firm with foreign clients it’s worth having anyway, since it shows who regulates them.
Page weight
The median home page was 2.6 MB. A third were over 5 MB, six were over 10 MB, and the heaviest came to 32.7 MB, mostly photos and video that hadn’t been compressed. That’s fine on office fibre, but a lot of buyers see a listing for the first time on their phone, sometimes on a poor connection, and there it shows.
A property site obviously needs big photos. It doesn’t need to send a 6,000-pixel original to a phone that displays it at 400.
What most sites got right
Every site used HTTPS, and all but one worked on a phone. Almost half had cookies completely right. None of the problems above needs a new website. Most come down to a setting in the consent tool, a few lines in the legal notice, or exporting images at a sensible size.
If you run a site like these, this free check does the first few for you in about 30 seconds. To go through them by hand:
- Open your site in a private window, don’t click anything, and look for Google Analytics or Facebook cookies (your browser’s developer tools list them under Application or Storage). If they’re there, your consent tool isn’t blocking them.
- Make sure your banner has a “Reject” button on its first screen, next to “Accept”.
- Read your aviso legal as a stranger would and check the company name, NIF/CIF, address, email and registry details are all filled in.
- If you’re a lawyer, add your colegio.
- Run your home page through PageSpeed Insights (it’s free) and resize the biggest images.
How I measured this
The sample was 61 websites of estate agencies (44), law firms (15) and tax advisers (2) with offices in Marbella, Estepona, Benahavís or San Pedro de Alcántara. I checked them on 7 October 2026 from Spain, using a fresh Chrome profile for each site and clicking nothing.
I counted a site as tracking if, once the page had loaded and gone quiet, it had cookies from Google
Analytics (_ga, _gid, _gat), Google Ads (_gcl_au), the Facebook pixel (_fbp), Hotjar, or the
Criteo, Bing or LinkedIn ad networks. I didn’t count functional cookies like sessions, language or the
consent tool’s own.
A cookie banner meant a fixed or floating element that mentions cookies and has at least one button. I went back over every “no banner” and “no reject” result by hand, against a screenshot.
For the tax ID I looked for a Spanish NIF, CIF or NIE on the home page or on any linked legal notice, privacy policy, terms or cookie page. Page weight is the total bytes transferred for the home page, measured once over a single connection.
It’s one day, from one location, and sites change. It isn’t legal advice either. If you think I’ve got your site wrong, email me and I’ll check it again.