[Enforcement library](/enforcement)

# NH Hotel Group: a toggle set to off still meant yes

Spain's AEPD found NH Hotel Group's site set non-essential cookies before consent and kept setting them after users switched categories off. It proposed a EUR 10,000 fine; NH paid EUR 8,000 early, ending the case.

## Key facts

- **Regulator or court:** Agencia Española de Protección de Datos (AEPD)
- **Jurisdiction:** Spain
- **Framework:** Spanish LSSI Article 22(2) (Law 34/2002)
- **Record date:** 2024-03-22
- **Procedural status:** Closed after voluntary payment of the reduced fine; administrative appeal waived

Switching every optional category to off and pressing the only button, Si, acepto, still set the same cookies. Spain's regulator treated that as no real choice at all.

AEPD · LSSI Article 22(2) · Voluntary payment 22 March 2024

- The problem
- Case record
- What the regulator found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

AEPD inspectors visited nh-hotels.com/es with a cleared browser. Before any choice, the site used analytics, functional and third-party cookies. In the settings panel the optional groups were pre-set to off, but the only button was \<\<Si, acepto>>; pressing it with every toggle off left "las mismas cookies detectadas al principio" (the same cookies detected at the start) ([AEPD resolution PS/00490/2023](https://www.aepd.es/documento/ps-00490-2023.pdf)).

## Case record

| Field | Record |
| --- | --- |
| Authority | Agencia Española de Protección de Datos (AEPD) |
| Jurisdiction | Spain |
| Reference | PS/00490/2023; EXP202315772 |
| Party | NH Hotel Group S.A., owner of nh-hotels.com/es |
| Law | LSSI Article 22(2), classed as a minor infringement under Article 38.4(g) |
| Stage | Terminated after voluntary payment on 22 March 2024 |
| Amount | EUR 10,000 proposed; EUR 8,000 paid |
| Source review | 20 October 2026 |

## What the regulator found

The proposed resolution of 1 March 2024 found three failings, which together breach LSSI Article 22(2):

- **Cookies before consent.** Google cookies (SOCS, NID, CONSENT, AEC) and third-party cookies from Tealium, Akamai and Qubit were used before any choice.
- **No real refusal or granular choice.** The panel's only action was \<\<Si, acepto>>, and it set the same cookies with every optional group switched off.
- **No withdrawal.** After consenting, switching groups back to off and saving still left non-essential cookies in use.

NH argued the Google cookies supported reCAPTCHA bot detection and were exempt under Article 29 Working Party guidance, and that the remaining cookies were technical or functional. The AEPD rejected this: the Google cookies collect information used for other purposes, and the Tealium, Akamai and Qubit cookies were used without consent. On the banner's first-layer text, the AEPD found it identified purposes and how to accept, configure or reject, and did not itself breach the rules.

## Technical issue

- **Tools or vendors:** Google (SOCS, NID, CONSENT, AEC), Tealium (TAPID, used to follow visitors across domains), Akamai (RT, bm\_sv), Qubit (qb\_permanent, qb\_session, \_qubitTracker, qb\_generic).
- **Where:** nh-hotels.com/es, first visit and the cookie settings panel.
- **When:** AEPD inspection on 11 December 2023 and re-check on 15 February 2024.

**Inth's technical interpretation:** the toggles changed what the panel displayed but not what the page loaded. Tags were already firing at page load, and the panel's single button wrote an "accepted" state without reading the toggles. Both the save handler and the tag loader need to read the same per-category state.

```javascript
// Panel toggles are ignored: the only button grants everything
saveButton.onclick = () => consent.grant(['analytics', 'marketing']);
loadTag('tealium'); // runs on page load regardless

// Save what the toggles say, and gate each tag on it
saveButton.onclick = () => {
  const chosen = toggles.filter(t => t.checked).map(t => t.category);
  consent.set({ granted: chosen });
};
consent.onChange(state => {
  if (state.granted.includes('analytics')) loadTag('tealium');
});
```

Illustrative pattern, not the defendant's code. Generic consent API, not a specific c15t call.

## Timeline

| Date | Event |
| --- | --- |
| 11 December 2023 | AEPD Inspection Subdirectorate checks nh-hotels.com/es |
| 24 January 2024 | Director opens sanctioning proceedings (the proposal states 25 January); provisional fine EUR 10,000 |
| 14 February 2024 | NH Hotel Group files submissions |
| 15 February 2024 | AEPD re-checks the site; cookies still used before consent |
| 1 March 2024 | Proposed resolution: EUR 10,000 fine |
| 22 March 2024 | NH pays EUR 8,000 using the 20% voluntary-payment reduction |
| Not stated | Resolution terminating proceeding EXP202315772 |

## Outcome

The AEPD terminated the proceeding under Article 85 of Law 39/2015 after voluntary payment. Paying early meant waiving any administrative action or appeal against the sanction. The resolution leaves open a contentious-administrative appeal to the Audiencia Nacional within two months of notification. No corrective order is recorded in the resolution.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Proposed fine | EUR 10,000 | \[AEPD resolution\](https://www.aepd.es/documento/ps-00490-2023.pdf) |
| Amount paid | EUR 8,000 (20% reduction) | \[AEPD resolution\](https://www.aepd.es/documento/ps-00490-2023.pdf) |
| Remediation | Not stated in the cited record |  |

## Why it matters

- **The panel has to work.** A settings panel with toggles that do nothing is treated as no choice, even when the first-layer text is acceptable.
- **Withdrawal is tested.** The AEPD switched categories back to off after consenting and checked again.
- **reCAPTCHA is not a blanket exemption.** Claiming Google cookies serve bot detection did not exempt them, given how the information is used.

Related issue pages: [Cookies before choice or after refusal](/enforcement/issues/cookies-before-choice-or-after-refusal), [Failed opt-out controls](/enforcement/issues/failed-opt-out-controls).

## How Inth catches this

- **Consent banner:** holds analytics and marketing tags until their category is granted, saves the per-category state the visitor chose, and removes the grant on withdrawal.
- **Website audit:** loads the site in a clean profile, records cookies and requests before any choice, after reject, and after withdrawal, and flags non-essential vendors in each state.
- **Evidence:** consent records with choice, country and banner version, plus per-state cookie and request observations.

Limit: whether a specific cookie is strictly necessary is a legal judgement; Inth reports which cookies were set and when.

## Checks for your own systems

### In the repository

- Check that the preferences panel's save handler reads every toggle.
- List tags that load outside the consent gate, including reCAPTCHA, tag managers and CDN scripts that set cookies.

### In the browser and network

- Switch every optional toggle off, save, reload and compare cookies with a first visit.
- Consent, then withdraw, and confirm Tealium, Akamai-style and analytics cookies stop being set or read.

### With the people responsible

- Document which cookies you treat as strictly necessary and why.
- Agree who retests withdrawal after each banner release.

## Sources and limits

- [AEPD resolution terminating proceeding PS/00490/2023 (EXP202315772)](https://www.aepd.es/documento/ps-00490-2023.pdf), including the proposed resolution of 1 March 2024 (Spanish)

Dating: secondary coverage seen in September 2026 described this as a new decision. The AEPD resolution itself records payment on 22 March 2024, and we found no 2026 decision against NH Hotel Group. The PDF on the AEPD site was last modified on 6 May 2026; the resolution's own date is not shown in the text. The PDF contains small errors ("15/02/23" for the re-check, and "8.000 euros (cuatro mil euros)"); the figures here follow the payment record. Spain is not yet a value in the library's jurisdiction filter, so this draft has no typed jurisdiction. Translations from Spanish are ours.

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit NH Hotel Group's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Orange](/enforcement/orange), [Cookies before choice or after refusal](/enforcement/issues/cookies-before-choice-or-after-refusal), [GDPR and ePrivacy cookies](/enforcement/laws/gdpr-and-eprivacy-cookies).