If you run a business in Spain, your website must follow Spanish rules, whatever language it is written in. Three pages are expected: the aviso legal (legal notice), the privacy policy and the cookie policy. This guide explains what each must contain, with the exact article behind every obligation, and ends with a checklist you can use on your own site. It gives general information as of September 2026 and is not legal advice.
Does this apply if you do not sell online?
Yes. Law 34/2002 on information society services (LSSI) applies to providers established in Spain (article 2). Its annex also covers services the user does not pay for, as long as they are an economic activity for the provider, so a website presenting your services falls within its scope. If you also collect personal data, for example through a contact form, the General Data Protection Regulation (GDPR, called RGPD in Spain) and Spain's Organic Law 3/2018 on data protection (LOPDGDD) apply as well.
The aviso legal: the details required by article 10 LSSI
Article 10.1 of the LSSI requires permanent, easy, direct and free access to: your name or company name; your residence or registered address or, failing that, the address of a permanent establishment in Spain; your email address and any other detail allowing direct and effective communication; your NIF, the Spanish tax identification number; your entry in the Registro Mercantil (Companies Register) or another public register, if applicable; details of any prior administrative authorisation your activity needs and of the supervising body; and any codes of conduct you have signed up to.
If you publish prices, article 10.1.f requires them to be clear and accurate, stating whether applicable taxes and, where relevant, delivery costs are included. The practical solution is a legal notice page linked from the footer of every page, which article 10.2 treats as meeting the obligation. If your clients read Spanish, offering these pages in Spanish as well is a sensible choice.
Regulated and health professions
If you practise a regulated profession, such as health psychology, physiotherapy, dentistry or nursing, article 10.1.d of the LSSI adds: your professional association (colegio) and membership number (número de colegiado); your qualification; the EU or EEA state that issued it and, where applicable, its recognition; and the professional rules that apply to you and where to consult them. If your practice needs a health authorisation from the regional government (article 3 of Royal Decree 1277/2003), give its details and the issuing body (article 10.1.c LSSI). As health data is a special category (article 9 GDPR), ask only for what is essential.
Privacy policy: what article 13 GDPR requires
When you collect someone's data, article 13 GDPR requires you to tell them, at that moment: your identity and contact details as controller and, if you have one, those of your data protection officer; the purposes and legal basis of the processing; your legitimate interests, if that is the basis; the recipients, such as your hosting or email provider; any transfers outside the European Union; how long you will keep the data or the criteria used to decide; the rights of access, rectification, erasure, restriction, objection and portability; the right to withdraw consent; the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD); whether providing the data is required and what happens if it is not; and any automated decision-making or profiling.
Contact forms: layered information and unticked boxes
You do not need to paste all of that beside the form. Article 11 of the LOPDGDD allows basic information, covering the controller, the purpose and how to exercise the rights in articles 15 to 22 GDPR, plus a link to the full policy. To answer an enquiry, the legal basis is usually a pre-contractual step requested by the person or their consent (article 6.1 GDPR).
To send promotions, ask for separate consent: article 21 of the LSSI prohibits commercial emails that were neither requested nor expressly authorised, except to existing customers about similar products, and recital 32 GDPR states that pre-ticked boxes do not constitute consent. In practice: a separate box, unticked by default.
Cookies: consent that means something
Article 22.2 of the LSSI only allows cookies if the user consents after receiving clear and complete information about their purposes. Cookies strictly necessary for the service the user has asked for, such as session cookies or those remembering the chosen language, are exempt. The AEPD's cookie guide (Guía sobre el uso de las cookies, updated in May 2024) sets out the rules: no non-exempt cookies until the user accepts; a Reject button in the same layer, at the same level and with the same visibility as Accept; carrying on browsing is not consent; no pre-ticked options; withdrawing consent must be as easy as giving it; and no cookie walls without an alternative.
Analytics cookies: a narrow exemption
The AEPD guide points out that analytics cookies are not, in principle, exempt. Its document on audience measurement tools (January 2024) only allows an exemption if they are limited to measuring audience solely on behalf of the site owner, produce anonymous statistics, are not combined with other data, are not passed to third parties and do not track users across sites. Otherwise, ask for consent, as you would for embedded videos, maps or social media pixels.
Does the accessibility law (Law 11/2023) apply to you?
Law 11/2023, which transposes the European Accessibility Act (Directive (EU) 2019/882), has applied since 28 June 2025. Its article 2.2 lists specific services provided to consumers, including e-commerce, meaning contracts concluded at a distance through a website or app; a site that simply presents your services is not, as such, on that list. In addition, article 3.3 exempts microenterprises that provide services, and Annex VII of Law 11/2023 defines a microenterprise as one employing fewer than 10 people with an annual turnover or annual balance sheet total not exceeding €2 million. If you are not a microenterprise and sell online to consumers, it may apply to you; if in doubt, ask a professional.
What is at stake: penalties
Article 39 of the LSSI sets the fines: up to €30,000 for minor infringements, €30,001 to €150,000 for serious ones and €150,001 to €600,000 for very serious ones. Failing to show the article 10 details is generally minor (article 38.4.b), and serious if the failure on identity, contact details or prices is significant (article 38.3.b). Using cookies without information or consent is minor (article 38.4.g) and serious if repeated within three years of a final decision (article 38.3.i); these cases are sanctioned by the AEPD (article 43.1). The authority may instead issue a warning with a deadline to put things right (article 39 ter). Under data protection law, failing to inform at all is very serious (article 72.1.h LOPDGDD) and incomplete information is minor (article 74.a), with fines set under article 83 GDPR.
Checklist for your website
| Item | Where on the site | Legal basis |
|---|---|---|
| Name or company name, address, email, other direct contact and NIF | Aviso legal, linked in the footer | Art. 10.1.a and e LSSI |
| Companies Register or other public register, if applicable | Aviso legal | Art. 10.1.b LSSI |
| Prior authorisation and supervising body, if applicable | Aviso legal | Art. 10.1.c LSSI |
| Professional association, membership number, qualification and professional rules | Aviso legal | Art. 10.1.d LSSI |
| Clear prices, stating whether taxes are included | Prices or services page | Art. 10.1.f LSSI |
| Full privacy policy | Own page, linked in the footer | Art. 13 GDPR |
| Basic information with a link to the policy | Next to every form | Art. 11 LOPDGDD |
| Separate unticked box for promotions | Form | Art. 21 LSSI; recital 32 GDPR |
| Banner with Accept and Reject at the same level | First visit | Art. 22.2 LSSI; AEPD guide |
| Cookie policy and permanent access to settings | Own page and footer | Art. 22.2 LSSI; AEPD guide |
| Accessibility, if you sell online to consumers and are not a microenterprise | Whole site | Arts. 2.2 and 3.3 Law 11/2023 |
Official sources checked on 28 September 2026: Law 34/2002 (LSSI, BOE consolidated text), Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), Law 11/2023, Royal Decree 1277/2003 and the AEPD guides on cookies (May 2024) and audience measurement (January 2024).
These three pages say who you are, explain what you do with personal data and respect each visitor's choice. At WebAutonomos, the legal notice, privacy policy and cookie policy are included in every website. We create the design and write the texts from your real details; you remain responsible for making sure that information is accurate and up to date. You can choose €15 a month with no setup fee and no lock-in, or €349 paid once, with the same services: hosting, SSL certificate, daily backups and maintenance included, plus one change a month. We prepare a demo in under 24 hours, and you only pay once you have approved it.