Spain Website Legal Checklist: LSSI, GDPR and Cookies

Any business website aimed at people in Spain has to meet a few legal requirements, whether it’s a one-page site for a restaurant or a full online store. This checklist summarizes the main rules in plain English, so you can review your site or brief your web team and lawyer.

Key takeaway

Website compliance in Spain comes down to transparency and choice: identify your business in a legal notice (LSSI-CE), explain what personal data you collect and why in a privacy policy (GDPR and LOPDGDD), and load nothing non-essential until the visitor accepts cookies, with rejecting as easy as accepting. Online stores must also give consumers the information and the withdrawal right (generally 14 calendar days) that Spanish consumer law requires, in every language of the site.

The laws that apply

Four sets of rules apply to most business websites in Spain:

• LSSI-CE: Ley 34/2002, de servicios de la sociedad de la información y de comercio electrónico. It covers websites linked to an economic activity: identification information, commercial emails, online contracting and cookies.
• GDPR: the EU General Data Protection Regulation (Regulation (EU) 2016/679), which governs any processing of personal data.
• LOPDGDD: Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales, the Spanish law that adapts and complements the GDPR.
• Consumer law: for online stores, mainly the consolidated General Law for the Defense of Consumers and Users (Real Decreto Legislativo 1/2007).

The Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) supervises data protection and cookies, and publishes the reference cookie guide.

Legal notice (aviso legal)

Article 10 of the LSSI requires the website owner to give users permanent, easy, direct and free access to basic identification information. This usually goes on an “Aviso legal” (legal notice) page linked from every page’s footer:

• Name or company name (razón social)
• Address (domicilio)
• Email address and any other details that allow direct, effective contact
• Tax ID (NIF; for companies this used to be called the CIF)
• Commercial Registry details or those of another public registry, where applicable
• Professional details if you work in a regulated profession, and authorization details if your activity requires prior authorization
• Prices, if shown, stated clearly with taxes and delivery costs

Privacy policy (GDPR and LOPDGDD)

If your site collects personal data (forms, newsletters, orders, analytics), you need a privacy policy: GDPR articles 13 and 14 require you to explain how you handle that data. A privacy policy should cover:

• Who the controller is and how to contact them, plus the Data Protection Officer if you have appointed one
• Purposes: what you use each type of data for (answering inquiries, orders, newsletters)
• Legal basis for each purpose: consent, performance of a contract, legal obligation or legitimate interest
• Recipients: who else receives the data (hosting, email, payment or analytics providers) and any transfers outside the European Economic Area
• Retention: how long you keep the data, or the criteria used to decide
• Rights: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and how to exercise them
• The right to complain to the AEPD

Article 11 of the LOPDGDD allows a layered approach: a short first layer where the data is collected, with at least the controller’s identity, the purpose and the rights users can exercise, plus a link that gives easy, immediate access to the full policy.

Cookies and consent

In Spain, non-essential cookies may only be used after the visitor consents. The rule comes from article 22.2 of the LSSI, and the AEPD’s cookie guide (Guía sobre el uso de las cookies, in Spanish, last updated in May 2024) explains how to apply it. The key rules:

• No non-essential cookies before consent. Cookies strictly needed for the site to work (session, shopping cart, security, remembering the consent choice) are exempt. Analytics, advertising and social media cookies are not, and they must not load until the user accepts.
• A clear banner. Explain briefly what cookies are used for and offer choices on the first layer. Rejecting must be as easy as accepting, for example with “Accept” and “Reject” buttons of equal prominence. Continuing to browse is not valid consent, and options must not be pre-selected.
• A cookie policy listing the cookies you use, who sets them (you or third parties), their purpose and duration, and how to withdraw consent.
• A way to change consent at any time, such as a “Cookie settings” link in the footer that reopens the choices.
• Third-party tools count too. Embedded videos, maps, chat widgets (including AI customer service chatbots), ad pixels and analytics tags can all set cookies; if those cookies aren’t strictly necessary, ask for consent first, for example by loading the embed only after a click.

Contact forms

A contact form collects personal data, so it needs information at the point of collection, only the fields you need and unticked consent boxes:

• Inform at the point of collection. Next to the form, show a short first-layer notice: controller, purpose, legal basis, rights and a link to the privacy policy.
• Ask only for what you need. Name, email and message are often enough.
• Use checkboxes correctly. Where you use a checkbox to confirm the user has read the privacy policy, it must not be pre-ticked. If you also want to send marketing emails, ask with a separate, unticked checkbox: article 21 of the LSSI prohibits commercial emails that the recipient has not previously requested or expressly authorized, with the main exception of existing customers receiving offers for similar products or services.
• Know where the data goes: which inbox or system receives the messages, who can access them and how long you keep them. Name the providers involved in your privacy policy.
• Cover anti-spam tools in your policies if they process visitor data or set cookies.

Online stores: consumer-law basics

Online stores that sell to consumers must also meet Spanish consumer law, which adds pre-contractual information, withdrawal rights and a clear ordering process. At a high level, check for:

• Terms and conditions of sale (condiciones generales de contratación), available before purchase in a form customers can save
• Pre-contractual information: your identity and contact details, the main characteristics of the products, the total price including VAT (IVA) and any delivery costs, and payment and delivery arrangements
• Right of withdrawal information: under article 102 of the consumer law, consumers can generally withdraw from a distance purchase within 14 calendar days without giving a reason. Explain how, provide the model withdrawal form and state any legal exceptions that apply to your products
• Legal guarantee information for the products you sell
• A clear ordering process: the steps to follow, how to correct input errors, the languages available, a final order button that clearly signals an obligation to pay, and a confirmation after purchase

These points come mainly from Real Decreto Legislativo 1/2007 and articles 27 and 28 of the LSSI. If you’re still deciding where to sell, our comparison of your own online store vs a marketplace covers the options in Spain.

Multilingual sites and a final checklist

If your site is in several languages, such as Spanish, English and Chinese, publish the legal notice, policies, banner and form notices in each of them, saying the same thing. Review them whenever you add a tool such as Google Analytics, an ad pixel, a chat widget or a newsletter.

Before publishing, check that you have:

1. A legal notice with the LSSI identification details, linked in the footer
2. A privacy policy with all GDPR information, including the right to complain to the AEPD
3. A cookie banner: nothing non-essential before consent, rejecting as easy as accepting
4. A cookie policy and a “Cookie settings” link
5. Contact forms with first-layer information and no pre-ticked boxes
6. For online stores: terms of sale, withdrawal information, prices including VAT
7. Legal texts in every language of the site

FAQ

Does a small business website in Spain need a legal notice?

Generally, yes. If the website is linked to an economic activity, including simply presenting your business, the LSSI identification requirements apply regardless of company size.

Can I use Google Analytics without cookie consent in Spain?

Generally, no. A standard Google Analytics setup uses non-essential analytics cookies, so under the AEPD’s guidance it should only load after the visitor accepts. Configure your banner to block it until then.

Do I need a cookie banner if I only use technical cookies?

If your site only uses strictly necessary cookies, no consent is required, so you don’t need a consent banner. It’s still good practice to describe those cookies in a cookie policy. Check carefully, though: embedded content and third-party tools often add unexpected cookies.

UsualMatrix builds websites for businesses in Spain with consent-first cookie banners, clear contact forms and legal pages in every language of the site, working in Chinese, Spanish and English. See our web design service or contact us to talk about your website.

Important: this article is general information about Spanish and EU rules at the date of the last update, not legal advice. What applies depends on your business, your sector and how your website works, so have a lawyer or data protection specialist confirm the requirements for your case.