Website legal requirements in Spain: a plain-English checklist

The laws that apply

The LSSI applies as soon as your website is linked to an economic activity: selling, advertising your services or even showing ads. In practice, that's any business website, including a freelancer's.

1. Legal notice (aviso legal)

The LSSI requires your website to show, in an easily accessible place (usually a footer link), who is behind it:

• Full name or company name.
• Tax ID: NIF (or NIE for a foreign autónomo), or the company's CIF/NIF.
• Address and an email or other direct contact method.
• For companies, details from the Registro Mercantil (Commercial Register).
• For regulated professions (lawyers, doctors, architects…), your professional association, membership number and the professional title held.
• If you need a licence or authorisation for your activity, the details of it.

2. Privacy policy

If your website collects any personal data (a contact form, a newsletter, a booking system), you need a privacy policy that explains, clearly and concisely:

• Who is responsible for the data (the data controller) and how to contact them.
• What data you collect and what for.
• The legal basis (consent, a contract, a legal obligation, legitimate interest).
• How long you keep it.
• Who you share it with (for example, your email or hosting provider) and whether it leaves the EU.
• People's rights (access, rectification, erasure, objection, portability…) and how to exercise them, plus the right to complain to the Spanish data protection authority, the AEPD.

On forms, add a short first-layer notice next to the submit button with a link to the full policy. If you want to send marketing emails, consent must be a separate, unticked checkbox.

3. Cookies and the cookie banner

Under the LSSI and the AEPD's cookie guidance, you may only use cookies that aren't strictly necessary (analytics, advertising, social media embeds) after the visitor has given consent. In practice, your banner should:

• Appear before non-essential cookies load.
• Offer "Accept" and "Reject" with equal prominence on the first layer.
• Let people configure cookies by type.
• Not treat scrolling or continuing to browse as consent.
• Link to a cookie policy listing the cookies used, their purpose and duration.
• Let visitors change their mind later (for example, a link in the footer).

The AEPD regularly fines businesses for cookie banners that don't meet these rules, so this is worth getting right.

4. If you sell online

• Terms and conditions of sale: who you are, the product, prices including VAT, delivery costs and times, payment methods.
• Right of withdrawal: consumers generally have 14 calendar days to return goods without giving a reason, with a model withdrawal form. Some products (custom-made, perishable, unsealed hygiene items…) are exceptions.
• Legal guarantee information for goods.
• A clear "order with obligation to pay" button and an order confirmation.
• Invoices for every sale.

If you're starting from scratch, our guide on how to sell online (in Spanish) covers the practical side, and our online store service sets up the shop.

5. Accessibility

Spain's Ley 11/2023, which transposes the European Accessibility Act, requires some products and services, including many online shops, to meet accessibility standards from 28 June 2025. Microenterprises (fewer than 10 employees and no more than €2 million turnover) providing services are exempt. Even if you're exempt, an accessible website (readable text, good contrast, alt text on images, keyboard navigation) is simply a better website for everyone.

What about language?

If your website is in English because your clients are international or expats, that's fine. But if you also sell to Spanish consumers, it's safest to offer the legal pages and terms of sale in Spanish as well, so every customer can understand what they're agreeing to. A bilingual site handles this naturally.

Checklist

1. Legal notice with your name, NIF/NIE/CIF, address and contact.
2. Privacy policy, plus a short notice on every form.
3. Cookie banner with accept and reject at the same level, and a cookie policy.
4. Separate, unticked consent for marketing emails.
5. Terms of sale and withdrawal information if you sell online.
6. HTTPS on the whole site; see what is an SSL certificate (in Spanish).
7. Links to all of the above in the footer of every page.

Planning these pages from the start is much easier than retrofitting them. If you need a website for your business in Spain, in English, Spanish or both, take a look at our web design service or our guide to registering a .es domain.

FAQ