Legal requirements for websites in Spain: aviso legal, privacy and cookies

When you launch a business website in Spain, you need to cover four main legal areas: an "aviso legal" showing your identification details under the LSSI-CE, a privacy policy (política de privacidad) that complies with the RGPD and LOPDGDD, a cookie consent system that follows AEPD guidance and, if you sell online, consumer terms of sale. This post is general information about gaps I often see in practice; it is not legal advice. Always confirm your own situation with a lawyer or a gestoría.

Aviso legal: who runs the site

Article 10 of Spain's Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE) requires businesses that provide services online to keep certain information accessible on their site in a "permanent, easy, direct and free" way. According to the current text in the BOE, this information is:

• Name or company name and address (if you're not established in Spain, the address of your permanent establishment in Spain)
• Email address and other details that allow direct and effective communication
• If registered, your Registro Mercantil or relevant public registry details
• If your activity requires prior authorization, the authorization details and the supervising body
• If you practice a regulated profession, your professional association, registration number and professional title
• Tax identification number (NIF)
• If you show prices, whether taxes and any shipping costs are included
• Any codes of conduct (código de conducta) you adhere to

In practice, this information is gathered under an "Aviso legal" link in the site footer. The most common gap I see at Turkish-owned businesses is that the NIF and registry details are missing entirely, or the Turkish company's details are used in place of the Spanish company's.

Privacy policy: RGPD and LOPDGDD

If your site has a contact form, bookings, newsletter signups or orders, you're collecting personal data. That brings in the EU General Data Protection Regulation (RGPD, known in English as GDPR) and Spain's Law 3/2018, the LOPDGDD. In general, your privacy policy should clearly answer these questions:

• Who processes the data (the data controller's identity and contact details)
• What data you process, for what purpose and on what legal basis
• Who the data is shared with (for example, email service, payment provider)
• How long the data is kept
• How people can exercise rights such as access, rectification, erasure and objection
• The right to file a complaint with the AEPD (Spanish Data Protection Agency)

Placing a short notice under your forms that points people to the privacy policy is also a common and correct practice. If you want to send marketing emails, use a separate, unchecked consent box for it.

A warning: a privacy text copied from another site is useless if it doesn't describe the tools you actually use. The text should reflect what really happens on your site.

Cookie consent: what the AEPD requires

Article 22 of the LSSI-CE requires informed user consent for non-essential cookies. The AEPD's cookie guide was updated in 2023 and set a compliance deadline of January 11, 2024 for the new criteria. The guide's key practical points are:

1. Rejecting must be as easy as accepting. On the first layer of the cookie banner, the "Reject" option must be at the same level and similarly visible as "Accept." Banners offering only "Accept" and "Settings" buttons are no longer considered sufficient.
2. No pre-checked boxes. Analytics or advertising cookies must be off by default.
3. No cookies load without consent. Code like Google Analytics or Meta Pixel must not run until the user gives consent.
4. Consent must be revocable. Users should be able to change their choice easily later; a permanent "Configurar cookies" link in the footer is common for this.
5. The cookie policy should explain on a separate page which cookies are used, by whom, for what purpose and for how long.

There's a point here that also matters for marketing: visitors who don't consent won't show up in your ad and analytics data. This is a legal obligation; the solution isn't to remove the consent banner but to set up your measurement correctly around it. I briefly explain how ad measurement works with this setup in my post Google Ads in Spain.

E-commerce: terms of sale and the 14-day withdrawal right

If you sell products or services to consumers through your site, Spain's General Law for the Protection of Consumers and Users (TRLGDCU) applies. Your site should have a page titled "Condiciones generales de contratación," and before ordering, consumers must be clearly informed about price, taxes, delivery costs, payment and delivery terms, and the withdrawal right.

On the withdrawal right (derecho de desistimiento), according to the current text in the BOE:

• In distance contracts, consumers can withdraw from the contract within 14 calendar days without giving a reason, except for the exceptions set by law (Article 102).
• The period starts on the day the contract is concluded for service contracts, and on the day the consumer physically receives the product for product sales (Article 104).
• Clauses that penalize consumers for exercising the withdrawal right or make them waive it are void.
• Some cases are exceptions, such as custom-made or perishable products (Article 103); clarify with your lawyer which of your products fall under an exception.

These rules work differently for business-to-business (B2B) sales. When building your e-commerce setup, planning these pages from the start is much easier than adding them later. For the technical and marketing side, see my post setting up an e-commerce site in Spain.

Accessibility: a new obligation for e-commerce

EU Directive 2019/882, known as the European Accessibility Act, was transposed into Spanish law by Law 11/2023. According to the law's text, the accessibility requirements apply from June 28, 2025, and e-commerce services are explicitly listed among the covered consumer services. The same law exempts microenterprises that provide services from these service requirements. Under the Directive's definition, a microenterprise has fewer than 10 employees and an annual turnover or balance sheet total not exceeding 2 million euros.

So a small shop's site is most likely exempt, but a growing online store may fall under it. Even if you're exempt, readable font sizes, enough color contrast, alt text on images and keyboard-navigable menus are good practice for both your customers and Google. Review with your lawyer whether you're covered and how the transitional provisions apply.

Does the site have to be in Spanish?

As far as I know, there's no general rule requiring a website to be only in Spanish; you can have Turkish or English sections. But in practice, if you sell to customers in Spain, having your legal pages and terms of sale in a language the customer understands, at least Spanish, builds trust and gives you safer ground in a potential dispute. If you operate in Catalonia, there may also be regional language rules, so ask your advisor about that too.

The mistakes I see most often

When I review the Spanish websites of Turkish-owned businesses, the same problems keep coming up:

• A KVKK text copied from a site in Türkiye used as the privacy policy on the Spanish site
• Setups where the cookie banner is shown, but analytics and ad code already run in the background before consent
• Banners with only an "Aceptar" button, or that hide the "Reject" option on a second screen
• Only the brand name listed on the Aviso legal page instead of the company
• Selling online without explaining the withdrawal right and return process at all
• Legal pages that exist on the site but aren't linked from the footer, so visitors can't find them

Most of these are technical issues a web developer can fix in a few hours; the content of the text, however, is legal work. The two shouldn't be mixed up: a designer shouldn't write legal texts, and a lawyer shouldn't have to check how cookie code loads. The cleanest result comes when both work together. Make it a habit to update your privacy and cookie policies whenever your tools change, for example when you add a new ad pixel or a new email service.

Pre-launch checklist

• Are there Aviso legal, Política de privacidad and Política de cookies links in the footer?
• Are the company name, address, email, NIF and registry details on the Aviso legal correct?
• Is the Reject button on the first layer of the cookie banner, at the same level as Accept?
• Are analytics and ad scripts blocked until consent?
• Do forms include a privacy notice and a separate marketing consent?
• If you sell, are your terms of sale and withdrawal right page ready?

I build sites that include these items in the design from the start through my Spain web design service; for the content of the legal texts, I recommend finalizing it with your lawyer or gestoría. If you're in the process of setting up a company, the digital guide to setting up a company in Spain page will help, and for the overall framework, the Spain digital marketing page.