Website Legal Requirements in Spain: 2026 Checklist

If you run a business in Spain, your website answers to Spanish and EU rules, whether you are Spanish or moved here from somewhere else. That catches out a lot of owners, because many templates online were written for the UK or the US and skip the Spanish basics: the aviso legal, the Spanish data protection authority's cookie rules and, since 2025, a handful of changes almost nobody has heard about.

This checklist is up to date as of October 2026, with how to check each point yourself. If you would rather skip to the answer, check your site for free with our audit: it looks at your legal notice, privacy policy, cookies and what loads before a visitor agrees, in seconds and with no sign-up.

This is general information, not legal advice. We checked every point on 17 October 2026 against the official sources (the BOE and BOJA gazettes, the AEPD and EUR-Lex) and link each one so you can read it yourself. If you handle health data or sell online at volume, have your setup reviewed by a professional.

What a business website in Spain legally needs, in short

• Always: a legal notice (aviso legal) saying who runs the site.
• If you collect any personal data (a form, an email address, visitor statistics): a privacy policy and a short notice next to the form.
• If you use non-essential cookies (Google Analytics, ad pixels, embedded YouTube videos): a banner with Reject on its first screen, a cookie policy, and nothing loading before the visitor chooses.
• If you sell to consumers: final prices including tax and, online, terms of sale and the right of withdrawal.
• If you show customer reviews: say whether you check they are genuine.
• If an AI chatbot answers your visitors: it must say it is an AI.
• If your business is in Andalusia: electronic complaint forms as well as paper ones, and a notice about them on your site if you have no premises open to the public.

What changed in 2025 and 2026

• 20 July 2025: the EU online dispute resolution (ODR) platform closed, so the link many legal notices carry now goes nowhere.
• 28 December 2025: Ley 10/2025 amended Spain's consumer law on prices, reviews and customer phone lines.
• 20 May 2026: electronic complaint forms (Hoj@) became compulsory for businesses in Andalusia.
• 2 August 2026: AI chatbots must say they are AI.
• Unchanged: the AEPD's cookie guide is still the May 2024 edition, and the fines keep coming.

1. A legal notice (aviso legal), even for a brochure site

Spain's information society law, the LSSI (also written LSSI-CE or LSSICE), requires in its article 10 that any website with an economic purpose says who is behind it. That includes a brochure site that sells nothing online: the ministry's LSSI FAQ says a company site that only describes its business still has to publish it. It must be permanently and easily accessible, which in practice means a footer link on every page:

• Your name or company name, and your tax ID: the NIF, which for a foreign resident trading as an autónomo is the NIE.
• Your address, with postcode.
• A contact email that works, ideally a professional email on your own domain.
• For a company such as an S.L., its Registro Mercantil details (tomo, folio and hoja).
• For a regulated profession, the details of your professional body (colegio), something websites for lawyers and websites for psychologists always need.

Sole traders skip this one most, usually because they would rather not publish their address. It still applies while you are trading.

How to check: open your site on your phone and tap the legal notice in the footer. The details should be there as text, not inside an image. If you see a link to the EU disputes platform (ec.europa.eu/consumers/odr), remove it: the platform closed on 20 July 2025 under Regulation (EU) 2024/3228. If you never had one, there is nothing to do.

2. A privacy policy that names you, and a line by every form

As soon as your site collects a name, an email, a phone number or an IP address for statistics, the GDPR and Spain's data protection act (LOPDGDD) apply. Under article 13 of the GDPR, your privacy policy must explain in plain language:

• Who the controller is (your business, by its real name) and how to reach you.
• What you use the data for, and on what legal basis: answering a request for a quote, consent for a newsletter.
• Who else sees it. Be honest here: your hosting, your email tool, Google Analytics, your CRM.
• How long you keep it.
• People's rights (access, correction, erasure, objection) and their right to complain to the AEPD, Spain's data protection authority.

The usual failure is not a missing policy but a copied one, written for another business or another country, that never says who the controller is. That is not a technicality: the AEPD fined a company €1,000 because the policy behind its contact form named only the website's domain as the controller (PS/00212/2024).

Next to each form goes a first layer: one line on who the controller is, what the data is for and where to read the rest, linking to the policy. The AEPD publishes model wording for these notices in Spanish. A contact form does not need an "I agree" checkbox; informing people is enough. A checkbox is only needed for consent-based uses such as a newsletter, and it must never be ticked in advance. The same care applies off the website: see the GDPR risk of using your personal WhatsApp for business.

How to check: read your policy as a customer would. Does it name your business, or just "the owner of this website"? Does it mention the tools you actually use? Then check your form for a short notice with a link, and for any box ticked by default.

3. Cookies: a Reject button up front, and nothing before the choice

This is where most sites fall down. The AEPD cookie guide, last updated in May 2024 and still current, comes down to five points:

• Reject on the first screen, in the same banner as Accept, at the same level and just as visible. Hiding it behind "Settings", or making it pale grey on white, does not count.
• No pre-ticked boxes: non-essential cookies start switched off in the settings panel.
• Nothing before the choice. Analytics, ad pixels, embedded YouTube videos and session recorders such as Microsoft Clarity need consent before they load. This is the one that catches people out: the banner looks right, but Google Analytics had already loaded.
• Carrying on browsing is not consent. The guide says so explicitly.
• Changing your mind must be as easy as agreeing, so keep a link back to the cookie settings, and a cookie policy listing what you use and why.

The fines are real, and sized to hurt a small business. Three AEPD cases:

• A restaurant whose banner would not let visitors reject cookies, and which set non-essential ones before anyone chose: €2,000, reduced to €1,600 for paying voluntarily (PS/00405/2023).
• A site where YouTube's cookies, and those set on arrival, kept working after the visitor clicked "Reject": €5,000 proposed, €3,000 paid after reductions (PS/00006/2026).
• The privacy policy with no named controller from the previous section: €1,000 (PS/00212/2024).

All three started with one person's complaint, not a random inspection. Nobody is fining a village bakery out of existence, but these are real sums for something you can fix in an afternoon.

How to check: open your site in a private window and see whether Reject is as clear as Accept. What loads before the visitor chooses is harder, because you cannot see it: our free audit opens your site as a first-time visitor and tells you. For videos, YouTube's privacy-enhanced mode (youtube-nocookie.com) or loading them only when someone presses play helps.

4. If you sell to consumers: prices with VAT, reviews and phone lines

Ley 10/2025 is mostly about customer service at large companies and utilities, but along the way it amended Spain's general consumer law, the TRLGDCU, on three points any website dealing with the public will show:

• Final prices, tax included. A price shown to consumers must be the full final price including taxes, with extra charges such as management fees made clear (art. 20.1.c). "From €80 + IVA" is fine if you only work for businesses; for consumers, show the final price, with the breakdown underneath if you like.
• Customer reviews. If you show reviews or testimonials, say whether or not you guarantee they come from people who really bought or used your service, and how you handle them (art. 20.4). One line does it, such as "Reviews from our Google Business Profile, shown as published, not selected or verified by us". For more of them, here is how to get more Google reviews without tricks.
• Customer phone lines. A number customers call about what they bought cannot cost them more than a standard call to a landline or mobile (art. 21.2). If yours is a 901, a 902 or a premium-rate 803, 806 or 807 line, add an ordinary one.

Selling online adds terms of sale, delivery and returns, and the 14-day right of withdrawal for distance purchases. If you are thinking about an online shop, plan for it from the start.

How to check: search your site for "+IVA", "IVA no incluido", "sin IVA" or "+VAT", and if you serve consumers, swap those for final prices. Then check that your reviews say where they come from.

5. AI chatbots must say they are AI

Since 2 August 2026, article 50 of the EU AI Act applies: people chatting with an AI must be told they are talking to a machine, unless it is obvious. Strictly, building that in is the toolmaker's duty, but the notice has to reach your visitor, so check it is there. A first message along the lines of "I'm a virtual assistant" does it. The AI chatbots we set up introduce themselves that way, and if you also publish AI-generated images or video, see what the EU rules on labelling AI content ask of a small business.

How to check: open your chat as a customer would. If an AI answers and never says so, change the welcome message; Tidio, Crisp, Intercom and the rest let you do it from their dashboard.

6. Andalusia: official complaint forms, now online too

If your business is in Andalusia, Decreto 82/2022 on official complaint forms (hojas de quejas y reclamaciones) applies, and since 20 May 2026 so does the order of 24 April 2026 on Hoj@, which makes every business offer them electronically as well as on paper. For your website:

• No premises open to the public? If you work at customers' homes, like a plumber or a cleaner, state that complaint forms are available, on paper and electronically, on your website and on your quotes, contracts and invoices (art. 7.3 of the decree).
• Selling or contracting online? The website or app used to contract must show clearly where a complaint can be filed (art. 5.3).
• Registering with Hoj@: large companies (over 250 staff, over €50 million in turnover or more than 20 premises in Andalusia) and utilities have six months from 20 May 2026; everyone else, sole traders included, has a year, until May 2027.

How to check: look in your footer for a line about complaint forms. If you have no premises and it is missing, one sentence does it, in Spanish because that is how the forms are known, with an English version alongside if your site is bilingual: "Existen hojas de quejas y reclamaciones a disposición de las personas consumidoras, también en formato electrónico (consumoresponde.es)". Put it on your quotes and invoices too. The Junta's consumer portal, Consumo Responde, has the details for businesses.

7. Accessibility: what applies now and what is coming

There is a lot of scaremongering here, so this is what the rules say. Today no law requires the informational website of a micro-business that does not sell online to be accessible: Ley 11/2023, which brought the European Accessibility Act into Spanish law, exempts micro-businesses that provide services (art. 3.3). Royal Decree 193/2023 will require it for websites offering goods and services to the public from 2029–2030. And if your site was paid for with a Kit Digital grant, it should already meet WCAG 2.1 level AA.

It is worth getting ahead of anyway: a site that reads well on a phone, with decent contrast, works better for older customers, and Google likes it too. More in our guide to the website accessibility law in Spain.

How to check: turn up your phone's text size and open your site. It should still read without text cut off, pale grey text should not fade into the background, and buttons should be easy to tap first time.

How to check your site in ten minutes

1. On your phone, in a private window, scroll to the footer: are there links to a legal notice, a privacy policy and a cookie policy?
2. Does the legal notice show your name or company name, tax ID, address and email, with no leftover ODR link?
3. Does the cookie banner show Reject as clearly as Accept?
4. Does your privacy policy name you and the tools you really use, and does your form carry a short notice with no box ticked in advance?
5. If you sell to consumers, are prices final, VAT included? Do your reviews say where they come from? Does your chatbot say it is an AI?
6. In Andalusia with no premises: do you mention the complaint forms?

What you cannot see with your own eyes, like what loads before a visitor accepts cookies, our free website audit checks for you: type your address and within seconds you get a traffic-light report with what is missing and how to fix it, no sign-up needed. It is an automated, indicative review, not a legal opinion, but it tells you where to start.

If you found problems, you are in the majority, and most of it is an afternoon's work. If someone else built your site, much of it is covered by our website maintenance from £49 a month with no contract; anything else gets a fixed quote. If you are starting fresh, our small business websites come with the legal basics built in, consent handling included, rather than bolted on afterwards.

Frequently asked questions

Do I need a legal notice if I do not sell online?

Yes. The LSSI applies to any website with an economic purpose, and the ministry's FAQ confirms that a company site which only describes its services still has to publish the article 10 details: name or company name, tax ID, address and a contact email.

Is a cookie banner mandatory in Spain?

Only if you use non-essential cookies, such as Google Analytics, ad pixels or embedded YouTube videos. Then you need a banner with Reject on its first screen, and none of those may load before the visitor chooses. A site that uses only strictly necessary cookies does not need a banner, although explaining them in a cookie policy is good practice.

Can I show prices without VAT?

If you only work for businesses, yes, that is normal. If you sell to consumers, the price you show must be the final one including taxes (TRLGDCU art. 20.1.c), with the breakdown underneath if you want it.

Can I use a privacy policy template?

A template or generator is a reasonable starting point, but it has to be adapted to your business, your data and your tools. An unedited template that describes a shop when you are a plumber, or never names the controller, is worse than nothing: it is a written record of you saying something untrue.

Can I really be fined as a sole trader?

The rules apply regardless of size, and the AEPD does sanction small businesses: a restaurant paid €1,600 over a cookie banner that would not let visitors reject. For reference, the LSSI treats missing legal-notice details as a minor offence, with fines of up to €30,000, and as a serious one when your name, address or email are significantly missing. All three AEPD cases above began with one person's complaint, which is exactly why it is worth getting in order.

Will the free audit tell me whether my site is legal?

Not entirely, and we would rather say so plainly. It is an automated, indicative review of what can be checked from outside: whether it finds a legal notice and a privacy policy, what loads before cookies are accepted, outdated links or "+IVA" prices. It tells you what to review, not whether your site is in order; only a lawyer can tell you that.

Getting this right is not about fear, it is about not leaving an avoidable problem sitting on your website. If you would rather a person looked at yours, get in touch and we will tell you what we would fix first.