Website legal pages in Spain: legal notice, privacy and cookies explained for businesses

Which legal pages your website needs

In Spain, a business website mainly has to comply with three sets of rules:

LSSI-CE (Law 34/2002)

The Spanish information society services law. It requires you to identify who is behind the website and regulates cookies and commercial emails.

GDPR (EU Regulation 2016/679)

The European data protection regulation. It applies as soon as your website collects personal data: a form, a booking, a newsletter or analytics that identify users.

LOPDGDD (Organic Law 3/2018)

The Spanish law that adapts the GDPR. It replaced the old LOPD 15/1999, which still appears in many templates.

That is where the usual pages come from: a legal notice, a privacy policy, a cookie policy and, if you sell online, terms and conditions.

Legal notice: who is behind the website

Article 10 of the LSSI requires you to provide, permanently, easily and free of charge, at least this information:

• Name or company name and address.
• Email address and other direct contact details.
• Tax identification number (NIF).
• Registration details in the Commercial Register or another public register, if applicable.
• If you practise a regulated profession (lawyer, doctor, architect…): professional body, membership number, qualification and applicable professional rules.
• Clear prices, stating taxes and delivery costs, if the website mentions prices.

It is the Spanish equivalent of the German “Impressum”. If you are self-employed, your name and NIF appear: it is mandatory, even if many people don't like it.

Source: BOE, Law 34/2002 (LSSI-CE).

Privacy policy: what you do with the data

If your website collects personal data, you must clearly state, as Article 13 of the GDPR sets out:

• Who the controller is and how to contact them.
• What you use the data for (answering enquiries, sending quotes, the newsletter…) and on what legal basis (consent, contract, legitimate interest…).
• Who it is shared with, including the providers that process it for you: hosting, email tool, CRM, bookings.
• Whether it leaves the European Union and with what safeguards.
• How long you keep it.
• The user's rights (access, rectification, erasure, objection, restriction and portability) and their right to complain to the Spanish data protection authority (AEPD).

What matters is that the text describes what your website really does. A generic template that mentions processing you don't do, and leaves out what you do, doesn't do its job.

Cookies: the banner almost nobody gets right

The LSSI (Article 22.2) requires clear information and consent before installing cookies that are not technical or strictly necessary. In practice, according to the Spanish data protection authority's guide:

• No consent, no loading: analytics, advertising pixels or embedded videos that set cookies must wait until the user accepts.
• “If you keep browsing, you accept” is no longer valid. The AEPD made this clear in 2020, following the European Data Protection Board.
• Rejecting must be as easy as accepting: since 2024, the reject button has to be on the first layer, at the same level and as visible as the accept button.
• Settings by purpose: users must be able to choose which types of cookies they accept.
• A way to change their mind: a permanent link to review or withdraw consent.
• A cookie policy explaining which cookies you use, whose they are, what they are for and how long they last.

Technical cookies, such as those that remember the chosen language or a basket's contents, don't need consent, although you must still inform users about them. A website that uses only those doesn't need a consent banner.

Breaches are penalised as a minor infringement under the LSSI, with fines of up to 30,000 euros, and as a serious one if repeated.

Source: AEPD, update of the guide on the use of cookies (in Spanish).

Contact forms and newsletters

• Basic information next to the form: controller, purpose and a link to the privacy policy. Having it in the footer is not enough.
• Ask only for the data you need. To answer an enquiry, name, email and message are usually enough.
• Unticked boxes: if you also want to send marketing, ask for separate consent and never with the box ticked in advance.
• Newsletters: you need the subscriber's consent and an unsubscribe link in every email. I explain it in more detail in how to send bulk email without ending up in spam.
• Anti-spam protection that doesn't hand data to third parties without telling users.

If you sell online

If your website sells products, services or paid bookings, you also need clear terms and conditions: final price, payment methods, delivery times, guarantees, how to complain and the consumer's right of withdrawal, which as a general rule is 14 calendar days. This is where it's especially worth having a professional review it.

Common mistakes

• Templates copied from another website, sometimes with another company's name.
• Citing the LOPD 15/1999, repealed since 2018.
• A banner with “accept” but no “reject”, or with rejection hidden on a second screen.
• Analytics or pixels that load before the user accepts, even with a banner.
• An outdated cookie policy that doesn't mention tools added since.
• Forms without information, or with the marketing box already ticked.
• Missing mandatory details in the legal notice: NIF, register or professional body details.

Who should write them

The legal pages are the website owner's responsibility, and ideally a lawyer or data protection consultant who knows your business prepares or reviews them. The technical side, on the other hand, is down to whoever builds the website: that the banner really blocks cookies until they are accepted, that forms inform users and that the legal links are always visible.

One advantage of simple websites, without dozens of plugins or third-party tools, is that they use very few cookies and everything is easier to comply with and explain. I discuss it in WordPress: advantages, drawbacks and alternatives.

Common questions