Website Rules in Spain

Spanish small businesses sometimes hide their aviso legal in a tiny footer link, or skip it entirely on landing pages. Article 10 of LSSI-CE is explicit: the information must be permanent, easy to access, free, and direct. In practice that means a footer link visible from every page, leading to a page that lists the natural or legal person's name, NIF or CIF, full address, contact email, and (for registered companies) the Mercantile Registry section, volume, page, and registration number. Regulated professions (lawyers, doctors, architects) must add their professional college and collegiate number. Hosting your aviso legal only inside a PDF, behind a login, or on a subdomain that does not match your business does not meet the standard.

The AEPD Guía de Cookies revision in July 2023 made the rules clearer than the original 2020 version. A compliant banner has three things: an Accept button and a Reject button shown with equal visibility (same size, same colour intensity, same screen position), a link or button to manage preferences with granular categories (technical, preferences, analytics, marketing), and zero non-essential cookies set before the visitor interacts. Cookie walls that block content until consent are explicitly disallowed for sites that have alternative business models, and the AEPD has sanctioned this pattern. The most common failures the AEPD cites in its resoluciones are: pre-ticked boxes for non-essential categories, a Reject button hidden inside a settings panel, and analytics cookies (Google Analytics _ga, Microsoft Clarity, Hotjar) firing on page load.

The AEPD applies the LSSI-CE penalty bands of Article 39: minor infractions up to €30,000, serious infractions €30,001–€150,000, and very serious infractions €150,001–€600,000. RGPD violations follow Articles 83.4 and 83.5: up to €10 million or 2% of global turnover for processing breaches, up to €20 million or 4% for breaches of the lawful-basis requirement. In practice, smaller pymes usually receive sanctions from €1,000 to €10,000 under the agravante and atenuante reductions in LOPDGDD Article 76. Voluntary acknowledgement of the infraction reduces the fine by 20%, and prompt payment by another 20%, so a €10,000 sanction can drop to €6,400 if you cooperate quickly.