What legal texts does your business website need in Spain?

Why copying another website's texts doesn't work

Legal texts describe your business: who you are, what data you collect, what you use it for, which cookies you load and how you sell. Another website's texts describe another business. Copying them means publishing false information about yourself, sometimes with another company's tax ID or email still inside.

And a customer who opens the legal notice and sees a different name, or a cookie banner with no way to refuse, comes away with an impression no nice photo will fix. Doing it properly isn't complicated, but you need to know what each text requires.

1. Legal notice (aviso legal)

Article 10 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE) requires it from anyone with a website linked to an economic activity, even if nothing is sold through it. It's enough for the site to promote your business. It must be permanently, easily and freely accessible, usually through a link in the footer of every page.

• Your full name if you're self-employed, or the registered company name if you have a company.
• Your NIF (tax ID).
• Your address and an email address or other means of contacting you directly.
• If you have a company, its Mercantile Registry entry details.
• If your activity requires prior administrative authorisation, the details of that authorisation and of the supervising body.
• If you practise a regulated profession (law, physiotherapy, architecture…), your professional association, membership number, academic qualification and the country that issued it, and the professional rules that apply to you.
• If you show prices, they must state clearly whether they include taxes and, where relevant, delivery costs.

2. Privacy policy

As soon as the website collects any personal data, even a name and phone number in a contact form, the General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD) apply. When collecting the data, you must tell the person:

• Who the data controller is, meaning you, and how to contact you.
• What the data will be used for and on what legal basis: for example, replying to the request they made.
• Who you share it with, if anyone, and whether it leaves the European Union.
• How long you'll keep it, or the criteria you use to decide.
• Their rights: access, rectification, erasure, objection, restriction of processing and portability, and how to exercise them.
• That they can lodge a complaint with the Spanish Data Protection Agency (AEPD).

The LOPDGDD allows this information to be given in layers: next to the form, a short summary of the essentials (controller, purpose and rights) with a link to the full policy. That way the form doesn't turn into a wall of text. And if you also want to use the data to send offers or news, you need separate consent, with a box the customer ticks themselves, never pre-ticked.

3. Cookie policy and consent banner

Cookies are governed by Article 22.2 of the LSSI-CE, and the AEPD publishes a guide on their use explaining how to apply it. The core idea: cookies strictly necessary for the site to work don't need permission, but analytics, advertising and tracking cookies do, and that permission must be asked for before they load.

• Refusing must be as easy as accepting. If there's an «Accept» button on the banner's first layer, there must be a «Reject» button at the same level.
• No pre-ticked boxes, and no treating continued browsing or scrolling as acceptance.
• Non-essential cookies don't load until the user accepts. A banner shown while analytics is already running in the background doesn't comply.
• Users must be able to change their mind later, through a link to the cookie settings that's always available.
• The cookie policy explains which cookies you use, what for, who sets them (you or third parties such as Google) and how long they last.

4. Terms of sale, if you sell online

If customers can buy or sign up directly through the website, consumer law (the consolidated text of the General Law for the Protection of Consumers and Users) requires you to tell them a number of things before purchase, clearly and understandably:

• The main characteristics of the product or service.
• The total price including taxes and, separately, delivery costs or any additional charges.
• Payment methods, delivery time and how complaints are handled.
• The right of withdrawal: consumers can return a purchase without giving a reason within 14 calendar days, which for goods runs from the day they receive them. You must explain how to exercise it and provide a withdrawal form.
• Any exceptions to withdrawal that apply to you, such as personalised goods, perishables, or items sealed for hygiene reasons that have been unsealed.
• The legal guarantee: for goods sold to consumers it's three years from delivery.

Watch the right of withdrawal: if you don't inform customers about it, the period doesn't stay at 14 days, it's extended by up to twelve more months. And after each purchase you must send the customer a confirmation on a durable medium, such as an email, with the contract terms.

If you only use the website to show products and close the sale on WhatsApp, in your shop or by phone, you don't need a checkout on the site, but the duty to inform customers about what you sell still applies. How you sell changes where it's explained, not whether it is.

Mistakes we see in copied templates

• Another business's name or tax ID still in the text.
• Listing tools the website doesn't use, or leaving out ones it does, such as analytics or an embedded Google map.
• Still linking to the EU online dispute resolution platform, which stopped operating in July 2025.
• A banner with a big «Accept» and a hidden «Settings», with no reject option on the first layer.
• Terms of sale with return periods or guarantees shorter than the law sets. Those clauses aren't valid against consumers, and they look bad too.