Legal rules for an online business or shop in Spain

Terms used

• Aviso legal — The aviso legal is the legal notice in your website footer showing who runs the site and how to contact them.
• NIF — The NIF is the Spanish tax identification number of a person or business.
• Registro Mercantil — The Registro Mercantil is the public commercial register where companies are recorded.
• AEPD — The AEPD is Spain's data protection authority, which enforces cookie and privacy rules and can fine websites.

Key rules

• Withdrawal: Online customers have 14 calendar days to withdraw from a purchase without giving a reason.
• Cookie banner: Accept and reject buttons must be equally easy to use, and non-essential cookies need consent first.
• Legal notice: Show your identity, contact details and tax ID in the footer at all times.
• Missing information: If you fail to explain the right to withdraw, the customer's period grows by 12 months.

What your website must show

Your site must show your business details permanently, easily and free of charge. Put them in a legal notice (aviso legal) in the footer. It must include:

• Your name or business name, your address, your email and one other way to contact you.
• Your NIF (tax ID).
• Your Registro Mercantil details, if you are registered there.
• Your licence and the body that issued it, if your activity needs authorisation.
• Your professional body, title and rules, if you work in a regulated profession.

Prices must be clear. Say whether taxes and delivery costs are included.

A shop must also show its terms of sale before the customer pays. They cover the steps to complete a purchase, the languages offered, whether you keep the contract on file, and your general terms and conditions.

Cookies

You need clear information and the user's consent before you store or read any non-essential cookie. Cookies your shop needs in order to work, such as the basket, do not need consent.

Your cookie banner must follow these rules:

• "Accept" and "Reject" sit at the same level.
• No pre-ticked boxes.
• Scrolling or carrying on browsing does not count as consent.
• Users can withdraw consent as easily as they gave it.
• In most cases you cannot block the site until the user accepts.

The data protection authority (AEPD) enforces these rules and can fine you.

Privacy policy

Publish a privacy policy alongside your cookie policy. It must state:

• who controls the data;
• why you use it and your legal basis;
• who receives it;
• any transfers abroad;
• how long you keep it;
• the user's rights.

Withdrawal rights

Customers who buy online have 14 calendar days to withdraw without giving a reason. The period starts when they receive the goods. If you did not properly tell them about this right, the period extends by 12 months.

When a customer withdraws:

• Refund every payment, including standard delivery, within 14 days of being told.
• You may hold the refund until the goods or proof of return arrive.
• The customer pays the direct cost of returning the goods, unless you agreed to pay it or did not tell them they would have to.

Some goods have no withdrawal right:

• custom-made goods;
• perishable goods;
• sealed hygiene or health goods once opened;
• sealed audio, video or software once unsealed;
• newspapers;
• digital content once it has started with the customer's consent;
• urgent repairs.

The timeline, documents list and questions below cover the steps and wording in more detail.

Timeline and deadlines

• Give the customer clear information about their right to withdraw: before purchase

• Customer can withdraw without giving a reason: within 14 calendar days of receiving the goods

• Refund all payments, including standard delivery costs: within 14 days of being told of the withdrawal

• Withdrawal period extends if you did not properly inform the customer: 12 months added to the withdrawal period

Documents you need

• Legal notice (aviso legal) in your website footer, showing your name or business name, address, email, another contact means, tax ID (NIF) and Registro Mercantil data if you are registered. Keep it visible, easy to find and free to access.

• Licence details and the issuing body, shown in the legal notice if your activity needs authorisation. For a regulated profession, also show the professional body, your title and the rules that apply.

• Terms of sale, shown before purchase. They cover the contracting steps, language, whether the contract is filed, prices with taxes and delivery costs, and the withdrawal right.

• Cookie policy, plus a cookie banner with accept and reject options at the same level.

• Privacy policy stating who controls the data, purposes, legal basis, recipients, transfers abroad, how long data is kept and users' rights.

Frequently asked questions

Can I make cookie consent a condition for using my website?

In most cases no, because the cookie guidance generally bans blocking access until the user accepts cookies. Show a banner where accepting and rejecting are equally easy, with no pre-ticked boxes. Scrolling does not count as consent.

Do I need consent for cookies that make my shop work?

No, technical cookies that the service strictly needs, such as those that keep items in a basket, do not need prior consent. Cookies for other purposes, such as advertising, do. You still need to explain them in your cookie policy.

What if I did not tell a customer about their right to withdraw?

The withdrawal period then extends by 12 months, so the customer can return the goods much later. Include the withdrawal information in your terms of sale before purchase to avoid this.

Who pays for a return when a customer withdraws?

The customer pays the direct return costs, unless you agreed to pay them or failed to tell them this. You must refund all payments, including standard delivery costs, and you may hold the refund until the goods or proof of return arrive.