Legal Requirements for an Online Store in Spain: 2026 Checklist

Why compliance is a launch task, not a later fixMany small businesses in Catalonia and across Spain treat legal paperwork as something to sort out onc...

Why compliance is a launch task, not a later fix

Many small businesses in Catalonia and across Spain treat legal paperwork as something to sort out once sales start flowing. In practice, the obligations kick in from the very first order, and the exposure does not scale with turnover. A store processing two orders a month carries the same duties as one processing two hundred. The Spanish data protection authority has been increasingly active, and complaints are free and easy to file online, so even a modest shop can attract attention.

This guide is written from a technical and web development perspective, not a legal one. Use it to understand what your online store needs, then work with a qualified adviser to draft the final texts. Getting the structure right at build time is far cheaper than retrofitting it later.

The six pillars every Spanish online store must cover

Legal notice identifying the business owner, as required by the LSSI.
Privacy policy aligned with the GDPR and Spain's LOPDGDD.
Cookie banner and policy with genuine, prior consent.
General terms of sale covering prices, shipping, returns and warranties.
Purchase process with withdrawal rights, order confirmation and VAT-inclusive prices.
Tax registration as a self-employed person or company, with the relevant IAE activity heading.

1. The legal notice: say who you are

Spain's Law on Information Society Services requires the store owner to be clearly identifiable: name or company name, tax number, registered address, contact email and, for companies, registry details. It is one of the simplest pages to get right, yet also one of the most frequently reported when it is missing. A competitor or a dissatisfied customer can check compliance in seconds.

Beyond the legal duty, transparency is a commercial asset. Shoppers routinely check the legal notice and contact page before entering card details with an unfamiliar store. With online fraud accounting for a large share of security incidents reported in Spain, that caution is entirely rational.

2. What the GDPR expects from your store

Every order, registration and contact form collects personal data. Three elements matter most:

A complete privacy policy: what data you collect, the purpose, the legal basis, retention periods, who you share it with (payment gateway, courier, email tool) and how customers can exercise their access, rectification and erasure rights.
Genuine consent: unticked boxes, separated by purpose. A marketing opt-in must never be pre-ticked or bundled with the purchase terms. Stores have been fined for registration forms without an acceptance checkbox.
Proportionate security: HTTPS across the site, protected access and data processing agreements with suppliers such as hosting and email providers. A reputable platform handles much of this by default; a hastily assembled site often does not.

The volume of complaints has risen sharply in recent years, and filing one costs nothing. Treat privacy as a design requirement, not an afterthought.

3. Cookies: consent that actually works

Non-essential cookies, including analytics and advertising, may only load after the user accepts. Rejecting must be as easy as accepting, and the banner cannot be decorative. The most common technical failure we find when auditing stores is a banner that looks compliant while Google Analytics and advertising pixels fire before any consent is given. That is a breach regardless of how polished the banner appears.

The fix is a properly configured consent management tool, which also produces the consent records the law expects. This is one of several areas where the technical build and the legal requirement overlap directly.

4. General terms of sale: the contract behind each order

Each purchase forms a contract, and your terms set its rules. They must state prices with VAT included for consumers, shipping costs, delivery times, payment methods, returns and warranties. Customers must be able to read and accept them before buying, and you should keep evidence of that acceptance.

Consumer law gives buyers 14 calendar days to withdraw without giving a reason, and you must inform them of this right before they purchase. Missing that information extends the withdrawal period, so clarity here protects you as much as the customer.

5. Tax registration and the IAE heading

Selling online requires registering as self-employed or as a company, and selecting the appropriate IAE activity heading. Registration is mandatory from the first order, even though most small businesses never end up paying the tax itself. Your accountant can confirm the right heading for your activity.

6. Build compliance into the platform

Most of these requirements are easier to satisfy when the website is built with them in mind. A professional web development project, whether custom or on WordPress, can include HTTPS by default, a consent manager wired correctly, secure forms, a privacy-friendly data flow and clear, accessible legal pages. That approach also supports performance and SEO, because fast, well-structured sites tend to rank and convert better.

If you are planning a store for a business in Lleida, Barcelona, Tarragona or Girona, treat the legal checklist as part of the specification rather than a separate project. It keeps launch timelines realistic and avoids expensive rework once orders start arriving.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.