In 2002, only 17% of households in Spain had internet access, making online shopping far less common than it would later become. Anticipating a rapid expansion of the web throughout the country, the Spanish government at the time enacted the Law on Information Society Services and Electronic Commerce (LSSI). The predictions proved accurate—by 2005, only three years later, 50.6% of households had an internet connection; by 2014, that number had risen to 74.4%.

Today, nearly all households have internet access, so it’s no surprise that ecommerce in Spain generated €23.114 million in revenue in the second quarter of 2024. While the LSSI might have been a little premature, and its robust protection measures for customers caused quite a stir, it’s undeniably a key piece of legislation in today’s digital commerce landscape. Let’s look at what it stipulates and how it impacts Spanish businesses.

What’s in this article?

• What is the LSSI?
  
• What does the LSSI aim to achieve?
  
• Who does the LSSI impact?
  
• How to make your website LSSI-compliant
  
• Penalties for noncompliance with the LSSI
  
• FAQs about the LSSI
  

What is the LSSI?

The LSSI governs any digital commercial activity, officially known as Law 34/2002. This includes selling goods from online stores, almost any profit-driven transaction, and digital business communications such as WhatsApp messages or newsletters used in email marketing strategies.

This law, published in the Official State Gazette (BOE) in 2002, incorporates the principles of the European Directive 2000/31/CE, which was approved two years earlier, into Spanish law.

What does the LSSI aim to achieve?

In addition to aligning Spanish regulations with the European Directive mentioned above, the LSSI aims to achieve several key objectives:

• Protecting consumer rights, including the right of withdrawal for online purchases
  
• Building trust among the parties involved in online commercial transactions
  
• Fostering digital employment
  
• Ensuring transparent communication within the digital environment
  
• Promoting the competitiveness of online businesses
  

The 2002 LSSI has been amended to meet these objectives as the ecommerce environment evolves. The most recent update was made through Royal Decree Law 9/2024, which includes regulations on marketplaces and updates to the penalty framework, among other things, and brings the LSSI in line with Regulation 2022/2065 of the European Parliament.

Who does the LSSI impact?

The LSSI applies to any person or legal entity established in Spain for tax purposes and to earn income, directly or indirectly, through a website or other electronic means of communication. Here are some of the most common cases:

• Sales of products or services over the internet
  
• Auctions run on specialized portals or marketplaces
  
• Posts on social networks that generate financial income
  
• Virtual programs such as online training
  
• Creation or broadcasting of advertisements through digital media
  
• Signing of online contracts
  
• Sending of newsletters and other marketing communications
  

How to make your website LSSI-compliant

If you engage in any activities listed in the previous section, you must make certain that your website and messages comply with current regulations. Here are the obligations under the LSSI:

• Identification: The page must include all important identification information, such as the individual or business’s name, address, Tax Identification Number (NIF), and the licensing number in the case of service providers belonging to a regulated profession.
  
• Transparent pricing: List all the fees for any products or services. For example, you must specify whether the value-added tax (VAT) is included in the prices listed on the website and determine the shipping costs associated with purchases. The Royal Legislative Decree 1/2007 also mandates additional charges, such as assembly costs for furniture purchases.
  
• Contract-related information: Make sure that users can always readily and easily access details about contracts they can enter. General terms and conditions, as well as the return policy, must be communicated clearly.
  
• Purchase confirmation: Send the customer confirmation that the process to contract a service or purchase a product has been completed successfully. Once the transaction is processed, you must inform them that your business has received payment. This requires a payment gateway such as Stripe Payments that ensures regulatory compliance. Payments also allow you to send receipts and invoices instantly, regardless of your customers’ chosen payment method.
  
• Communication opt out: If you send marketing messages or newsletters to customers, always provide them with the option to unsubscribe. Your newsletters must contain a link allowing customers to inform you that they no longer wish to receive messages from your business.
  
• Telephone services: Obtain the customer’s consent if you provide support through a premium-rate telephone number, for instance, an IT support service that can be reached by calling a 902 number.
  

Penalties for noncompliance with the LSSI

In the event of noncompliance with obligations under the LSSI, the penalties outlined in Section 39 apply. These vary based on the severity of the infraction. Here are the various types of violations and corresponding penalties:

Minor infractions

The following are considered minor infractions, attracting fines that can go up to €30,000:

• Sending a business communication that doesn’t clearly identify the sender or indicate that the message is intended for profit
  
• Sending business communications to consumers who have opted out of the service
  
• For internet service providers, failure to indicate what security measures are implemented
  

Serious infractions

The following are considered serious infractions, with potential fines ranging from €30,001 to €150,000:

• Failure to inform the customer of the terms and conditions of the digital offering provided
  
• Opposition to inspections of LSSI compliance
  

Severe infractions

The fine for severe infractions ranges from €150,001 to €600,000. While the original law from 2002 included multiple categories of infractions within this “severe” category, the majority of them have since been repealed. Failure to delete a consumer’s data or failing to terminate a service after the competent administrative body has ordered a business to do so are currently the only severe infractions in effect.

If two or more of these occur repeatedly over three years, the penalty might not be limited to a financial fine. Should the competent authorities deem it necessary, the business owner could be banned from engaging in commercial activities in Spain for up to two years. Furthermore, both serious and severe infractions might lead to the publication of the sanctioned individual’s name in the BOE.

FAQs about the LSSI

Is the LSSI the only law regulating online commercial activity?

No. Besides the LSSI, other regulations govern online commercial activities in Spain. These include Law 11/2022, also known as the General Telecommunications Law, and the General Data Protection Regulation (GDPR), which regulates the use of cookies.

Does the LSSI apply to websites that are exclusively informational?

Yes. Although a business does not offer services or sell products online and uses its website solely to share details about its activities, certain aspects of the LSSI apply. In this case, the site must feature the information specified in Section 10 of the LSSI, including the business’s name and address of its main location.

How can you determine if a business’s website activity is considered commercial under this regulation?

If the business generates income from the information on its website, it’s considered an economic or commercial activity—the LSSI’s provisions apply. The law applies to individuals and operations that generate income directly (such as by selling their products or services straight from the site) and indirectly (such as if the site doesn’t allow customers to make purchases but provides details about the business’s products or services).