Spain. ePrivacy / marketing. Act
LSSILaw 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE)
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Spain's LSSI implements ePrivacy for online services, requiring consent for non-essential cookies and prior request or express authorisation for commercial e-mail and SMS.
- Key themes
- Unique features
AEPD enforces both LSSI and GDPR and frequently fines for cookie and spam breaches.
- SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to €600,000 for very serious breaches; GDPR fines
§3Dates
- Key dates
- Adopted
- In force
- BOE-A-2002-13758; cookies Art 22.2; commercial communications Art 21; AEPD cookie guide updated 2023
§4Text and authority
- Text
- Authoritative text boe.es
- Authority
- Agencia Española de Protección de Datos (AEPD) for cookies and spam
§5Where it applies
- Domestic law of
- Spain
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.