Legislation · Criminal law and related legislation

Information society services and electronic commerce

Law 34/2002 of 11 July on information society services and electronic commerce.

BOE-A-2002-13758 · BOE consolidation updated: 23/01/2025

Unofficial English translation — not the official Spanish legal text. This text was translated automatically for general information and has not been reviewed article by article. It may contain translation errors. If there is any discrepancy, consult the official Spanish version. The translation reflects the Spanish copy and update date shown on this page. Read the Spanish legal text

Check for updates on BOE ↗Read the Spanish text on Matrimonialistas.com

Contents of this law

Consolidated text: «Last updated, published on 23/01/2025»

Includes correction of errors published in BOE No. 187 of 6 August 2002. Ref. BOE-A-2002-15886

JOHN CARLOS I KING OF SPAIN

To all who see and understand the present.

Know: That the Cortes Generales have passed and I come to sanction the following law.

EXPOSURE OF GROUNDS

I

The purpose of this Law is to incorporate into Spanish law the Directive 2000/31/EC of the European Parliament and of the Council of 8 Juneconcerning certain aspects of information society services, in particular electronic commerce in the internal market (Directive on electronic commerce). It also partially incorporates the Directive 98/27/EC of the European Parliament and of the Council of 19 Mayon the cessation of proceedings for the protection of the interests of consumers, by regulating, in accordance with the provisions of the Act, an action for cessation of conduct contrary to the provisions of the Act.

What the Directive 2000/31/EC It calls the "information society" is determined by the extraordinary expansion of telecommunications networks and, in particular, the Internet as a vehicle for the transmission and exchange of all kinds of information. Its incorporation into economic and social life offers countless advantages, such as improving business efficiency, increasing user choice and the emergence of new sources of employment.

However, the introduction of the Internet and new technologies is subject to some legal uncertainties, which need to be clarified by the establishment of an appropriate legal framework, which will generate the necessary confidence for the use of this new medium for all actors involved.

This is what this Act is intended to mean, that part of the application to the activities carried out by electronic means of both general and special rules that regulate them, dealing only with those aspects that, either because of their novelty or because of the peculiarities involved in their exercise by electronic means, are not covered by such regulation.

II

The Act provides for a broad concept of “information society services”, which includes, in addition to the procurement of goods and services by electronic means, the provision of information by electronic means (such as that used by newspapers or magazines that may be on the network), brokering activities relating to the provision of access to the network, the transmission of data by telecommunications networks, the temporary copying of Internet pages requested by users, the hosting of information servers, services or applications provided by others, or the provision of search tools or links to other Internet sites, as well as any other service provided at the individual request of users (discharge of video or audio files...), provided that it represents an economic activity for the provider. These services are offered by telecommunications operators, Internet access providers, portals, search engines or any other subject who has a website through which he carries out any of the activities indicated, including electronic commerce.

From a subjective point of view, the law applies, on a general basis, to service providers established in Spain. "Establishment" means the place from which an economic activity is directed and managed, a definition which is based on the concept of tax domicile in Spanish tax rules and which is compatible with the material notion of establishment preached by Community law. The Law also applies to those who are not resident in Spain who provide information society services through a "permanent establishment" located in Spain. In the latter case, the subjection to the Law is only partial, in respect of those services provided from Spain.

The place of establishment of the service provider is an essential element of the Act, because it depends on the scope of application not only of this Law, but on all other provisions of the Spanish law applicable to them, depending on the activity they carry out. In addition, the place of establishment of the provider determines the law and the competent authorities for the monitoring of its compliance, in accordance with the principle of the application of the law of the country of origin which inspires Directive 2000/31/EC.

In addition, the freedom to provide information society services in Spain from other countries of the European Economic Area is restricted only in the cases provided for in the Treaty on European Union. Directive 2000/31/ECwhich consist of the production of serious harm or danger to certain fundamental values such as public order, public health or the protection of minors. Likewise, the provision of services from those States may be restricted when they affect any of the matters excluded from the country of origin principle, as specified in article 3 of the Act, and the provisions of Spanish legislation which, if applicable, apply to them are not complied with.

III

It provides for the entry of the Internet domain name(s) corresponding to the service provider in the public register where the provider is registered for the acquisition of legal personality or for advertising purposes only, in order to ensure that the link between the provider, his physical establishment and his “establishment” or location on the network, which provides his Internet address, is easily accessible to citizens and the public administration.

The Act also establishes the obligations and responsibilities of service providers engaged in brokering activities such as transmission, copying, hosting and tracing of data on the network. In general, they impose a duty of collaboration on such providers to prevent the further dissemination of certain illegal services or content. The responsibilities that may arise from non-compliance with these rules are not only administrative, but also civil or criminal in nature, depending on the legal assets concerned and the applicable rules.

It also stresses in the Act its commitment to protect the interests of service recipients so that they can enjoy sufficient guarantees when contracting a service or on the Internet. To this end, the Act imposes an obligation on service providers to facilitate access to their identification data on those who visit their website; to inform recipients of the prices they apply to their services; and to enable them to visualize, print and archive the general conditions to which the contract is subject, where appropriate. When contracting is done with consumers, the service provider must also guide them during the procurement process, indicating the steps to be taken and how to correct possible errors in data entry, and confirming the acceptance made upon receipt.

With regard to commercial communications, the Act provides that commercial communications must be identified as such, and prohibits their sending by e-mail or other equivalent electronic means of communication, unless the addressee has given his consent.

IV

The conclusion of contracts by electronic means is also encouraged by the affirmation of the Law, in accordance with the spiritualistic principle governing the perfection of contracts in our law, the validity and effectiveness of the consent given by electronic means, the declaration that the express admission of this technique is not necessary for the contract to take effect between the parties, and the ensuring of equivalence between paper documents and electronic documents for the purpose of fulfilling the requirement of "written form" contained in various laws.

It takes the opportunity to set the time and place for the conclusion of electronic contracts, adopting a single solution, also valid for other types of contracts concluded at a distance, which unifies the disparate criterion contained so far in the Civil and Commercial Codes.

The provisions contained in this Law on general aspects of electronic procurement, such as those relating to the validity and effectiveness of electronic contracts or the time of consent, shall apply even if neither party has the status of provider or recipient of information society services.

The Act promotes the development of codes of conduct on matters regulated by this Act, considering them to be an instrument of self-regulation that is particularly suitable for adapting the various provisions of the Act to the specific characteristics of each sector.

Because of its simplicity, speed and convenience for users, it also enhances the use of arbitration and alternative dispute resolution procedures that can be created by codes of conduct, to resolve disputes that may arise in electronic contracting and in the use of other information society services. The use of electronic means in the conduct of such procedures is also encouraged, with due regard, where appropriate, to the rules on the use of such means laid down by specific arbitration rules.

In accordance with the Directives 2000/31/EC and 98/27/ECthe cessation action is regulated, which may be exercised to put an end to conduct contrary to this Law that infringes the interests of consumers and users. In carrying out this action, account must be taken, in addition to the provisions of this Act, of the provisions of the General Act on the incorporation of the Directive 98/27/EC.

The Act also provides for the possibility for citizens and entities to address different ministries and administrative bodies in order to obtain practical information on various aspects relating to the subjects covered by this Act, which will require the establishment of mechanisms to ensure maximum coordination between them and the consistency and consistency of the information provided to users.

Finally, a proportionate but effective sanctions regime is established, as indicated by the Directive 2000/31/ECto deter service providers from failing to comply with the provisions of this Act.

The Act also provides for a number of provisions aimed at making information provided by electronic means accessible to persons with disabilities, and in particular information provided by public administrations, a commitment referred to in the Council of the European Union resolution of 25 March 2002 on accessibility of public websites and their content.

This provision has been drawn up following an extensive public consultation process and has been submitted to the information procedure on technical standards and regulations provided for in the Directive 98/34/EC of the European Parliament and the Council of 22 Juneas amended by Directive 98/48/EC of the European Parliament and the Council of 20 July, and in the Royal Decree 1337/1999 of 31 July 1999.

TITLE I

General provisions

CHAPTER I

Subject matter

Article 1. Object.

1. This Law regulates the legal regime for information society services and electronic procurement, with regard to the obligations of service providers including those acting as intermediaries in the transmission of content by telecommunications networks, commercial communications by electronic means, pre- and post-contract information, the conditions relating to its validity and effectiveness and the sanctioning regime applicable to information society service providers.

2. The provisions contained in this Act shall be without prejudice to the provisions of other State or autonomous regulations outside the coordinated regulatory sphere, or which have as their purpose the protection of health and public safety, including the safeguarding of national defence, the interests of the consumer, the tax regime applicable to the services of the information society, the protection of personal data and the competition rules.

Paragraph 3 is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December, which added it. Ref. BOE-A-2025-1136

Paragraph 3 is added by final provision 2.1 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

CHAPTER II

Scope

Article 2. Service providers established in Spain.

1. This Law shall apply to information society service providers established in Spain and to services provided by them.

A service provider shall be deemed to be established in Spain when his or her residence or registered office is in Spanish territory, provided that the latter coincides with the place where the administrative management and management of his or her business is effectively centralized. In another case, the place where such management or direction is carried out shall be taken care of.

2. This Act shall also apply to the information society services offered by providers resident or domiciled in another State through a permanent establishment located in Spain.

A provider shall be deemed to operate by means of a permanent establishment situated in Spanish territory where it has facilities or places of work, on a continuous or regular basis, where it carries out all or part of its activity.

3. For the purposes provided for in this Article, the service provider shall be presumed to be established in Spain where the provider or any of his branches has been registered in the Commercial Register or in another Spanish public registry where registration was necessary for the acquisition of legal personality.

The use of technological means located in Spain, for the provision or access to the service, will not serve as a criterion for determining, on its own, the establishment in Spain of the provider.

4. Information society service providers established in Spain shall be subject to the other provisions of the Spanish legal order which apply to them, depending on the activity they carry out, irrespective of the use of electronic means for its realization.

Article 3. Service providers established in another Member State of the European Union or the European Economic Area.

1. Without prejudice to Articles 7.1 and 8, this Law shall apply to information society service providers established in another Member State of the European Union or in the European Economic Area where the recipient of the services is resident in Spain and the services concern the following matters:

(a) Intellectual or industrial property rights.

(b) Issue of publicity by collective investment institutions.

(d) Obligations arising from contracts concluded by natural persons who are consumers.

(e) Rules governing the choice by the contracting parties of the law applicable to their contract.

(f) Licitude of unsolicited commercial communications by electronic mail or other electronic equivalent means of communication.

2. In any event, the constitution, transmission, modification and termination of real rights in immovable property situated in Spain shall be subject to the formal requirements of validity and effectiveness established in the Spanish legal system.

3. Service providers referred to in paragraph 1 shall also be subject to the rules of the Spanish legal order governing the matters referred to in that paragraph.

4. The provisions of the preceding paragraphs shall not apply to cases where, in accordance with the rules governing the matters referred to in paragraph 1, the law of the country in which the recipient of the service resides or is established did not apply.

The amendment to paragraph 1 is hereby annulled by a resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

Paragraph 1 is amended by final provision 2.2 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 4. Providers established in a State not belonging to the European Union or the European Economic Area.

Providers established in countries other than members of the European Union or the European Economic Area shall be subject to the provisions of Articles 7.2 and 11.2.

Providers who direct their services specifically to Spanish territory will also be subject to the obligations provided for in this Law, provided that this does not contravene the provisions of applicable international treaties or conventions.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.3 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Paragraph 1 is amended by art. 4.1 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 5. Services excluded from the scope of the Act.

1. The following information society activities and services shall be governed by their specific rules:

(a) Services provided by notaries and registrars of property and commercial agents in the exercise of their respective public functions.

(b) The services rendered by lawyers and prosecutors in the exercise of their representational and defence functions at trial.

2. The provisions of this Law, with the exception of the provisions of Article 7.1, shall apply to the services of the Information Society relating to gambling involving bets of economic value, without prejudice to the provisions of its specific state or regional legislation.

TITLE II

Provision of information society services

CHAPTER I

Principle of freedom to provide services

Article 6. Not subject to prior authorization.

The provision of information society services shall not be subject to prior authorisation.

This rule shall not affect authorisation schemes provided for in the legal system which do not have as their specific and exclusive purpose the provision by electronic means of the services concerned.

Article 7. Principle of freedom to provide services.

1. The provision of information society services from a provider established in a Member State of the European Union or the European Economic Area shall be carried out under the freedom to provide services, without any restrictions being imposed on them for reasons arising from the coordinated regulatory field, except in the cases provided for in Articles 3 and 8.

2. The application of the principle of freedom to provide information society services to providers established in non-member States of the European Economic Area shall be in accordance with international agreements which are applicable.

The amendment to paragraph 1 is hereby annulled by a resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

Paragraph 1 is amended by final provision 2.4 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 8. Restrictions on the provision of services and intra-Community cooperation procedure.

1. If a particular information society service is or is likely to be in breach of the following principles, the bodies responsible for its protection, in the exercise of their legally assigned functions, may take the necessary measures to interrupt its provision or to withdraw the data that infringe them. The principles referred to in this paragraph are as follows:

(a) Safeguarding public order, criminal investigation, public security and national defence.

(b) The protection of public health or of natural or legal persons who have the status of consumers or users, even when acting as investors.

(c) Respect for the dignity of the person and the principle of non-discrimination on the grounds of race, sex, religion, opinion, nationality, disability or any other personal or social circumstances; and

(d) Protection of youth and children.

(e) Safeguarding intellectual property rights.

The adoption and enforcement of the measures of restriction referred to in this subparagraph shall in any event respect the guarantees, rules and procedures provided for in the legal system to protect the rights to personal and family privacy, to the protection of personal data, to freedom of expression or to freedom of information, where they may be affected.

In all cases where the Constitution and the laws regulating the respective rights and freedoms provide for this in an exclusive manner, only the competent judicial authority may take the measures provided for in this article, as a guarantor of the right to freedom of expression, the right to literary, artistic, scientific and technical production and creation, the freedom of teaching and the right to information.

2. The bodies competent for the adoption of the measures referred to in the preceding paragraph, in order to identify the person responsible for the information society service who is conducting the alleged infringement, may require the information society service providers to transfer the data enabling such identification in order to enable it to appear in the proceedings. Such a request shall require prior judicial authorization in accordance with the first paragraph of Article 122a of the Treaty. Law regulating contentious-administrative jurisdiction. Once the authorisation has been obtained, the providers shall be obliged to provide the data necessary to carry out the identification.

3. The adoption of restrictions on the provision of information society services from providers established in a State of the European Union or the European Economic Area other than Spain shall follow the intra-Community cooperation procedure described in the following paragraph of this Article, without prejudice to the provisions of procedural and judicial cooperation legislation.

4. Where a competent body agrees, in the exercise of the powers conferred upon it by law, and in accordance with Article 3 (4) (a) of the Convention, Directive 2000/31/ECestablishing restrictions affecting an information society service from one of the Member States of the European Union or the European Economic Area other than Spain, that body shall follow the following procedure:

(a) The competent body shall require the Member State in which the provider concerned is established to take appropriate measures. In the event that it does not adopt them or is insufficient, that body shall notify the European Commission or, where appropriate, the Joint Committee of the European Economic Area and the Member State concerned of the measures it intends to take.

(b) In cases of urgency, the competent body may take appropriate measures, notifying the Member State of origin and the European Commission or, where appropriate, the Joint Committee of the European Economic Area as soon as possible and in any event no later than 15 days after its adoption. It shall also state the cause of such urgency.

The requirements and notifications referred to in this paragraph shall always be made through the body of the General Administration of the State competent for the communication and transmission of information to the European Communities.

5. The competent bodies of other Member States of the European Union or of the European Economic Area may require the cooperation of intermediary service providers established in Spain in accordance with the terms laid down in Article 11(2) of this Law if they deem it necessary to ensure the effectiveness of the restrictive measures they take under the preceding paragraph.

6. The measures of restriction adopted under this article shall in any event comply with the guarantees and requirements provided for in article 11, paragraphs 3 and 4, of this Act.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.5 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Paragraphs 2, 3, 4 and 5 are renumbered as 3, 4, 5 and 6 and paragraphs 2 and (e) are added to paragraph 1 by final provision 43.1 and 2 of Law 2/2011 of 4 March. Ref. BOE-A-2011-4117.

It is amended by art. 4.2 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

CHAPTER II

Obligations and liability of information society service providers

Section 1a Obligations

Article 9. Domain name registration.

(No content)

It is left without content by art. 4.3 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 10. General information.

1. Without prejudice to the information requirements laid down in the legislation in force, the information society service provider shall be obliged to have the means by which the following information can be accessed by electronic means, on a permanent, easy, direct and free basis, by both the recipients of the service and the competent bodies:

(a) Your name or corporate name; your residence or domicile or, failing that, the address of one of your permanent establishments in Spain; your email address and any other information that allows you to establish with it a direct and effective communication.

(b) The details of their registration in the Commercial Register in which they are registered or in which they are registered for the acquisition of legal personality or for advertising purposes only.

(c) In the event that their activity is subject to a prior administrative authorisation regime, the details of such authorization and the identification of the competent body responsible for their supervision.

(d) If he pursues a regulated profession, he shall indicate:

1.o The data of the professional association to which, if applicable, belongs and collegiate number.

2.o The official or professional academic degree with which it has.

3. the State of the European Union or the European Economic Area in which the title was issued and, where appropriate, the corresponding approval or recognition.

4. The professional rules applicable to the exercise of their profession and the means by which they may be known, including electronic ones.

(e) The tax identification number applicable to it.

(f) Where the information society service refers to prices, clear and accurate information on the price of the product or service shall be provided, indicating whether it includes the applicable taxes and, where appropriate, the shipping costs.

(g) Codes of conduct to which it is attached, if any, and how to consult them electronically.

2. The obligation to provide this information shall be terminated if the provider includes it on his website or website under the conditions set out in paragraph 1.

3. Where a telephone numbering range has been allocated to additional charging services allowing access to information society services and requiring their use by the service provider, such use and the downloading of software performing marking functions shall be carried out with the prior, informed and express consent of the user.

For this purpose, the service provider shall provide at least the following information:

(a) The characteristics of the service to be provided.

(b) The functions to be performed by the software being downloaded, including the telephone number to be dialed.

(c) The procedure for terminating the connection of additional charging, including an explanation of the specific time at which such an end will occur; and

(d) The procedure necessary to restore the connection number prior to the additional charging connection.

The above information shall be clearly visible and identifiable.

The provisions of this paragraph are without prejudice to the provisions of the telecommunications rules, in particular with regard to the requirements for access by users to telephone numbering ranges, where applicable, attributed to additional charging services.

Paragraph 1 (f) is amended by final provision 2.1 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Subparagraph 1 (b) and (f) are amended by art. 4.4 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Paragraph 3 is added by additional provision 8.1 of Law 59/2003 of 19 December. Ref. BOE-A-2003-23399

Article 11. Obligation to cooperate with brokerage service providers.

1. Where a competent body has ordered, in the exercise of its legally conferred powers, that the provision of an information society service or the withdrawal of certain contents from providers established in Spain be interrupted and that the collaboration of intermediary service providers be necessary for this purpose, that body may order the said providers to suspend the corresponding intermediation service used for the provision of the information society service or of the contents the interruption or withdrawal of which has been ordered respectively.

2. If, in order to ensure the effectiveness of the decision agreeing to the interruption of the provision of a service or the withdrawal of contents from a provider established in a State not belonging to the European Union or the European Economic Area, the competent body considers it necessary to prevent access from Spain to such services, and for this purpose the collaboration of the intermediary service providers established in Spain is necessary, that body may order the said intermediary service providers to suspend the corresponding intermediation service used for the provision of the information society service or of the content whose interruption or withdrawal has been ordered respectively.

3. In the adoption and enforcement of the measures referred to in the preceding paragraphs, the guarantees, rules and procedures provided for in the legal system to protect the rights to personal and family privacy, to the protection of personal data, to freedom of expression or to freedom of information shall in any case be respected, where they may be affected.

In all cases where the Constitutionthe rules governing the respective rights and freedoms or those applicable to the various matters confer jurisdiction on the courts in an exclusive manner to intervene in the exercise of activities or rights, only the competent judicial authority may take the measures provided for in this Article In particular, the authorization of the hijacking of Internet pages or their restriction when it affects the rights and freedoms of expression and information and other protected under the terms set out in the Article 20 of the Constitution It may be decided only by the competent courts.

4. The measures referred to in this Article shall be objective, proportionate and non-discriminatory, and shall be taken in a precautionary manner or in enforcement of the decisions rendered, in accordance with the administrative procedures established by law or those provided for in the relevant procedural legislation.

In particular, where necessary to protect the rights of the victim or groups or persons discriminated against, judges and courts may, in accordance with procedural law, agree, on a reasoned basis, and always in accordance with the principle of proportionality, any measure restricting or interrupting the provision of services or withdrawing data from websites provided for in this Act.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.6 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

The second subparagraph is added to paragraph 4 by final provision 1 of Law 15/2022 of 12 July. Ref. BOE-A-2022-11589

It is amended by art. 4.5 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 12. Duty to retain traffic data relating to electronic communications.

(Repealed)

It is repealed by the sole derogation provision.1 of Law 25/2007 of 18 October. Ref. BOE-A-2007-18243

Article 12 bis. Security information obligations.

1. Intermediation service providers established in Spain in accordance with article 2 of this Law who carry out activities consisting of the provision of Internet access services, shall be obliged to inform their clients on a permanent, easy, direct and free basis of the different technical means that increase the levels of information security and allow, inter alia, the protection against computer viruses and spyware, and the restriction of unsolicited emails.

2. Internet access service providers and providers of e-mail or similar services shall inform their customers on a permanent, easy, direct and free basis of the security measures they apply in the provision of those services.

3. Service providers referred to in paragraph 1 shall also report on existing tools for filtering and restricting access to certain unwanted or potentially harmful content and services on the Internet for young people and children.

4. The service providers referred to in paragraph 1 shall provide their clients with information on possible responsibilities for the use of the Internet for illicit purposes, in particular for the commission of criminal offences and for infringements of intellectual and industrial property law.

5. The reporting obligations referred to in the preceding paragraphs shall be terminated if the relevant provider includes the information required on its website or main website in the manner set out in the above paragraphs.

It is added by article 4.6 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Text added, published on 29/12/2007, in force from 29/03/2008.

Article 12 ter. Obligations relating to the portability of non-personal data.

Intermediary service providers hosting or storing user data to which they provide social media services or equivalent information society services shall, on request, forward to such users the content they have provided to them, without preventing their subsequent transmission to another supplier. Referral shall be in a structured, commonly used and mechanically readable format.

They shall also transmit such content directly to another provider designated by the user, whenever technically possible, as foreseen by the Article 95 of Organic Law 3/2018 of 5 December Personal Data Protection and Digital Rights Guarantee.

For the performance of these obligations, the provisions of article 12.5 of the Convention shall apply. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of individuals with regard to the processing of their personal data and the free movement of such data and repealing the Directive 95/46/EC.

It is added by final provision 3.1 of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

Text added, published on 11/12/2020, in force from 11/13/2020.

Section 2.a. Liability regime

Article 13. Responsibility of information society service providers.

1. Information society service providers are subject to civil, criminal and administrative liability established generally in the legal system, without prejudice to the provisions of this Law.

2. In order to determine the liability of service providers for the pursuit of brokering activities, the following Articles shall apply.

The amendment to paragraph 2 is hereby annulled by a resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

Paragraph 2 is amended by final provision 2.7 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 14. Responsibility of network operators and access providers.

1. Operators of telecommunications networks and providers of access to a telecommunications network providing an intermediation service consisting of transmitting data provided by or providing access to the recipient of the service via a telecommunications network shall not be liable for the information transmitted, unless they themselves have caused the transmission, modified the data or selected the data or the recipients of the data.

The strictly technical manipulation of data-hosting files, which takes place during transmission, shall not be construed as modification.

2. The activities of transmission and provision of access referred to in the preceding paragraph include the automatic, provisional and transitory storage of data, provided that they are used exclusively to allow transmission through the telecommunications network and their duration does not exceed the reasonably necessary time.

The deletion of this article by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December, is hereby repealed. Ref. BOE-A-2025-1136

It is deleted by final provision 2.18 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 15. Liability of service providers who make temporary copies of data requested by users.

Intermediation service providers which transmit data provided by a recipient of the service via a telecommunications network and, for the sole purpose of making it more effective by forwarding it to other recipients who request it, shall store it in their systems on an automatic, temporary and temporary basis, shall not be liable for the content of such data or for the temporary reproduction thereof, if:

(a) Do not change the information.

(b) Allow access to it only to recipients who meet the conditions imposed for that purpose by the addressee whose information is requested.

(d) They do not interfere with the lawful use of technology generally accepted and used by the industry in order to obtain data on the use of information; and (e) They withdraw information they have stored or make impossible access to it, as soon as they have effective knowledge of:

1o That has been removed from the site of the network where it was initially located.

2. That access to it has been prevented, or that a competent court or administrative body has ordered it to withdraw or to prevent access to it.

The deletion of this article by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December, is hereby repealed. Ref. BOE-A-2025-1136

It is deleted by final provision 2.18 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 16. Liability of providers of hosting or data storage services.

1. The providers of an intermediation service consisting of hosting data provided by the recipient of this service shall not be liable for the information stored at the request of the recipient, provided that:

(a) Have no effective knowledge that the activity or information stored is unlawful or that it infringes the property or rights of a third party liable to compensation; or

(b) If they do, act diligently to remove or make impossible access to the data.

The service provider shall be deemed to have the effective knowledge referred to in paragraph (a) where a competent body has declared the data wrongful, ordered the data to be removed or that access to the data is prevented or the injury declared to have occurred, and the provider is aware of the relevant resolution, without prejudice to the procedures for the detection and removal of content that the providers apply under voluntary agreements and other means of effective knowledge that may be established.

2. The exemption from liability provided for in paragraph 1 shall not operate in the event that the recipient of the service acts under the direction, authority or control of the provider.

The deletion of this article by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December, is hereby repealed. Ref. BOE-A-2025-1136

It is deleted by final provision 2.18 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 17. Responsibility of service providers providing links to content or search tools.

1. Information society service providers providing links to other content or including in their directories or content search instruments shall not be responsible for the information to which they address the recipients of their services, provided that:

(a) Have no effective knowledge that the activity or information to which they refer or recommend is unlawful or that it infringes the property or rights of a third party that may be compensated; or

(b) If they do, act diligently to delete or disable the relevant link.

2. The exemption from liability laid down in paragraph 1 shall not operate in the event that the content provider to which it is linked or whose location is provided acts under the direction, authority or control of the provider facilitating the location of those content.

The deletion of this article by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December, is hereby repealed. Ref. BOE-A-2025-1136

It is deleted by final provision 2.18 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Paragraph 2 is amended by Art. 4.7 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

CHAPTER III

Codes of conduct

Article 18. Codes of conduct.

1. The public administrations shall, through coordination and advice, promote the development and application of voluntary codes of conduct by corporations, associations or commercial, professional and consumer organizations in the matters regulated by this Law. The State General Administration shall encourage, in particular, the development of codes of conduct at Community or international level.

Codes of conduct affecting consumers and users shall also be subject to: Chapter V of Act No. 3/1991 of 10 January 1991, unfair competition.

Codes of conduct may deal, in particular, with procedures for the detection and removal of illegal content and the protection of recipients from the electronic sending of unsolicited commercial communications, as well as with extrajudicial procedures for the resolution of disputes arising from the provision of information society services.

2. In drawing up such codes, the participation of consumer and user associations and of organisations representing persons with physical or mental disabilities should be ensured, where they affect their respective interests.

Where their content may affect them, the codes of conduct shall take particular account of the protection of minors and of human dignity, and specific codes may be drawn up where necessary on these matters.

The public authorities shall encourage, in particular, the establishment of common criteria agreed by industry for the classification and labelling of content and the adherence of providers to them.

3. The codes of conduct referred to in the preceding paragraphs shall be accessible electronically. Their translation into other official languages, in the State and the European Union, will be encouraged with a view to their wider dissemination.

Paragraph 1 is amended by final provision 2.2 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Paragraph 3 is amended by Art. 4.8 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

TITLE III

Commercial communications by electronic means

Article 19. Legal regime.

1. Commercial communications and promotional offers shall be governed, in addition to this Act, by their own rules and those in force in the field of commercial and advertising.

2. In any event, the Organic Law 15/1999 of 13 December 1999Personal Data Protection, and its development regulations, in particular as regards the collection of personal data, the information to the data subjects and the creation and maintenance of personal data files.

Article 20. Required information on commercial communications, promotional offers and competitions.

1. Commercial communications made electronically shall be clearly identifiable as such, and the natural or legal person on behalf of whom they are made shall also be clearly identifiable.

2. In the case of promotional offers, such as discounts, prizes and gifts, and of promotional contests or games, subject to authorization, it shall be ensured, in addition to compliance with the requirements set out in the preceding paragraph and in the trade management rules, that they are clearly identified as such and that the conditions of access and, where appropriate, participation are easily accessible and expressed clearly and unequivocally.

3. The provisions of the preceding paragraphs are without prejudice to the provisions of the regulations issued by the Autonomous Communities with exclusive powers over consumption.

4. In any event, it is prohibited to send commercial communications which dissimulate or conceal the identity of the sender on behalf of the person making the communication or which contravene the provisions of this article, as well as those in which the addressees are encouraged to visit Internet pages which contravene the provisions of this article.

Paragraphs 1 and 3 are amended by final provision 2.3 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Paragraph 4 is added by Art. 4.1 of Royal Decree-Law 13/2012 of 30 March. Ref. BOE-A-2012-4442.

It is amended by art. 4.9 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 21. Prohibition of commercial communications through electronic mail or equivalent electronic means of communication.

1. It is prohibited to send advertising or promotional communications by e-mail or other equivalent electronic means of communication which have not previously been requested or expressly authorized by the addressees of such communications.

2. The provisions of the preceding paragraph shall not apply where there is a prior contractual relationship, provided that the provider has lawfully obtained the contact details of the addressee and used them for the sending of commercial communications concerning products or services of his own company which are similar to those initially contracted with the customer.

In any event, the provider must provide the recipient with the possibility to object to the processing of his data for promotional purposes by means of a simple and free procedure, both at the time of data collection and in each commercial communication addressed to him.

Where the communications have been sent by e-mail, such means must necessarily consist of the inclusion of an e-mail address or other valid e-mail address where this right may be exercised, the sending of communications other than that address being prohibited.

Paragraph 2 is amended by final provision 2.4 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

A subparagraph is added to paragraph 2 by Art. 4.2 of Royal Decree-Law 13/2012 of 30 March. Ref. BOE-A-2012-4442.

It is amended by final provision 1.1 of Law 32/2003 of 3 November. Ref. BOE-A-2003-20253

Article 22. Rights of recipients of services.

1. The addressee may at any time revoke the consent given to the receipt of commercial communications with the simple notification of his will to the sender.

To this end, service providers should provide simple and free procedures to enable service recipients to revoke their consent. Where communications have been sent by e-mail, such means must necessarily consist of the inclusion of an e-mail address or other valid e-mail address where this right may be exercised, the sending of communications which do not include such address being prohibited.

They shall also provide information accessible by electronic means on such procedures.

2. Service providers may use data storage and retrieval devices on terminal equipment of the recipients, provided that they have given their consent after they have been provided with clear and complete information on their use, in particular on the purposes of data processing, in accordance with the provisions of the Convention on the Rights of the Child on the use of such devices. Organic Law 15/1999 of 13 December 1999, personal data protection.

Where technically possible and effective, the consent of the addressee to accept the processing of the data may be facilitated by the use of appropriate parameters of the browser or other applications.

This shall not prevent the possible storage or access of a technical nature for the sole purpose of transmitting a communication via an electronic communications network or, to the extent strictly necessary, for the provision of an information society service expressly requested by the addressee.

It is amended by final provision 2.5 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

It is amended by art. 4.3 of Royal Decree-Law 13/2012 of 30 March. Ref. BOE-A-2012-4442.

It is amended by final provision 1.2 of Law 32/2003 of 3 November. Ref. BOE-A-2003-20253

TITLE IV

Electronic procurement

Article 23. Validity and effectiveness of contracts concluded electronically.

1. Contracts concluded electronically shall have all the effects provided for in the legal system, where the consent and other requirements for their validity are met.

Electronic contracts shall be governed by the provisions of this Title, the Civil and Commercial Codes and the other civil or commercial contract rules, in particular the rules for the protection of consumers and users and for the management of commercial activity.

2. The conclusion of contracts by electronic means will not require prior agreement by the parties on the use of electronic means.

3. Provided the Law requires that the contract or any information related thereto be in writing, this requirement shall be deemed satisfied if the contract or information is contained in an electronic medium.

4. The provisions of this Title shall not apply to contracts relating to family law and inheritance.

Contracts, businesses or legal acts in which the Law determines for their validity or for the production of certain effects the public documentary form, or which require by law the intervention of judicial bodies, notaries, registrars of the property and commercial or public authorities, shall be governed by their specific legislation.

Article 24. Proof of contracts concluded electronically.

1. Proof of the conclusion of a contract by electronic means and of the obligations arising therefrom shall be subject to the general rules of the legal system.

Where contracts concluded by electronic means are signed electronically, the provisions of the Article 3 of Law 59/2003 of 19 December, electronic signature.

2. In any event, the electronic medium containing a contract concluded electronically will be admissible at trial as documentary evidence.

Paragraph 1 is amended by Article 4.10 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 25. Intervention by trusted third parties.

(Repealed)

It is repealed by the repeal of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

Article 26. Applicable law.

In determining the law applicable to electronic contracts, the provisions of the rules of private international law of the Spanish legal order shall be laid down, and the provisions of Articles 2 and 3 of this Law shall be taken into account for their application.

Article 27. Obligations prior to recruitment.

1. In addition to meeting the information requirements set out in the current rules, the information society service provider carrying out electronic procurement activities shall be required to make available to the addressee, before initiating the procurement procedure and by means of techniques appropriate to the means of communication used, on a permanent, easy and free basis, clear, understandable and unambiguous information on the following points:

(a) The various procedures to be followed in concluding the contract.

(b) Whether the provider will file the electronic record in which the contract is formalized and whether it will be accessible.

(d) The language or languages in which the contract may be formalized.

The obligation to make the information referred to in the preceding paragraph available to the addressee shall be deemed to have been fulfilled if the provider places it on its website or website under the conditions set out in that paragraph.

Where the provider specifically designs its e-procurement services to be accessed by means of devices with small format screens, the obligation set out in this subparagraph shall be deemed to be fulfilled when it provides permanently, easily, directly and accurately the Internet address in which such information is made available to the addressee.

2. The provider shall not be obliged to provide the information referred to in the preceding paragraph where:

(a) Both contracting parties so agree and neither of them is considered a consumer; or

(b) The contract was concluded exclusively through the exchange of e-mail or other equivalent electronic communication.

3. Without prejudice to the provisions of the specific legislation, tenders or proposals for electronic procurement shall be valid for the period fixed by the offeror or, failing that, for as long as they remain accessible to the recipients of the service.

4. Prior to the commencement of the procurement procedure, the service provider shall make available to the addressee the general conditions to which the contract should be subject, where appropriate, so that they can be stored and reproduced by the addressee.

The heading and paragraphs 1 and 2 are amended by Article 4.11 of Law 56/2007 of 28 December.Ref. BOE-A-2007-22440

Article 28. Information after the conclusion of the contract.

1. The offeror is obliged to confirm the receipt of the acceptance to which he made it by one of the following means:

(a) The dispatch of an acknowledgement of receipt by e-mail or other means of electronic communication equivalent to the address indicated by the acceptor, within 24 hours of receipt of the acceptance; or

(b) Confirmation, by means equivalent to that used in the procurement proceedings, of the acceptance received, as soon as the accepting party has completed that procedure, provided that the confirmation can be filed by its addressee.

In cases where the confirmation obligation corresponds to a recipient of services, the provider shall facilitate the fulfilment of that obligation by making available to the recipient any of the means referred to in this paragraph. This obligation shall be enforceable if the confirmation is to be addressed to the provider himself or to another addressee.

2. Acceptance and confirmation shall be deemed to have been received when the parties to which they are addressed are able to be aware of this.

In the event that the receipt of the acceptance is confirmed by acknowledgement of receipt, it shall be presumed that the addressee may have the said record since it has been stored on the server on which his email account is registered, or on the device used for receiving communications.

3. No confirmation of receipt of acceptance of an offer shall be required when:

(a) Both contracting parties so agree and neither of them is considered a consumer; or

(b) The contract was concluded exclusively by means of an exchange of e-mail or other equivalent electronic communication, where such means are not used for the sole purpose of circumventing the performance of that obligation.

Article 29. Place of conclusion of the contract.

Contracts concluded by electronic means involving a consumer shall be presumed to have been concluded at the place where the consumer is habitually resident.

Electronic contracts between employers or professionals, in the absence of an agreement between the parties, shall be presumed to have been concluded at the place where the service provider is established.

TITLE V

Judicial and extrajudicial settlement of disputes

CHAPTER I

Cease action

Article 30. Stop action.

1. An action for cessation may be brought against conduct contrary to this Law that harms the collective or diffuse interests of consumers.

2. The cessation action is aimed at obtaining a judgment condemning the defendant to cease conduct contrary to this Law and to prohibit its future repetition. The action may also be brought to prohibit the conduct of a conduct when it has been terminated at the time of the action, if there are sufficient indications that cause imminent fear of its recurrence.

3. The cessation action shall be carried out in accordance with the requirements of the Civil Procedure Act for this kind of stock.

Article 31. Active legitimation.

They are entitled to bring the cessation action:

(a) Natural or legal persons having a legitimate right or interest, including those who may be harmed by breaches of the provisions of articles 21 and 22, including providers of electronic communications services who wish to protect their legitimate commercial interests or the interests of their clients.

(b) The groups of consumers or users concerned, in the cases and conditions provided for in Civil Procedure Act.

(c) Consumer and user associations which meet the requirements of Law 26/1984 of 19 July 1984, General for the Defence of Consumers and Users, or, where appropriate, in regional consumer protection legislation.

(d) The Public Prosecutor ' s Office.

(e) The National Consumer Institute and the relevant bodies of the Autonomous Communities and Local Authorities competent for consumer protection.

(f) Entities of other Member States of the European Union established for the protection of the collective or diffuse interests of consumers who are entitled to the European Commission by their inclusion in the list published for that purpose in the Official Journal of the European Communities.

The Judges and Tribunals shall accept that list as evidence of the capacity of the entity entitled to become a party, without prejudice to examining whether the purpose of the list and the interests concerned legitimize the exercise of the action.

Paragraph (a) is amended by art. 4.4 of Royal Decree-Law 13/2012 of 30 March. Ref. BOE-A-2012-4442.

CHAPTER II

Extrajudicial settlement of conflicts

Article 32. Out-of-court settlement of conflicts.

1. The provider and recipient of information society services may submit their disputes to arbitrations under consumer and user arbitration and defence laws, and to out-of-court dispute resolution procedures established by means of codes of conduct or other self-regulation instruments.

2. In the out-of-court dispute resolution procedures referred to in the preceding paragraph, electronic means may be used, as specified in their specific rules.

TITLE VI

Information and control

Article 33. Information to recipients and service providers.

The recipients and service providers of the information society may address any body competent in the field of the information society, health and consumption of the public administrations, for:

(a) To obtain general information on their contractual rights and obligations under the rules applicable to electronic contracting;

(b) To report on judicial and extrajudicial conflict resolution procedures; and

(c) Obtain data from authorities, associations or organizations that may provide additional information or practical assistance.

Communication with such bodies may be made by electronic means.

It is amended by art. 4.12 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 34. Communication of relevant resolutions.

1. The General Council of the Judiciary shall transmit to the Ministry of Justice, in the form and at the intervals agreed by agreement between the two bodies, all judicial decisions containing relevant pronouncements on the validity and effectiveness of contracts concluded by electronic means, on their use as evidence in court, or on the rights, obligations and liability regime of recipients and service providers of the information society.

2. The arbitral bodies and those responsible for the other extrajudicial dispute resolution procedures referred to in Article 32.1 shall communicate to the Ministry of Justice the awards or decisions of relevance to the provision of information society services and electronic commerce in accordance with the criteria set out in the preceding paragraph.

3. In the communication of the decisions, awards and decisions referred to in this Article, the necessary precautions shall be taken to safeguard the right to privacy and the protection of the personal data of the persons identified therein.

4. The Ministry of Justice shall forward to the European Commission and facilitate access by any interested party to the information received in accordance with this Article.

Article 35. Monitoring and control.

1. The Ministry of Economic Affairs and Digital Transformation shall monitor:

(a) Compliance by information society service providers with the obligations laid down in this Act and its implementing provisions, with regard to information society services.

(b) The fulfilment of the obligations set out in the Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019on promoting fairness and transparency for professional users of online brokering services, by those suppliers within its scope.

(c) The fulfilment of the obligations set out in the Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022on European data governance and amending the Regulation (EU) 2018/1724 by data intermediation service providers and recognised data management organisations for altruistic purposes falling within its scope.

However, references to the competent bodies contained in articles 8, 10, 11, 15, 16, 17 and 38 shall be construed as references to courts or administrative bodies which, in each case, are concerned by the matter.

2. The bodies referred to in paragraph 1 of this Article may carry out such inspection actions as may be necessary for the exercise of their supervisory functions.

Officials attached to such bodies who carry out the inspection referred to in the preceding paragraph shall be regarded as public authority in the performance of their duties.

3. In any event, and notwithstanding the provisions of the preceding paragraph, where the conduct carried out by information society service providers is subject, by reason of the subject matter or type of entity concerned, to specific areas of competence, guardianship or supervision, irrespective of whether it is carried out using telematic or electronic techniques and means, the bodies to which the sectoral legislation confers specific control, supervision, inspection or guardianship powers shall exercise the functions which fall within their competence.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by the final provision 2.8 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Paragraph 1 is amended by final provision 1.1 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

The first subparagraph of paragraph 1 is amended by final provision 3.2 of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

Paragraph 1 is amended by final provision 2.6 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Paragraphs 1 and 2 are amended by Article 4.13 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Article 35 bis. National register of recognised data management organizations for altruistic purposes.

1. The Ministry of Economic Affairs and Digital Transformation shall establish, maintain and publish the national register of recognized data management organizations for altruistic purposes, as provided for in article 17 of the Convention. Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022on European data governance and amending the Regulation (EU) 2018/1724.

2. The maximum time limit for issuing and notifying a decision in the prior verification procedure for compliance with the requirements laid down in that Regulation Regulation (EU) 2022/868 for the registration of data management organisations for altruistic purposes shall be 12 weeks, after which the application may be deemed rejected.

It is added by final provision 1.2 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Text added, published on 09/05/2023, in force from 10/05/2023.

Article 36. Duty of collaboration.

1. Information society service providers are obliged to provide the Ministry of Science and Technology and the other bodies referred to in the preceding article with all the information and collaboration necessary for the performance of their duties.

They shall also allow their agents or inspection staff access to their premises and to consult any documentation relevant to the control activity concerned, the provisions of which apply, where appropriate, to the Article 8.5 of Act No. 29/1998 of 13 July 1998, regulating the Dispute-Administrative Jurisdiction.

2. Where, as a result of an inspection, facts are known that may constitute offences under other laws, state or autonomous, the competent bodies or bodies shall be informed of them for their supervision and punishment.

Article 36 bis. Duty of communication of organizations and associations representing professional users or users of corporate websites.

Organizations and associations that have a legitimate interest in representing professional users or users of corporate websites, and that, complying with the requirements of Article 14.3 of the Regulation (EU) 2019/1150, have requested the Ministry of Economic Affairs and Digital Transformation to be included in the list drawn up for that purpose by the European Commission, shall immediately notify the said Ministry of any circumstances affecting its entity resulting in a breach of the above requirements.

It is added by final provision 3.3 of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

Text added, published on 11/12/2020, in force from 11/13/2020.

TITLE VII

Violations and penalties

Article 37. Responsible.

They are subject to the sanctioning regime established in this title:

(a) Information society service providers to whom this Law applies.

(b) Suppliers falling within the scope of Regulation (EU) 2019/1150.

(c) Data intermediation service providers and recognized data management organizations for altruistic purposes falling within the scope of the Regulation (EU) 2022/868.

Where the infringements provided for in Article 38.3(i) and 38.4(g) are due to the installation of information storage and retrieval devices as a result of the transfer by the provider of the information society service of their own spaces to display publicity, the advertising network or agent directly managing with the provider of the information society service in the event of failure to take measures to require the user to fulfil his or her information duties and obtain the consent of the user shall be liable for the infringement.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.9 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

It is amended by final provision 1.3 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

The first paragraph is amended by final provision 3.4 of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

It is amended by final provision 2.7 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Article 38. Infractions.

1. Infringements of the provisions of this Act shall be classified as very serious, serious and minor.

2. These are very serious violations:

(a) (No content)

(b) Failure to comply with the obligation to suspend the transmission, hosting of data, access to the network or the provision of any equivalent brokering service, where directed by a competent administrative body, pursuant to Article 11.

(d) (Repealed)

3. These are serious violations:

(a) (Repealed)

(b) Significant non-compliance with article 10.1 (a) and (f).

(c) The mass dispatch of commercial communications by e-mail or other equivalent electronic means of communication, or their insistent or systematic dispatch to the same recipient of the service where the requirements of article 21 are not met in such shipments.

(d) The significant breach of the obligation of the service provider set out in Article 22(1) in relation to the procedures for the revocation of the consent of the recipients.

(e) Failure to make available to the recipient of the service the general conditions to which the contract is subject, where appropriate, in the manner provided for in article 27.

(f) The habitual breach of the obligation to confirm the receipt of an acceptance, where no agreement has been reached on its exclusion or the contract has been concluded with a consumer.

(g) Resistance, excuse or refusal to conduct the inspection of bodies authorized to carry out the inspection under this Act.

(h) Significant non-compliance with Article 10(3).

(i) The reoffending of the commission of the minor offence provided for in paragraph 4 (g) if it has been declared by a final decision issued within three years immediately prior to the commencement of the sanctioning procedure.

(j) The requirement to pay a fee for meeting the obligation under article 12 ter, other than the cases provided for in article 12.5 of the Convention; Regulation (EU) 2016/679.

(k) The habitual breach of the obligation under article 12 ter.

(l) Significant or repeated non-compliance by online brokering service providers with any of the obligations set out in articles 3 to 12 of the Convention Regulation (EU) 2019/1150.

(m) Significant or repeated non-compliance by online search engine providers with any of the obligations set out in Articles 5 and 7 of the Convention Regulation (EU) 2019/1150.

(n) Significant or repeated non-compliance by data intermediation service providers with any of the obligations under Article 11 of the Convention Regulation (EU) 2022/868.

(ñ) Significant or repeated non-compliance by data intermediation service providers with any of the conditions for the provision of data intermediation services set out in Article 12 of the Convention; Regulation (EU) 2022/868.

(o) Acting on the market as a provider of data intermediation services using the common logo and the name ‘provider of data intermediation services recognised in the Union’ without the competent authority having confirmed that it fulfils the necessary requirements as provided for in Article 11.9 of Regulation (EU) No 1303/2013; Regulation (EU) 2022/868.

(p) Significant or repeated non-compliance by recognised data management organizations for altruistic purposes with any of the requirements of Articles 18, 19, 20, 21 and 22 of the Convention; Regulation (EU) 2022/868.

(q) Acting on the market as a recognised data management organisation for altruistic purposes using the common logo and the name ‘data management organisation for altruistic purposes recognised in the Union’ without the competent authority having confirmed that it fulfils the necessary requirements laid down in Article 18 of Regulation (EU) No 1303/2013. Regulation (EU) 2022/868.

(r) Significant or repeated non-compliance by data intermediation service providers and recognised data management organizations for altruistic purposes with the obligations set out in Article 31 of the Convention Regulation (EU) 2022/868 on the transfer of non-personal data to third countries.

4. These are minor violations:

(a) Failure to comply with article 12 bis.

(b) Not to report in the manner prescribed by article 10.1 on the aspects referred to in paragraphs (b), (c), (d), (e) and (g) thereof, or in paragraphs (a) and (f) where it does not constitute a serious breach.

(d) Sending commercial communications by e-mail or other equivalent means of electronic communication where the requirements of article 21 are not met and do not constitute a serious breach.

(e) Failure to provide the information referred to in article 27.1, where the parties have not agreed to its exclusion or the addressee is a consumer.

(f) Non-compliance with the obligation to confirm the receipt of a petition in accordance with the terms of article 28, where the exclusion has not been agreed upon or the contract has been concluded with a consumer, unless it constitutes a serious breach.

(g) Use data storage and retrieval devices where the information has not been provided or the consent of the recipient of the service has been obtained as required by Article 22.2.

(h) Failure to comply with the obligation of the service provider laid down in Article 22(1) in relation to procedures for the revocation of the consent given by the addressees where it does not constitute a serious infringement.

(i) Failure to comply with Article 10(3) where it does not constitute a serious infringement.

(j) The requirement to pay a fee for meeting the obligation under Article 12b, where this is permitted by Article 12.5 of the Regulation (EU) 2016/679, if the amount exceeds the amount of the costs incurred.

(k) Failure to comply with the obligation under article 12 ter, where it does not constitute a serious breach.

(l) Non-compliance by online brokering service providers with any of the obligations set out in articles 3 to 12 of the Convention Regulation (EU) 2019/1150where it does not constitute a serious infringement.

(m) Non-compliance by online search engine suppliers with any of the obligations set out in Articles 5 and 7 of the Convention Regulation (EU) 2019/1150where it does not constitute a serious infringement.

(n) Non-compliance by data intermediation service providers with any of the obligations under Article 11 of the Convention Regulation (EU) 2022/868where it does not constitute a serious infringement.

(ñ) Non-compliance by data intermediation service providers with any of the conditions set out in Article 12 of the Convention Regulation (EU) 2022/868where it does not constitute a serious infringement.

(o) The non-compliance of recognised data management organizations for altruistic purposes with any of the requirements of Articles 18, 19, 20, 21 and 22 of the Convention Regulation (EU) 2022/868where it does not constitute a serious infringement.

(p) Non-compliance by data intermediation service providers and recognized data management organizations for altruistic purposes with the obligations set out in article 31 of the Convention Regulation (EU) 2022/868 in the case of transfers of non-personal data to third countries, where it does not constitute a serious infringement.

The amendment to paragraphs 2 to 4 is hereby annulled by a resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

Paragraphs 2 to 4 are amended by final provision 2.10 to 12 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Paragraphs 3 and 4 are amended by final provision 1.4 and 5 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Points (j) to (u) in paragraph 3 and (j) to (s) in paragraph 4 are added by final provision 3.5 and 6 of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

Paragraphs 3(c), 3(i) and 4(g) are amended by final provision 2.8-10 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Subparagraph 2 (a) is deleted and subparagraph 4 (a) is amended by article 2. 4.14 and 15 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Paragraphs 2 (c) and (d) and 3 (a) are repealed by the single derogation provision.1 of Law 25/2007 of 18 October. Ref. BOE-A-2007-18243

Paragraphs 2, 3 and 4 are amended by additional provision 8.2 of Law 59/2003 of 19 December. Ref. BOE-A-2003-23399

Paragraphs 3(b) and 4(d) are amended by final provision 1.3 and 4 of Law 32/2003 of 3 November. Ref. BOE-A-2003-20253

Article 39. Sanctions.

1. The following penalties shall be imposed for the commission of the offences referred to in the preceding article:

(a) For the commission of very serious offences, a fine of EUR 150,001 up to EUR 600,000. The repetition within three years of two or more very serious offences, which have been punished on a firm basis, may, depending on their circumstances, give rise to the penalty of prohibition of action in Spain, for a maximum period of two years.

b) serious offences, fine of 30,001 to 150,000 euros.

2. Where infringements punishable under this Law have been committed by service providers established in States which are not members of the European Union or the European Economic Area, the body which has imposed the corresponding penalty may order the intermediary service providers to take the necessary measures to prevent access from Spain to the services offered by them for a maximum period of two years in the case of very serious infringements, one year in the case of serious offences and six months in the case of minor offences.

3. Without prejudice to any economic penalties that may be imposed under this Act, the commission of the infringement provided for in Article 38(3)(p) or Article 38(4)(o) shall cancel the registration in the national and Union public registers of recognised data management organisations for altruistic purposes and the right to use the name data management organisation for altruistic purposes recognised in the Union shall be revoked.

4. Infringements may include any or some of the following additional penalties:

(a) Serious and very serious violations may be accompanied by the publication, at the expense of the perpetrator, of the sanctioning decision in the "Official Gazette of the State" or in the official public service journal which, if applicable, imposed the sanction; in two newspapers whose scope of dissemination coincides with that of the public administration or on the home page of the provider's website, once the latter is of a firm character.

For the purpose of imposing this penalty, the social impact of the offence committed, by the number of users or contracts concerned, and the seriousness of the offence shall be considered.

(b) Without prejudice to the economic penalties referred to in Article 39(1)(b), data intermediation service providers who have committed any of the serious infringements referred to in Article 38(3)(n), (n) and (o), may be subject to the definitive cessation of the activity of supply as an ancillary penalty as provided for in Article 14(4) of the Treaty. Regulation (EU) 2022/868.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.13 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

It is amended by final provision 1.6 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Drafted paragraph 2(2) in accordance with the correction of errors published in BOE No. 187 of 6 August 2002. Ref. BOE-A-2002-15886

Article 39 bis. Moderation of sanctions.

The sanctioning body shall determine the amount of the penalty by applying the scale of the type of offences immediately preceding the scale of serious offences in the case in question, in the following cases:

(a) Where a qualified reduction in the guilt of the accused or in the anti-juridicity of the act is appreciated as a result of the significant concurrence of several of the criteria set forth in article 40.

(b) When the offending entity has diligently regularized the irregular situation.

(c) Where it can be seen that the conduct of the person concerned has been likely to lead to the commission of the infringement.

(d) When the offender has spontaneously acknowledged his guilt.

(e) Where there has been a merger by absorption and the infringement predates such proceedings, it is not attributable to the absorbing entity.

It is amended by final provision 1.7 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

It is added by final provision 2.11 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Text added, published on 10/05/2014, in force from 11/05/2014.

Article 39 ter. Warning.

1. Bodies with punitive jurisdiction, taking into account the nature of the facts and the significant concurring nature of the criteria set out in articles 39 bis and 40, may agree not to initiate the penal proceedings and, instead, to warn the responsible person, in order that, within the time limit determined by the sanctioning body, it may prove that corrective measures are taken which, in each case, are relevant, provided that the acts constitute a minor or serious violation in accordance with the provisions of this Law.

2. If the warning is not taken into consideration within the time limit specified by the sanctioning body, the appropriate penalty procedure shall be initiated for such non-compliance.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.14 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

It is added by final provision 1.8 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Text added, published on 09/05/2023, in force from 10/05/2023.

Article 40. Graduation of the amount of sanctions.

The amount of fines imposed shall be graduated on the basis of the following criteria:

(a) The existence of intentionality.

(b) Time period during which the offence was committed.

(d) The nature and amount of the damage caused.

(e) The benefits derived from the offence.

(f) Invoicing volume to which the infringement relates.

(g) Adherence to a code of conduct or to a system of advertising self-regulation applicable to the offence committed, which complies with the provisions of article 18 or the eighth final provision and which has been favourably informed by the competent body or bodies.

(h) The adoption of measures to mitigate or redress the damage caused by the breach.

Point (h) is added by final provision 1.9 of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

It is amended by final provision 2.12 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Article 41. Provisional measures.

1. In proceedings for serious or very serious infringements, the procedure may be adopted in accordance with the Law 30/1992 of 26 November 1992, of the Legal Regime of the Public Administrations and of the Common Administrative Procedure, and its implementing rules, the provisional measures provided for in those rules which are deemed necessary to ensure the effectiveness of the decision which is definitively issued, the good end of the procedure, the maintenance of the effects of the infringement and the requirements of the general interests.

In particular, the following may be agreed:

(a) Temporary suspension of the activity of the service provider and, where appropriate, temporary closure of its establishments.

(b) Precinct, storage or seizure of computer records, media and archives and documents in general, as well as of computer equipment and equipment of all kinds.

(c) To warn the public of the existence of possible misconduct and of the initiation of the sanctioning file in question, as well as of the measures taken to stop such conduct.

2. In the adoption and enforcement of the measures referred to in the preceding paragraph, the guarantees, rules and procedures provided for in the legal system to protect the rights to personal and family privacy, to the protection of personal data, to freedom of expression or to freedom of information shall in any event be respected, where they may be affected.

In all cases where the Constitutionthe rules governing the respective rights and freedoms or those applicable to the various matters confer jurisdiction on the courts to intervene in the exercise of activities or rights, only the competent judicial authority may adopt the measures provided for in this Article.

3. In any event, the principle of proportionality of the measure to be adopted shall be respected with the objectives to be achieved in each case.

4. In cases of urgency and for the immediate protection of the interests involved, the provisional measures provided for in this Article may be agreed before the initiation of the sanctioning file. The measures must be confirmed, amended or terminated in the agreement to initiate the procedure, which must be carried out within 15 days of their adoption, and which may be the subject of the appropriate appeal.

In any event, such measures shall be null and void if the sanctioning procedure is not initiated within that period or if the initiating agreement does not contain an express statement of the penalties.

Article 42. Coercive fine.

The administrative body competent to decide on the sanctioning procedure may impose periodic penalty payments of not more than EUR 6,000 for each day that the provisional measures agreed upon are not complied with.

The amendment is repealed by Resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

It is amended by final provision 2.15 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Article 43. Power to impose sanctions.

1. Sanctions for non-compliance with the provisions of this Act shall be imposed on the person holding the Ministry of Economic Affairs and Digital Transformation, and on the person holding the Secretary of State for Digitization and Artificial Intelligence, in the case of very serious and minor offences.

Notwithstanding the above, the imposition of penalties for failure to comply with decisions handed down by the competent bodies on the basis of the subject matter or entity referred to in Article 38.2 (a) and (b) of this Law shall be the responsibility of the body which issued the decision in breach. The Data Protection Agency shall also be responsible for imposing penalties for the commission of offences under articles 38.3 (c), (d) and (i) and 38.4 (d), (g) and (h) of this Act.

2. The sanctioning authority provided for in this Act shall be exercised in accordance with the provisions of this Act. Law 39/2015 of 1 October 2015, the Common Administrative Procedure of Public Administrations, and its implementing rules. The procedure shall last for a maximum period of nine months from the date of the initiation agreement. The maximum duration of the simplified procedure shall be three months.

The amendment to paragraph 1 is hereby annulled by a resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

Paragraph 1 is amended by final provision 2.16 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Drafted in accordance with the bug correction published in BOE No. 19 January 2025. Ref. BOE-A-2025-994

It is amended by final provision 3.7 of Law 6/2020 of 11 November. Ref. BOE-A-2020-14046

It is amended by final provision 2.13 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

It is amended by art. 4.16 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Paragraphs 1, second subparagraph and 2 are amended by additional provision 8.3 and 4 of Law 59/2003 of 19 December. Ref. BOE-A-2003-23399

Paragraph 1 is amended by final provision 1.5 of Law 32/2003 of 3 November. Ref. BOE-A-2003-20253

Article 44. Concurrence of violations and sanctions.

1. The sanctioning authority referred to in this Law may not be exercised when criminal punishment has been imposed, in cases where the identity of the subject, fact and basis is appreciated.

However, when criminal proceedings are being conducted for the same acts or for others whose separation from those punishable under this Act is rationally impossible, the proceedings shall be suspended in respect of them until the final decision of the judicial authority is given.

If the case file is re-established, the decision to be issued must respect the facts established in the court decision.

2. The imposition of a penalty provided for in this Act shall not prevent the processing and resolution of another procedure punishable by the competent bodies or bodies in each case where the offending conduct was committed using telematic or electronic techniques and means and is defined in another Act, provided that there is no identity of the protected legal good.

3. Penalties shall not be imposed under this Act if the acts constituting an offence are also punishable under the sectoral regulations to which the service provider is subject and there is an identity of the protected legal good.

Where, as a result of punitive action, facts which may constitute offences established in other laws are known, the competent bodies or bodies shall be informed of such offences for their supervision and punishment.

Article 45. Prescription.

Very serious offences shall be prescribed at three years, serious offences at two years and minor offences at six months; penalties for very serious offences shall be prescribed at three years, serious offences at two years and minor offences at one year.

Additional provision one. Meaning of the terms used by this Law.

For the purposes of this Law, the terms defined in the Annex shall have the meaning assigned to them there.

Second additional provision. Drugs and medical devices.

The provision of information society services relating to medicinal products and medical devices shall be governed by the provisions of their specific legislation.

Additional provision three. Arbitral System of Consumption.

The provider and the recipient of information society services may submit their disputes to consumer arbitration by acceding to the competent Arbitral System of Consumption which shall also be provided by electronic means, in accordance with the procedure laid down by regulation.

It is amended by art. 4.17 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Additional provision four. Amendment of the Civil and Commercial Codes.

One. The Article 1.262 of the Civil Codewhich is worded as follows:

‘The consent is expressed by the tender contest and by the acceptance of the thing and the cause to be constituted by the contract.

In different places, the one who made the offer and the one who accepted it, there is consent since the offeror knows the acceptance or since, having sent it the acceptor, he cannot ignore it without failing to good faith. The contract, if any, is presumed to have been concluded at the place where the offer was made.

In contracts concluded by automatic devices there is consent since the acceptance is expressed.’

Two. The Article 54 of the Commercial Codewhich is worded as follows:

"When the offerer is in different places, the offeror has given his consent since the acceptance was received or since the acceptance was sent by the acceptor, he cannot ignore it without failing to do so in good faith. The contract, if any, is presumed to have been concluded at the place where the offer was made.

In contracts concluded by automatic devices there is consent since the acceptance is expressed.’

Additional provision 5. Accessibility for persons with disabilities and elderly to information provided by electronic means.

(Repealed)

It is repealed by the single derogation provision.c) of Law 11/2023 of 8 May. Ref. BOE-A-2023-11022

Paragraph 6 is added by Art. 16 of Law 26/2011 of 1 August. Ref. BOE-A-2011-13241.

Paragraph 1 is amended and paragraphs 3, 4 and 5 are added by Article 4.18, 19 and 20 of Law 56/2007 of 28 December. Ref. BOE-A-2007-22440

Additional provision 6. Domain name allocation system under the ".es".

One. This provision governs, in compliance with the provisions of the Additional provision 16 of Law 17/2001 of 7 December 2001, by Brands, the inspiring principles of the domain name allocation system under the country code corresponding to Spain ".es".

Two. The corporate public entity Red.es is the allocation authority, which is responsible for managing the registration of Internet domain names under the ".es", as set out in the sixth additional provision of the Act No. 11/1998 of 24 April 1998General Telecommunications.

Three. The assignment of Internet domain names under the ".es" shall be carried out in accordance with the criteria set out in this provision, in the National Plan for Internet Domain Names, in the other specific rules that are issued in its development by the assignment authority and, to the extent that they are compatible with them, with the generally applied practices and recommendations emanating from international entities and agencies that carry out activities related to the management of the Internet domain name system.

The criteria for the allocation of domain names under the ".es" should ensure an adequate balance between the confidence and legal certainty required for the development of electronic commerce and other services and activities by electronic means, and the flexibility and agility required to enable the satisfaction of the demand for the allocation of domain names under the ".es", thus contributing to the development of the information society in Spain.

Differentiated spaces may be created under the ".es", which facilitate the identification of the contents they host depending on their owner or the type of activity they perform. Among others, indicators may be created related to education, entertainment and the proper moral development of childhood and youth. These third-level domain names will be assigned as set out in the National Internet Domain Name Plan.

Four. They may apply for the assignment of domain names under the ".es", as provided for in the National Plan for Internet Domain Names, to all persons or entities, with or without legal personality, that have interests or have links with Spain, provided that they meet the other requirements for obtaining a domain name.

Domain names under the ".es" shall be assigned to the first applicant entitled to do so, without the possibility of granting, in general, a preferential right to obtain or use a domain name to holders of certain rights.

The allocation of a domain name confers on its owner the right to use it, which shall be conditional on the fulfilment of the requirements established in each case, as well as on its maintenance over time. Verification by the assignment authority of non-compliance with these requirements shall result in the cancellation of the domain name, subject to the procedure to be determined in each case and to be ensured by the hearing of interested parties.

Beneficiaries of a domain name under the ".es" shall respect the technical rules and conditions that the allocation authority may establish for the proper functioning of the domain name system under the ".es".

The responsibility for the correct use of a domain name in accordance with the laws, as well as for respect for intellectual or industrial property rights, rests with the person or organization for which such domain name has been registered, in the terms provided for in this Law. The assignment authority shall cancel those domain names whose owners infringe those rights or conditions, provided that this is ordered in the relevant judicial decision, without prejudice to what is provided for in paragraph 8 of this additional provision.

Five. The National Plan of Internet Domain Names will establish appropriate mechanisms to prevent abusive or speculative registration of domain names, misuse of generic terms or place names and, in general, to prevent conflicts that may arise from the assignment of domain names.

In addition, the Plan will include the necessary precautions to minimize the risk of error or confusion on the part of users regarding ownership of domain names.

For this purpose, the public enterprise entity Red.es will establish the necessary coordination with the Spanish public registers. Its holders shall facilitate access to and consultation of such public registers, which in any event shall be free of charge to the entity.

Five bis. The assignment authority shall suspend or cancel, in accordance with the corresponding prior judicial order, the domain names by which a criminal offence or misdemeanour established in the Spanish Criminal Code. Similarly, the assignment authority shall proceed when the State Security Forces and Corps issue a request for precautionary suspension as a preventive measure within 24 hours of the knowledge of the facts.

Furthermore, pursuant to the provisions of articles 8, 11 and in accordance with this Law, the competent administrative or judicial authority may, as a measure to obtain the interruption of the provision of an information society service or the withdrawal of content, require the assignment authority to suspend a domain name or cancel a domain name.

In the same way, the other legal cases will be taken.

In the cases provided for in the preceding two paragraphs, a precautionary suspension or cancellation of a domain name may be ordered only if the service provider or responsible person has failed to comply with the order for cessation of the illicit activity.

In all cases where the Constitutionthe rules governing the respective rights and freedoms or those applicable to the different matters confer jurisdiction on the courts in an exclusive manner to intervene in the exercise of activities or rights, only the competent judicial authority may require interim suspension or cancellation. In particular, where such measures affect the rights and freedoms of expression and information and other protected under the terms of the Convention, Article 20 of the Constitution may only be decided by the competent courts.

The suspension shall consist of the impossibility of using the domain name for the purposes of Internet address and the prohibition to modify the ownership and registration data of the domain name, although it may add new contact details. The owner of the domain name may only renew the domain name or modify the renewal modality. The precautionary suspension shall be maintained until it is lifted or confirmed in a final decision ordering the cancellation of the domain name.

The cancellation will have the same effects as the suspension until the expiration of the registration period and if the remaining time is less than one year, for an additional year, after which the domain name may be re-allocated.

Six. The assignment of domain names shall be carried out by telematic means that ensure the agility and reliability of registration procedures.

The submission of applications and the practice of notifications shall be done electronically, except in cases where this is provided for in the assignment procedures and other transactions associated with the registration of domain names.

Registrars, as intermediaries in the procedures relating to the registration of domain names, may provide ancillary services for the assignment and renewal of domain names, in accordance with the requirements and conditions to be determined by the assignment authority, which shall in any case ensure respect for the principle of free competition between those agents.

Seven. The National Plan for Internet Domain Names will be approved by order of the Minister of Science and Technology, on the proposal of the public enterprise entity Red.es.

The Plan will be supplemented by the procedures for the allocation and other operations associated with the registration of domain names and Internet addresses established by the President of the corporate public entity Red.es, as foreseen in the additional provision of Act No. 14/2000 of 29 December 2000, of Fiscal, administrative and social measures.

Eight. In such terms as may be permitted by the applicable provisions, the assignment authority may establish a system of out-of-court dispute resolution on the use of domain names, including those relating to industrial property rights. This system, which will ensure that the parties concerned are afforded adequate procedural guarantees, shall apply without prejudice to any legal action the parties may take.

Nine. In order to promote the development of eGovernment, the corporate public entity Red.es will be able to provide the service of telematics administrative notifications and to provide reliable proof of the date and time of their receipt.

Section Fivea is added by final provision 2.14 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Additional provision 7. Promotion of the Information Society.

The Ministry of Science and Technology as the Department of the General Administration of the State responsible for the proposal to the Government and for the implementation of policies to promote the development in Spain of the Information Society, the generation of national added value and the consolidation of a strong and efficient national industry of products, services and contents of the Information Society, will submit to the Government for approval and to the Cortes Generales a four-year plan for the development of the Information Society and convergence with Europe with measurable objectives, structured around concrete actions, with effective follow-up mechanisms, that addresses in a balanced manner all the lines of action, considering different horizons of maturation of initiatives and ensuring cooperation and coordination of the public administrations as a whole.

This plan will also set out the objectives, actions, resources and periodicity of the convergence process with the countries of our Community environment in line with the decisions and recommendations of the European Union.

In this regard, the plan shall:

Strongly promote training and education initiatives in information technologies to extend their use, especially in the fields of education, culture, business management, e-commerce and health.

To deepen the implementation of government and e-government by increasing the level of citizen participation and improving the efficiency of public administrations.

It is added by final provision 1.6 of Law 32/2003 of 3 November. Ref. BOE-A-2003-20253

Written in accordance with the correction of errors published in BOE No.68 of 19 March 2004. Ref. BOE-A-2004-5049

Text added, published on 04/11/2003, in force from 05/11/2003.

Additional provision 8th. Collaboration of domain name registers established in Spain in the fight against illicit activities.

1. Domain name records established in Spain shall be subject to the provisions of paragraph Five bis of the sixth additional provision, with respect to the domain names they assign.

2. Domain name registration entities established in Spain shall be obliged to provide data relating to domain name holders requested by public authorities for the exercise of their powers of inspection, control and sanction where the administrative offences being prosecuted are directly related to the activity of an Internet page identified with the domain names they assign.

Such data shall also be provided, where necessary, for the investigation and mitigation of cybersecurity incidents involving equipment related to a domain name of those entrusted to its management. Such information shall be provided to the body, body or entity legally or regulatoryly determined.

In both cases, the request shall be made by means of a reasoned written statement specifying the data required and the need and proportionality of the data requested for the purpose sought. If the data requested are personal data, their transfer will not require the consent of the data subject.

It is added by final provision 2.15 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Text added, published on 10/05/2014, in force from 11/05/2014.

Additional provision ninth. Management of cybersecurity incidents affecting the Internet network.

1. Information Society service providers, domain name registers and registration agents established in Spain are obliged to cooperate with the competent CERT in the resolution of cybersecurity incidents affecting the Internet network and to act on the security recommendations indicated or set out in the codes of conduct derived from this Law.

Bodies, public bodies or any other public sector entity operating security incident response teams shall collaborate with the competent authorities to provide the technical evidence necessary for the prosecution of offences arising from such cybersecurity incidents.

2. For the performance of the above functions and obligations, information society service providers, while respecting the secrecy of communications, shall provide the necessary information to the competent CERT and to the competent authorities for the proper management of cybersecurity incidents, including IP addresses that may be involved or involved in them.

Similarly, public bodies, agencies or any other public sector entity operating security incident response teams may exchange information associated with cybersecurity incidents with other CERTs or competent authorities at national and international level, provided that such information is necessary for the prevention of incidents within their scope of action.

3. The Government will launch, within six months, a programme to promote a public-private cooperation scheme to identify and mitigate cyber security attacks and incidents affecting the Internet network in Spain. To this end, codes of conduct on cybersecurity applicable to different providers of information society services, as well as domain name registers and registration agents established in Spain, will be developed.

The codes of conduct shall determine the set of standards, measures and recommendations to be implemented to ensure efficient and effective management of such cybersecurity incidents, the collaborative regime and conditions for adherence and implementation, as well as the procedures for analysing and reviewing the resulting initiatives.

The Secretariat of State for Telecommunications and the Information Society shall coordinate the actions undertaken under these codes of conduct.

4. In accordance with the codes of conduct to be defined in particular, information society service providers shall identify users affected by cybersecurity incidents notified to them by the competent CERT and indicate to them the actions to be carried out and which are under their responsibility, as well as the times of action. In any event, they shall be provided with information on the harm they may suffer or cause to third parties if they do not assist in the resolution of cybersecurity incidents covered by this provision.

In the event that users do not exercise their responsibility for disinfection or removal of elements causing the cybersecurity incident within the recommended time limit, service providers shall, at the request of the competent CERT, isolate such equipment or service from the network, thus avoiding negative effects on third parties until the malicious activity ceases.

The preceding paragraph shall apply to any equipment or service geolocated in Spain or operating under a domain name ‘.es’ or others whose registration is established in Spain.

5. The competent organs, public bodies or any other public sector entity shall be determined by regulation to perform the functions of security incident response equipment or CERT for the purposes of this provision.

6. The Secretariat of State for Telecommunications and the Information Society shall ensure a smooth exchange of information with the Secretariat of State for Security of the Ministry of the Interior on incidents, threats and vulnerabilities as envisaged in the Act 8/2011 of 28 April 2011establishing measures for the protection of critical infrastructure. In this regard, coordination mechanisms will be established between the two bodies to ensure the provision of a coordinated response to incidents within the framework of this Law.

It is added by final provision 2.16 of Law 9/2014 of 9 May. Ref. BOE-A-2014-4950.

Text added, published on 10/05/2014, in force from 11/05/2014.

Single transitional provision. Annotation in the corresponding public records of domain names granted prior to the entry into force of this Law.

Service providers who, at the time of entry into force of this Law, were already using one or more domain names or Internet addresses shall apply for the entry of at least one of them in the public register in which they were registered for constituent or advertising purposes within one year of the said entry into force.

Final provision one. Amendment to Article 37 of the Act No. 11/1998 of 24 April 1998General Telecommunications.

Article 37 (1) (a) is amended as follows: Act No. 11/1998 of 24 April 1998, Telecommunications General, which is worded as follows:

'(a) Citizens may be connected to the public fixed telephone network and may have access to the provision of the fixed telephone service available to the public. The connection should provide the user with the possibility to broadcast and receive national and international calls and allow for the transmission of voice, fax and data at sufficient speed to access the Internet functionally.

For this purpose, the sufficient speed referred to in the preceding paragraph shall be deemed to be that which is widely used for access to the Internet by subscribers to the fixed telephone service available to the public with connection to the network by means of copper pairs and voiceband modem.’

This provision enters into force on 13 July 2002, as set out in final provision 9.

Final provision two. Amendment of the sixth additional provision of the Act No. 11/1998 of 24 April 1998General Telecommunications.

Paragraph 10 of the sixth additional provision of the Act No. 11/1998 of 24 April 1998, Telecommunications General, to read as follows:

‘10. Allocation fee for limited resource of domain names and Internet addresses.

(a) Taxable fact.

The taxable fact of the fee for allocation of domain names and Internet addresses will be constituted by the realization by the public entity of the activities necessary for the assignment and renewal of domain names and Internet addresses under the country code corresponding to Spain (.es).

(b) Passive subjects.

Applicants for the allocation or renewal of Internet names and addresses shall be taxable persons.

The amount of the fee shall be unique for each name or address whose allocation or renewal is requested. In no case shall the name or address be assigned or renewed without payment of the fee.

Only the number and identity of the elements and criteria for quantification on the basis of which the due quotas are determined may be amended by law.

For the purposes set out in the preceding paragraph, elements and criteria for quantifying the amount required by the initial annual allocation of domain names or Internet addresses are considered the number allocated, the cost of the verification and verification activities of the allocation requests, as well as the level at which the allocation occurs and, in the case of annual renewal in subsequent years, the cost of maintaining the allocation and the verification and updating of data activities.

The number of Internet names or addresses assigned and the action taken by registration agents to specify the amount of the fee will also be taken into account.

The establishment and modification of the amounts resulting from the application of the elements and quantification criteria referred to in the preceding paragraphs may be carried out by ministerial order.

By way of derogation from the preceding subparagraphs of this subparagraph, in exceptional cases where this is provided for in the National Plan for Internet Domain Names and in such terms as may be laid down therein, on the basis of the special market value of the use of certain names and addresses, the amount per initial annual allocation may be replaced by the amount resulting from a tendering procedure setting out an estimated initial reference value. If the award value of the invitation to tender exceeds that reference value, that reference value shall constitute the amount of the fee. In cases where this tender procedure is followed, the Ministry of Science and Technology shall require, prior to its convening, the competent authority for the Register of Domain Names to suspend the granting of the names and addresses it considers to be affected by its special economic value. The relevant basic documents will then be approved, taking into account the provisions of the National Plan for Internet Domain Names, the requirements, conditions and conditions applicable to the tendering procedure.

(d) I accrue.

The fee shall be due on the date on which the application for allocation or renewal of Internet names or addresses is accepted, as provided for in the regulations, and shall not be processed without payment.

(e) Taxation and collection management.

The levy on the fee shall be based on the allocation of its management to the public enterprise entity Red.es and the determination of the procedure for its settlement and payment, by ministerial order.

Model declarations, deadlines and forms of payment of the fee shall be approved by resolution of the public entity Red.es.

The amount of revenue obtained by this fee shall be used to finance the expenses of the public entity of the company Red.es for the activities carried out in the performance of the functions assigned to it in subparagraphs (a), (b), (c) and (d) of paragraph 4 of this provision, including, where appropriate, the surplus in the Public Treasury, in accordance with the proportion and amount to be determined by a joint decision of the Secretaries of State for Budgets and Expenditures and for Telecommunications and for the Information Society, on the proposal of the latter.’

This provision enters into force on 13 July 2002, as set out in final provision 9.

Final provision three. Addition of a new transitional provision to the Act No. 11/1998 of 24 April 1998General Telecommunications.

In addition to Act No. 11/1998 of 24 April 1998, Telecommunications General, a new twelfth transitional provision, with the following wording:

‘Transitional provision twelfth. Criteria for the development of the technology upgrade plan for the fixed public telephone network access network.

Within five months of the entry into force of this provision, the operator designated for the provision of the universal service shall submit to the Ministry of Science and Technology, for approval within one month, following a report by the Telecommunications Market Commission, a detailed action plan to ensure that connections to the fixed public telephone network allow its subscribers functional access to the Internet and, in particular, to those connected via Rural Cell Access Telephony (TRAC).

The development of the plan shall be subject to the following conditions:

(a) Include efficient technological solutions available on the market to ensure the right of users to have, upon request from the approval of the plan, the possibility of functional access to the Internet within a maximum period of 60 days from the date of such request in the areas covered. Such technological solutions should provide for their medium-term evolution towards broadband speeds without necessarily requiring their replacement.

(b) The introduction of technology solutions referred to in paragraph (a) into the access network should reach subscribers to the fixed telephone service available to the public who, at the date of approval of the plan, do not have the possibility of functional access to the Internet, according to the following schedule:

1st At least 30 per 100 by 30 June 2003.

2. At least 70 per cent by 31 December 2003.

3rd 100 per cent by 31 December 2004.

In any case, this implementation will reach at least 50 per cent of the above-mentioned subscribers in each of the Autonomous Communities by 31 December 2003.

(c) The action plan should prioritize the deployment referred to in paragraph (b) above in accordance with the higher density of affected subscribers.

(d) For the purposes of the preceding paragraphs and where necessary, the operator designated for the provision of the universal service may conclude with other operators holding concessions in the public radio domain, contracts for the assignment of rights to use the frequency bands necessary for the fulfilment of the objectives set out in this provision. Such contracts shall be subject to prior approval by the Ministry of Science and Technology, which may lay down such conditions as it deems necessary to safeguard the public interest.’

This provision enters into force on 13 July 2002, as set out in final provision 9.

Final provision four. Amendment of the single derogation provision of the Act No. 11/1998 of 24 April 1998General Telecommunications.

The last paragraph of the single derogation provision is amended Act No. 11/1998 of 24 April 1998, Telecommunications General, which is worded as follows:

‘Any other provisions of the same or lower rank as this Law shall likewise be repealed in relation to the provisions of this Law and in particular to Article 37(1)(a) as regards data transmission speed.’

This provision enters into force on 13 July 2002, as set out in final provision 9.

Final provision five. Adjustment of the regulatory regulation on telephone or electronic contracting with general conditions to this Act.

The Government shall, within one year, amend the Royal Decree 1906/1999 of 17 December 1999regulating telephone or electronic contracting with general conditions under development Article 5.3 of Act No. 7/1998 of 13 April 1998on general terms and conditions of recruitment, in order to adapt its content to the provisions of this Act.

In this amendment, the Government will take particular account of the need to facilitate the actual use of electronic contracts, in accordance with the mandate set out in Article 9.1 of the Convention. Directive 2000/31/EC.

Final provision six. Constitutional foundation.

This Act is governed by article 149.1.6.a, 8a and 21a of the Constitution. the Constitutionwithout prejudice to the powers of the Autonomous Communities.

Final provision seven. Enabling the Government.

The Government is empowered to develop the provisions of this Act by regulation.

Final provision 8th. Differential from adherence to codes of conduct incorporating certain guarantees.

Within one year of the entry into force of this Act, the Government shall adopt a distinctive mark identifying service providers who comply with codes of conduct adopted with the participation of the Consumers and Users Council and which include, inter alia, adherence to the Arbitral Consumer System or other systems of extrajudicial dispute resolution that comply with the principles laid down in Community legislation on alternative consumer dispute resolution systems, as laid down in regulations.

Final provision ninth. Entry into force.

This Law will enter into force three months after its publication in the "Official Gazette of the State".

However, the first, second, third and fourth additional provisions of this Law shall enter into force on the day following its publication in the "Official Gazette of the State".

Therefore,

I command all Spaniards, private individuals and authorities to keep and enforce this law.

Madrid, 11 July 2002.

JUAN CARLOS R.

The President of the Government,

JOSÉ MARÍA AZNAR LÓPEZ

ANNEX

Definitions

For the purposes of this Act:

(a) "Information society services" or "services" shall mean any service normally provided at a cost, at a distance, by electronic means and at the individual request of the addressee.

The concept of information society service also covers services not paid by its recipients, to the extent that they constitute an economic activity for the service provider.

Information society services are, inter alia, provided that they represent an economic activity, the following:

1. Electronic procurement of goods or services.

2. Organization and management of auctions by electronic means or by virtual markets and shopping centres.

3.o The management of online purchases by groups of people.

4. The sending of commercial communications.

5.o Information provision via telematics.

Information society services shall not be regarded as those which do not meet the characteristics referred to in the first subparagraph of this paragraph, and in particular the following:

1. Services provided through voice telephony, fax or telex.

2. The exchange of information by means of e-mail or other equivalent electronic means of communication for purposes other than the economic activity of those who use it.

3. o The television broadcasting services (including quasi-video on demand) referred to in Article 3(a) of the Treaty, Act No. 25/1994 of 12 July 1994incorporating into the Spanish legal system the Council Directive 89/552/EEC of 3 Octoberon the coordination of certain laws, regulations and administrative provisions of the Member States relating to the pursuit of television broadcasting activities, or any other provisions replacing it.

4th Sound broadcasting services; and

5.o Teletext television and other equivalent services such as electronic guides of programmes offered through television platforms.

(b) "intermediary service" means an information society service facilitating the provision or use of other information society services or access to information.

Intermediation services include the provision of Internet access services, the transmission of data via telecommunications networks, the temporary copying of Internet pages requested by users, hosting on the data servers, applications or services provided by others, and the provision of search, access and data collection tools or links to other Internet sites.

(d) "Service consignee" or "addressee" means a natural or legal person who uses, whether or not for professional reasons, an information society service.

(e) "Consumer" means a natural or legal person within the meaning of Article 1 of the Law 26/1984 of 19 July 1984General for the Defense of Consumers and Users.

(f) "Commercial communication" means any form of communication aimed at the promotion, directly or indirectly, of the image or goods or services of an undertaking, organisation or person engaged in a commercial, industrial, craft or professional activity.

For the purposes of this Law, the commercial communication shall not be considered data that allow direct access to the activity of a person, enterprise or organization, such as the domain name or email address, or communications relating to goods, services or the image offered when they are produced by a third party and without economic consideration.

(g) "regulated occupation" means any professional activity which requires the acquisition of a diploma in accordance with laws or regulations.

(h) "Electronic contract" or "electronic contract" means any contract in which the offer and acceptance are transmitted through electronic data processing and storage equipment connected to a telecommunications network.

(i) "Coordinated regulatory area" means all requirements applicable to information society service providers, whether required by this Law or other rules governing the exercise of economic activities by electronic means, or by the general laws applicable to them, which relate to the following aspects:

1st Beginning of the activity, such as professional qualifications or qualifications required, registration advertising, precise administrative or collegial authorizations, notification schemes to any public or private body or body; and

2. Subsequent exercise of this activity, such as requirements relating to the performance of the service provider, the quality, safety and content of the service, or those affecting advertising and electronic contracting and the responsibility of the service provider.

Conditions relating to tangible goods and goods, their delivery and services not provided by electronic means are not included in this area.

(j) "competent body" means any judicial or administrative body, whether of the General Administration of the State, of the Autonomous Administrations, of the local entities or of their respective bodies or public bodies, acting in the exercise of legally conferred powers.

The amendment to subparagraph (b) is hereby annulled by a resolution of 22 January 2025, which publishes the Agreement of the Congress of Deputies repealing Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2025-1136

Paragraph (b) is amended by final provision 2.17 of Royal Decree-Law 9/2024 of 23 December. Ref. BOE-A-2024-26915

Point 6 of point (a) is repealed by the repeal provision.18 of Law 7/2010 of 31 March. Ref. BOE-A-2010-5292

Regulates information society services and electronic commerce, including relevant website information duties. Its requirements sit alongside privacy and other rules applicable to the service.

This summary was prepared from the Spanish BOE text retrieved on 7 November 2026.

Legal dictionary Related legal services