Spain

La Moncloa. The Government of Spain regulates artificial intelligence to ensure its reliable, ethical and guaranteed use

Spanish Data Protection Agency investigation into BBVA over alleged General Data Protection Regulation violations (EXP202408496)

On 4 March 2026, the Spanish Data Protection Agency (AEPD) issued a ruling imposing a sanction of EUR 100'000 on Banco Bilbao Vizcaya Argentaria (BBVA) after confirming that the bank had infringed Article 6 of the General Data Protection Regulation (GDPR) by processing personal data without a valid legal basis. The facts established that the original SEPA mandate was linked to a cancelled account and that BBVA had certified that no active transfer was in place; the claimant’s consent had not ...

Investigation into X, Meta, and TikTok over alleged AI-enabled creation and dissemination of child sexual abuse material

On 17 February 2026, Spain's Council of Ministers voted to request the Public Prosecutor's Office to investigate and, where appropriate, prosecute potential crimes of sexual abuse material against minors on major social media platforms, including X, Meta, and TikTok. The Council of Ministers initiated the action under Article 8 of the Organic Statute of the Public Ministry to request an investigation into whether the platforms are facilitating child sexual abuse material through Artificial In...

Data Protection Agency investigation into Tools for Humanity Corporation and Worldcoin's data processing activities compliance with GDPR

On 16 February 2026, the Spanish Data Protection Agency (AEPD) issued a warning to Tools for Humanity regarding planned Orb-related processing operations in Spain. The company had informed the AEPD that it acts as sole data controller, that operations would relaunch in Barcelona in February 2026, that a new subscription-based rewards model would replace token-based rewards, and that the Worldcoin Foundation is no longer involved in processing due to anonymised multi-party computation. After r...

Content moderation regulation in proposed legislative package for digital platforms

On 3 February 2026, the President of the Government announced a package of five measures aimed at digital platforms. The announced measures include a proposed legislative reform to hold platform managers legally responsible where illegal or hateful content is not removed. Under the reform, algorithmic manipulation and the amplification of illegal content would also be classified as a criminal offence. Further, the President of the Government announced the creation of a tracking, quantificatio...

Guide on protecting privacy while using AI tools

On 27 January 2026, the Spanish Data Protection Agency (AEPD) released a guide on protecting privacy while using AI tools. The guide provides ten recommendations, including advising users not to upload personal data and, in particular, to avoid sensitive data such as health, financial, contractual, geolocation and travel or accommodation data. Further, the guide advises users to review AI service terms and select safer versions, noting data flows including cookies, IP addresses, tracking and ...

Updated frequently asked questions on data protection

On 21 January 2026, the Spanish Data Protection Agency (AEPD) published an updated Frequently Asked Questions (FAQ) section, aiming to provide small and medium-sized enterprises (SMEs) and privacy professionals with practical tools for regulatory compliance. The initiative forms part of the Strategic Plan 2025-2030 and addresses over 200 questions commonly raised by data controllers and citizens. The update introduces a new category specifically dedicated to the obligations of data controller...

Data Protection Agency published information note analysing risks arising from using third-party images in artificial intelligence systems

On 13 January 2026, the Spanish Data Protection Agency (AEPD) published an information note analysing the data protection implications of using third parties’ images in Artificial Intelligence (AI) systems. The note applies to AI providers, platforms, and users that upload, generate, modify, or disseminate images or videos of identifiable persons. It highlights visible risks, including sexualisation and synthetic intimate content, attribution of false events with reputational effects, decontextu

User recommendations regarding TikTok's international data transfers

On 22 December 2025, the Spanish Data Protection Agency issued user recommendations stating that TikTok continues to transfer European users’ personal data to third countries, including China, despite prior findings by European data protection authorities that such transfers do not comply with the General Data Protection Regulation (GDPR). The Agency noted that an Irish court temporarily lifted the suspension on these transfers pending a final ruling, but only subject to TikTok meeting strict...

Investigation into Meta over allegations that it tracked Android users' web activity and linked it to Facebook and Instagram identities

On 19 November 2025, the Prime Minister announced an investigation into Meta following findings by research centres in Spain, Belgium, and the Netherlands that the company allegedly used a hidden mechanism to track the web activity of Android users and link it to their Facebook and Instagram identities. The alleged practice may be in breach of the General Data Protection Regulation, the ePrivacy Directive, the Digital Markets Act, and the Digital Services Act. The Prime Minister noted that Me...

Package of measures to address threats in digital space, including disinformation and child protection

On 19 November 2025, the Prime Minister of Spain announced a package of measures to address threats in the digital space. The package focuses on online platforms and covers four areas, including disinformation, child protection, hate speech and social polarisation, and privacy. The package aims to implement the Prime Minister's proposals at the World Economic Forum's annual meeting of 2025. The proposal highlighted verifying identities through the European Digital Identity Wallet, mandating e...

Encryption Guide for Self-Employed Workers and Small and Medium-Sized Enterprises

On 18 November 2025, the Spanish Data Protection Agency (AEPD) released the Encryption Guide for Self-Employed Workers and Small and Medium-Sized Enterprises (SMEs), providing self-employed professionals and SMEs with a practical approach to implementing secure and appropriate encryption measures for a number of relevant scenarios. The Guide explains the purpose of encryption and sets out practical measures in a number of scenarios, such as email transmission, cloud storage and device protect...

Preliminary Draft Law for the proper use and governance of Artificial Intelligence, for the purposes set forth in Article 26.4 of Law 50/1997 was approved by Council of Ministers

On 11 March 2025, the Council of Ministers approved the Preliminary Draft Law for the proper use and governance of Artificial Intelligence (AI), for the purposes set forth in Article 26.4 of Law 50/1997, aligning Spanish legislation with the European AI regulation to ensure ethical, inclusive, and beneficial AI use. The draft law introduces a digital right to withdraw AI systems that cause serious incidents and mandates clear labelling of AI-generated content. Oversight responsibilities are assi

Data Protection Agency clarification on General Data Protection Regulation regarding AI

On 11 March 2025, the Spanish Data Protection Agency (AEPD) published an article on artificial intelligence (AI) and data protection, referring to a recent publication by the UK's Information Commissioner's Office (ICO). The ICO's consultation on generative AI identified several points for clarification, including the requirement that incidental processing of personal data falls within the scope of data protection laws. The ICO stated that data protection rules apply to any processing of pers...

Data Protection Authority investigation into World 2 Meet over alleged unnecessary collection of personal data

On 22 August 2025, the Spanish Data Protection Authority (AEPD) fined World 2 Meet EUR 70’000 for the unnecessary collection of personal data. The amount was reduced by 20 per cent to EUR 56’000 for acknowledgement of liability, and by a further 20 per cent to EUR 42’000 for voluntary payment. World 2 Meet, the travel division of the Iberostar Group, required a complainant to submit a copy of his identity document to complete traveller registration. The complainant argued this was unnecessary...

Data Protection Authority investigation into Vodafone over alleged direct marketing violations

On 18 July 2025, the Spanish Data Protection Authority (APED) rejected Vodafone Spain's appeal of an AEPD ruling, which found the company liable for direct marketing violations. On 8 May 2025, Vodafone Spain appealed the ruling from the AEPD in which it issued fines totalling EUR 20'000 for sending unsolicited commercial emails and failing to include an opt-out mechanism in emails. Vodafone claimed that there was a recording error in which another client, who had opted into the emails, was li...

Data Protection Agency guidance on its authority in accordance with EU's Artificial Intelligence Act

On 15 July 2025, the Spanish Data Protection Agency (AEPD) issued guidance clarifying that it can already act against prohibited AI systems that process personal data, before the EU Artificial Intelligence (AI) Act is fully in force. From 2 August 2025, supervisory and sanctioning provisions under Article 5 of the AI Act covering banned AI systems such as real-time biometric identification in public spaces, will begin to apply. Although Spain has not yet adopted its national AI law and the AE...

AEPD code of conduct for resolution of data protection disputes in electronic communications sector

On 17 December 2024, the code of conduct for regulating data protection disputes in the electronic communications sector adopted by the Spanish Data Protection Agency (AEPD) enters into force. The code introduces a mediation procedure for resolving disputes between citizens and member entities, covering issues such as data processing without legitimacy, unmet rights, improper credit system insertion, and fraudulent contracting. The procedure, supervised by the Advertising Jury of the Associat...

Extended Collective Licensing for the use of copyrighted works in Artificial Intelligence training

On 10 December 2024, the Ministry of Culture closes its consultation on a draft Royal Decree to introduce Extended Collective Licensing (ECL) for the use of copyrighted works in Artificial Intelligence training. The proposal, based on Article 12 of Directive (EU) 2019/790 on Copyright and Related Rights in the Digital Single Market (DSM Directive), would allow collective management organisations to grant non-exclusive licences for works whose rightholders have not individually authorised thei...

Act requiring transparency on use of AI in legal services (Organic Law 5/2024 on the Right of Defense)

On 4 December 2024, the Act requiring transparency on the use of AI in legal services (Organic Law 5/2024 on the Right of Defense) enters into force. The Act establishes comprehensive regulations on the right of defence as a fundamental legal protection under Article 24 of the Spanish Constitution. It requires disclosure on the use of artificial intelligence (AI) in digital platforms related to legal services and mandates public access to information on how AI systems make recommendations or ...

AEPD Outline on Blockchain and the Right of Deletion

On 13 November 2024, the Spanish Data Protection Agency (AEPD) published a technical note demonstrating the feasibility of constructing Blockchain infrastructures that comply with the General Data Protection Regulation (GDPR). The note outlines the fundamentals of Blockchain infrastructures, clarifies data protection concepts within this technology, and analyses real application cases. It proposes policies, including organisational and technical measures, to implement the right of deletion in...

AEPD technical note on LIINE4DU 1.0 methodology for threat modelling for privacy and data protection

On 24 October 2024, the Spanish Data Protection Agency (AEPD) adopted a technical note on LIINE4DU 1.0 methodology for threat modelling for privacy and data protection. The note seeks to aid organisations within the European Union in managing privacy risks while ensuring compliance with the General Data Protection Regulation. The note focuses on legitimate data processing and provides tools to assess and mitigate risks to data subjects' rights and freedoms. The methodology covers threat categ...

AEPD Report on addictive patterns in the processing of personal data

On 10 July 2024, the Spanish Data Protection Agency (AEPD) issued a Report on addictive patterns in the processing of personal data. The Report analyses platforms' uses of deceptive and addictive design patterns such as social engineering, and interface interference to increase user engagement and data collection. The Report establishes a three-tiered categorisation of deceptive patterns, providing examples of their respective uses. Finally, the Report emphasises the implications for data pro...

AEPD investigation into Meta's electoral functionalities Election Day Information and Voter Information Unit

On 31 May 2024, the Spanish Data Protection Agency (AEPD) issued a precautionary measure against Meta Platforms, mandating the immediate suspension of the Election Day Information (EDI) and Voter Information Unit (VIU) functionalities in Spain ahead of the European Parliament elections. This decision was made to prevent the planned collection and processing of personal data, which the AEPD identified as potentially violating the General Data Protection Regulation (GDPR) principles of legality...

AEDP investigation into Motorsport Network Espana concerning cookie practices

On 14 May 2024, the Spanish Data Protection Agency (AEPD) issued its ruling in the investigation into Motorsport Network. The AEPD noted that Motorsport Network's website required users to either accept cookies for free access or subscribe for a fee to use the website without cookies. During the investigation, the AEPD determined that upon initial website access, Motorsport Network deployed non-technical cookies without user consent, a practice that requires explicit approval under the ePriv...

AEPD Guidelines for Processing Incorporating Wi-Fi Tracking Technologies

On 7 May 2024, the Spanish Data Protection Agency (AEPD) published the Guidelines for Processing Incorporating Wi-Fi Tracking Technologies. The Guidelines provide an analysis of the technology's implications, highlight key risks, and offer a set of recommendations for responsible usage in compliance with data protection regulations. Wi-Fi tracking technology enables the identification and tracking of mobile devices through Wi-Fi signals, facilitating the detection of device presence in specif...

Content moderation regulation in Bill on online child protection

On 4 June 2024, the Council of Ministers announced the draft Bill on online child protection. The Bill would be focusing on content moderation regulation across various digital platforms in order to protect minors. The Bill would mandate platforms to implement measures ensuring the protection of minors in the digital environment, including the activation of parental controls by default. Further, the Bill would amend the Penal Code in order to criminalise deepfake pornography, online grooming ...

Royal Decree establishing Artificial Intelligence (AI) Sandbox Proposal to test requirements under the EU AI Act

On 7 November 2023, the Council of Ministers approved a Royal Decree, allowing the Ministry of Economic Affairs and Digital Transformation to launch a call for companies to join the controlled testing environment, or sandbox, under the European Regulation of Artificial Intelligence. In collaboration with the European Commission, the Government of Spain is initiating the first sandbox to assess requirements for high-risk AI systems in the proposed European AI regulation. The testing environmen...

AEDP Investigation against Ramona Films for alleged breach of Age Verification Requirement

On 29 October 2023, the Spanish Data Protection Agency issued a ruling against RAMONA FILMS S.L. for failing to implement adequate age verification measures on its websites. The company was found to have allowed users to access content by simply clicking a button to confirm they were over 18 without any further checks. The authority imposed a series of fines totalling 232'000 euros and ordered the company to implement appropriate security measures within one month.

Initiative on Promoting Digital Transformation and Cybersecurity of the Media

On 14 October 2023, the Spanish government closed its public consultation on promoting the digital transformation and cybersecurity of the media. The purpose of this consultation was to understand the digital and cybersecurity needs of the written and digital press. It aimed to find out the appropriate digital solutions and technologies for the sector, determine the proper investment plans for such technologies, and measure the sector’s cybersecurity and cyber resilience. This initiative is a...

Boe A 2023 22767

Royal decree for the establishment of the Spanish Agency for the Supervision of Artificial Intelligence (AESIA)

On 22 August 2023, the Spanish Council of Ministers adopted a royal decree for the establishment of the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) in anticipation of the adoption and implementation of the European Artificial Intelligence(AI) Act. The AI Act would mandate Member States to designate a national supervisory authority to ensure compliance with the Act. The AESIA, the established agency attached to the Ministry of Economic Affairs and Digital Transformati...

Data Protection Authority "ValidaCripto RGPD" tool to assess encryption systems

On 5 October 2023, the Spanish Data Protection Agency (AEPD) launched the “ValidaCripto RGPD” tool, designed to assist in assessing the compliance of encryption systems with data regulations. The tool is a locally-operated web application, freely accessible and designed to ensure that no data is collected or transmitted to the AEPD. Its primary purpose is to provide an efficient means of assessing the suitability of cryptographic systems used in personal data processing by enabling users to s...

AEDP investigation into BURWEBS S.L. for GDPR Violations

On 22 March 2023, the Spanish Data Protection Authority ruled on the investigation into BURWEBS S.L.'s data protection practices. The investigation revealed several violations, including the inability to switch off cookies, indefinite storage and processing of user data, and the collection of IP or Wi-Fi data without specifying a purpose. The company also made it difficult for users to delete their personal data by requiring them to present their identity card. The authority was particularly ...

United States and Spain Capacity Building Tool to Combat Ransomware

On 10 November 2022, the US Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the US Department of State and the Spanish Ministry of the Interior, announced a joint project to develop a capacity-building tool with the aim of preventing ransomware attacks. The project was developed as part of the Second International Counter Ransomware Initiative (CRI) Summit, held from 31 October 2022 to 1 November 2022 in Washington DC. The tool will feature case studies on public-...

AEPD Investigation into Techpump Solutions for GDPR and LSSI Violations

On 31 October 2022, the Spanish data protection authority ('AEPD') imposed a fine of EUR 525'000 on Techpump Solutions S.L., for multiple violations of the General Data Protection Regulation (GDPR) and Law No. 34/2002, on Information Society Services and Electronic Commerce ('LSSI'). The AEPD found that Techpump Solutions, owner of various internet domains containing adult content, had failed to comply with data protection regulations, including the unlawful processing of personal data, insuf...

AEPD Guidelines on assessment of biometric data from data protection perspective

On 26 July 2022, the Spanish Data Protection Agency (AEPD) issued a set of Guidelines on the use of biometric data and outlined the implications of the use of biometric techniques and the potential risks to the rights and freedoms of individuals under the General Data Protection Regulation (GDPR). Specifically, the Guidelines provide a non-exhaustive list of useful criteria that may be used in risk assessments, including the purposes of biometric data operations, the scope or extent of proces...

Algorithm disclosure requirement towards delivery workers for digital platforms

The Royal Decree-Law 9/2021 amending the Worker`s Statute Act goes into force. The Decree awards delivery workers working for digital platforms the right of information about the algorithms which influence their working conditions including prioritisation, performance assessment and other forms of profile building. The representatives of delivery workers may request this information including mathematical formulae and parameters used on behalf of their constituents.

Procedure for Intervention against Disinformation

The Procedure for Intervention against Disinformation is adopted by the National Security Council. The Procedure defines requirements for the detection of disinformation campaigns, the analysis of the impact of disinformation on national security and the authority for enforcement.

BOE-A-2023-18911 Real Decreto 729/2023, de 22 de agosto, por el que se aprueba el Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial.