Email marketing in Spain: the opt-in rules.
Spain is an opt-in jurisdiction, and among the stricter ones. A list built lawfully under an opt-out regime does not become usable by crossing a border — and the burden of proving consent sits with the sender.
Email is where imported marketing practice collides with Spanish law most directly, because the gap is not a matter of design preference but of legal basis. In much of the world a commercial email to a business contact is lawful until the recipient objects. In Spain, the general position is the reverse: the message needs a lawful basis before it is sent, and for most marketing that basis is consent obtained in advance.
Two regimes operate together. The LSSI-CE governs commercial communications sent by electronic means, requiring prior authorisation and imposing identification and opt-out obligations on every message. The GDPR defines what valid consent looks like and requires that it be demonstrable. Both are enforced by the AEPD.
What valid consent has to look like.
- Affirmative action — an unticked box the user ticks, not a pre-ticked one they fail to notice
- Specific to marketing — separate from accepting terms, creating an account or completing a purchase
- Informed — who is sending, what they will send, and the categories of content covered
- Granular where relevant — newsletters, offers and third-party communications treated separately
- Freely given — not a condition of accessing a service that does not require it
- Recorded — timestamp, source, wording shown, and IP or equivalent evidence retained
- Withdrawable — a working unsubscribe in every message, honoured promptly and free of charge
- Sender identified — the message must make clear who is behind it and its commercial nature
If you cannot show how consent was obtained, you do not have it.
When a complaint arrives, the question is not whether the recipient once visited your site but whether you can produce the evidence of their agreement. Imported lists, scraped addresses and contacts acquired with an acquisition are the three sources that most often fail this test.
Where imported practice diverges.
| Practice | Common elsewhere | Position in Spain |
|---|---|---|
| Cold B2B email to named individuals | Widely practised | Requires a lawful basis; consent is the safe route |
| Purchased or rented lists | A market exists | Consent obtained by a third party rarely transfers validly |
| Pre-ticked subscription box | Historically normal | Not valid consent |
| Marketing consent bundled into terms | Frequent | Not specific or freely given |
| Opt-out only, no prior consent | The default in several markets | Insufficient as a general rule |
| Email to existing customers about similar goods | Permitted in many regimes | A narrow soft opt-in exists — conditions are strict and should be checked |
| Unsubscribe via reply only | Common | A simple, free and effective mechanism must be provided |
The soft opt-in row deserves care. Spanish law recognises a limited route for communications to people who are already customers, about products or services similar to those they bought, where the opportunity to object was given at collection and is repeated in every message. It is narrower than the equivalent in some other countries, and it is not a general licence to email a customer database about anything.
Building a list that survives scrutiny.
Does this apply to a company outside Spain?
"We send from abroad, so our own rules apply."
GDPR reaches processing connected to offering goods or services to people in the EU. Sending marketing to Spanish recipients brings the activity within scope regardless of where the servers or the sender sit.
Segment by recipient location, or comply at the strictest level.
Either apply Spanish and EU standards to your whole programme, or maintain a properly segmented EU list with its own consent capture and evidence trail. Mixed lists with a single opt-out policy are where problems begin.
Consent capture, records and notices — before the first send.
Privacy and cookie documentation, LSSI identification, and a consent flow that produces evidence you can actually produce later. Far cheaper before launch than after a complaint.
- LSSI-CE
- Ley 34/2002 — governs commercial communications by electronic means, including prior authorisation and identification duties.
- AEPD
- Agencia Espanola de Proteccion de Datos — the supervisory authority that investigates complaints and issues sanctions.
- Consentimiento
- Consent, which must be free, specific, informed, unambiguous and demonstrable.
- Baja / darse de baja
- Unsubscribe — the wording Spanish recipients look for in a marketing email.
- Comunicacion comercial
- Commercial communication — the regulated category your marketing email falls into.
- Responsable del tratamiento
- Data controller — the entity that must be identified and that carries the accountability.
Can we email business addresses without consent?
Is double opt-in legally required?
What about a list we acquired with a business?
How long does consent last?
Next in the cluster.
The list is only as good as the evidence behind it.
Book a free call ↗Alexander Baranov
Seventeen years designing and delivering cross-border corporate structures — incorporation, tax, banking and market entry — for founders expanding into Spain and the EU. Author of professional books on entering and selling in the Spanish market.
More about Voixa and the team ↗