ReportAEVI
Guide to Consumer Rights, Advertising and Data Protection: Spain
1 Jan 202513 pages~15 min full read
Digital purchases in Spain generally require a 14-day right of withdrawal, though this is waived for age-rated titles once gameplay begins and for opened physical copies or virtual currencies.
See it on page 5Data processing for users under 14 requires verified parental consent, which must be obtained through age-verification mechanisms or electronic signatures.
See it on page 11Influencer marketing must include clear, visible disclosures such as #Sponsored or #Ad to avoid violating regulations against covert sponsorship.
See it on page 8Advertising content is strictly prohibited from exploiting minors, promoting violence or discrimination, or featuring political messaging outside of designated election periods.
See it on page 7Digital assets and NFTs must be sold with transparent licensing terms and explicit notifications informing users exactly when their right of withdrawal is forfeited.
See it on page 6Developers are legally obligated to provide ongoing game maintenance and updates, and must avoid incorporating unilateral contract changes that qualify as unfair terms.
See it on page 6Data protection compliance requires clear, layered privacy notices and the formal documentation of processing activities to distinguish between controller and processor roles.
See it on page 11The guide is intended to equip Spanish video‑game publishers, developers and marketers with a practical understanding of the legal framework governing consumer rights, advertising and data protection. It draws on the General Law for the Defence of Consumers and Users, the General Advertising Law, the Unfair Competition Law, the General Data Protection Regulation and the Spanish Organic Law on Data Protection, applying them to digital products released in Spain throughout 2025.
Key consumer‑protection provisions require clear pre‑purchase information, a 14‑day withdrawal right for most digital purchases, and safeguards against unfair terms such as unilateral contract changes. Exceptions apply to virtual currencies, physical copies that have been opened and age‑rated titles once gameplay begins. Developers must maintain and communicate updates, while digital assets—including NFTs—must be presented with transparent licensing terms and explicit notices when the right of withdrawal is lost. Advertising must avoid misleading claims, covert sponsorship, political content outside election periods, and any material that exploits minors, encourages violence, discrimination or unhealthy behaviours; influencer promotions must be marked with visible disclosures such as #Sponsored or #Ad.
Data‑protection obligations centre on distinguishing controller and processor roles, informing users through layered privacy notices, and securing personal data—including special categories—via documented processing activities and contractual safeguards. For users under 14, parental consent must be verified through age checks or electronic signatures. The guide concludes with a checklist summarising rights to information, withdrawal, fair advertising, loot‑box age verification, ongoing game maintenance and GDPR‑compliant data handling.
