In short. Article 21 of Law 34/2002 requires prior requests or express authorisation for promotional email, subject to a customer exception with opt-out conditions.
Definition: A Spanish business may send promotional email when the recipient has previously requested it or expressly authorised it, or when the customer exception in Article 21(2) of Law 34/2002 applies. That exception requires a prior contractual relationship, lawfully obtained contact details, similar products or services from the same business, and a simple, free opt-out.
Key facts
- As of 17 October 2026, Spain's consolidated Law 34/2002 prohibits promotional email without a prior request or express authorisation under Article 21(1), subject to the customer exception in Article 21(2). That exception requires an opportunity to object when contact details are collected and in every commercial message.
- The EU ePrivacy Directive, Article 13(2), also provides an exception for a seller's own similar products or services, with an easy, free opportunity to object.
- For personal data, the General Data Protection Regulation, Article 7(1), requires the business to demonstrate consent when processing relies on it.
What communications and consent does the rule cover?
The annex to Law 34/2002, paragraph (f), defines a commercial communication as one promoting, directly or indirectly, a business's image, goods or services. Article 21(1) covers email and equivalent electronic communications. The annex's definition of a recipient includes natural and legal persons using a service for professional or other purposes.
Where consent concerns personal data, GDPR Article 4(11) defines it as freely given, specific, informed and unambiguous, expressed through a statement or clear affirmative action. Recital 32 explains that silence, inactivity and pre-ticked boxes do not constitute consent. Article 7(2) requires a consent request within a written declaration covering other matters to be clearly distinguishable and expressed in clear, plain language.
When does the customer exception apply?
Article 21(2) of the Spanish law makes the exception conditional on a prior contractual relationship. The business must have obtained the recipient's contact details lawfully. It must use them for commercial communications about products or services from its own business that are similar to those initially contracted for.
The same provision requires a simple, free procedure for objecting to promotional processing, both during collection and in each message. The ePrivacy Directive's Article 13(2) describes collection in the context of a sale and permits subsequent messages under this exception where the customer has not initially refused that use.
What must the email and withdrawal process include?
Under Law 34/2002, Articles 21(2) and 22(1), email must include an email address or another valid electronic address where the recipient can exercise the relevant objection or withdrawal right. Article 22(1) allows consent to be revoked at any time by notifying the sender and requires simple, free procedures with electronically accessible information about them.
Article 20(1) also requires the commercial nature of the message and the person or business on whose behalf it is sent to be clearly identifiable. Article 20(4) prohibits concealing that sender's identity.
Related terms
- When does the ePrivacy Directive require consent for marketing email?
- When can a shop email existing customers under the ePrivacy Directive?
- GDPR right to object
FAQ
Can you use the customer exception for another company's products?
Article 21(2) of Law 34/2002 confines this exception to similar products or services from your own business.
Does the Spanish rule cover business recipients?
The same law's annex, paragraph (d), includes legal persons and professional use in its definition of a recipient. Article 21 addresses recipients without creating a general exemption for business email.
Can you withdraw consent after subscribing?
Article 22(1) allows withdrawal at any time by notifying the sender. For consent-based personal data processing, GDPR Article 7(3) also requires withdrawal to be as easy as giving consent.
Sources
- BOE, "Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico", consolidated text updated 23 January 2025
- EUR-Lex, "Directive 2002/58/EC", consolidated text of 19 December 2009
- EUR-Lex, "Regulation (EU) 2016/679", 27 April 2016
Check how a page reads to answer engines. Open the GEO score analyzer