Online safety & content laws in Spain (2026)

Spain's Congress approved advancing the Organic Law for the protection of minors in digital environments, rejecting a blocking amendment from Vox. The bill raises the minimum social-media registration age from 14 to 16, requires privacy-preserving age verification via Spain's Cartera Digital Beta credential, and criminalises AI-generated child sexual abuse material.

The Spanish Cabinet gave its second approval to the landmark child-online-protection bill, banning under-16s from social media without explicit parental consent, mandating platform content-classification labels, and requiring terminal manufacturers to provide free parental controls — marking the most comprehensive child online safety legislation in Spain's history.

The Council of Ministers approved a draft law formally incorporating EU Regulation 2022/2065 (DSA) and Regulation 2024/1083 (European Media Freedom Act) into Spanish law, reinforcing CNMC supervisory powers with fines up to 6 % of global turnover and creating a national audiovisual media registry.

Following its phased rollout, the DSA became fully applicable to all in-scope intermediary services in the EU, extending content-moderation transparency, illegal-content reporting, and algorithmic accountability obligations beyond VLOPs to medium and small platforms serving Spanish and EU users.

Spain's Ministry for Digital Transformation officially appointed the National Markets and Competition Commission (CNMC) as the national Digital Services Coordinator, making it the single contact point for DSA compliance supervision, cross-border cooperation with other EU DSCs, and user-complaint escalation.

Four months after the Commission's April 2023 designation of 17 VLOPs and 2 VLOSEs — including Google, Meta, TikTok and Twitter/X — the DSA's strictest obligations entered force: systemic risk assessments, independent annual audits, algorithmic transparency and researcher data-access provisions directly protecting Spanish users.

Spain's Ley 13/2022 overhauled audiovisual regulation to cover streaming VOD services, video-sharing platforms and commercial influencers, imposing registration with a national audiovisual registry, child-protection labelling, advertising disclosure rules, and mandatory reporting channels for illegal content — transposing the EU AVMSD into Spanish law.

Spain updated its mandatory cybersecurity baseline — the Esquema Nacional de Seguridad — replacing the 2010 decree; it establishes 73 security controls across organisational, operational and protection layers, and is mandatory for all public-sector digital services and private providers serving the state, directly securing the infrastructure of online public services.

Spain's LOPDGDD adapted EU GDPR into national law and uniquely added a catalogue of 'digital rights', including the right to be forgotten on social media and search engines, the right to digital disconnection at work, and reinforced protections for minors' data online — setting the privacy foundation of today's internet safety framework.

The Ley de Servicios de la Sociedad de la Información y de Comercio Electrónico transposed the EU E-Commerce Directive 2000/31/EC, establishing liability safe harbours for intermediaries, mandatory provider identification and information requirements, and a framework for courts and administrative bodies to order blocking of illegal online content — the cornerstone of Spanish internet regulation for two decades.