The legal notice is, together with the privacy policy and the cookie policy, one of the three documents usually linked from the footer of any business website. But, unlike the other two, it has nothing to do with the processing of personal data: its function is more basic and, at the same time, very specific. The legal notice answers the question of who is behind this website and fulfils a transparency obligation set out in art. 10 of Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
This guide explains, with a focus on companies, what exactly the legal notice is, what its legal basis is, who is required to publish it, what information it must contain and how it differs from the other legal documents of a website. The aim is operational and without an alarmist tone: so that a manager can review the legal notice of their own website and detect what is missing.
What the legal notice of a website is
The legal notice is the text through which the owner of a website identifies itself to users. It is not a contract or an acceptance document: it is identifying information of permanent access that the law requires to be made available to the public.
The logic is simple. When a person interacts with a website —reads its content, submits a form, buys a product or simply consults a business's information— they have the right to know who they are dealing with and to be able to contact that entity directly. The legal notice is the instrument that provides that minimum transparency: it gives the name, tax identification, address and a contact channel of the site's owner.
It is worth distinguishing it from the outset from the other two documents with which it is often confused. The legal notice identifies the owner (art. 10 LSSI-CE); the privacy policy informs about the processing of personal data (arts. 13 and 14 GDPR); and the cookie policy documents the storage devices on the user's equipment (art. 22.2 LSSI-CE). They are three complementary pieces, not interchangeable ones.
Legal basis: art. 10 of the LSSI-CE
The obligation to publish the legal notice arises from article 10 of the LSSI-CE (Law 34/2002), which is headed with the general information that the provider of information society services is required to supply. That provision requires that provider to arrange the means for both the recipients of the service and the competent bodies to access, by electronic means, in a permanent, easy, direct and free manner, a set of identifying details.
The expression "provider of information society services" is the key concept. The LSSI-CE applies to those who carry out an economic activity through the internet or other electronic means, and it includes both those who sell online and those who maintain a corporate website that supports, even indirectly, an activity with an economic purpose. The legal notice is the way to fulfil that requirement of permanent and accessible identification.
The LSSI-CE does not operate alone: it coexists with the GDPR (Regulation (EU) 2016/679) and the LOPDGDD (Organic Law 3/2018) as regards the processing of data, and with consumer regulations when there are sales. For an overall view of this law, see the complete guide to the LSSI-CE.
Who is required to have a legal notice
The obligation falls on providers of information society services. To determine whether a specific website fits into that category, the practical criterion is whether the site involves an economic activity for its owner. Under that criterion, the following are required:
- Companies and corporations with a corporate website, whether or not they sell online. A business's digital showcase is part of its economic activity.
- Self-employed professionals and practitioners who use their website to promote services, acquire customers or show their portfolio.
- Online shops and any website that sells products or services over the internet.
- Websites with advertising income, affiliate income, sponsorships or any other economic source linked to the site, even if they do not sell directly.
- Platforms, professional blogs and projects that, even without charging the visitor, obtain a direct or indirect economic benefit from their online activity.
The strictly personal page with no economic purpose falls outside the scope of the LSSI-CE: a hobby blog with no advertising or monetisation, for example. That said, the threshold is low. As soon as a website serves as a commercial channel, a means of acquisition or a way to reinforce a business's brand —even if it does not process a single online payment— the provider status is presumed and the art. 10 obligation applies. When in doubt, for a website linked to any professional activity, the practical answer is that the legal notice is necessary.
What the legal notice must include under art. 10 LSSI-CE
The content of the legal notice adjusts to the information listed in art. 10 of the LSSI-CE. Not all sections apply to all websites: some depend on the legal form or the activity. The basic identifying block, on the other hand, is common to any provider.
Basic identifying details (always)
- Full company name (or first name and surnames if the owner is a natural person).
- NIF or CIF of the owner.
- Address. If there is no conventional physical establishment, at least an address that allows direct communication.
- Email address and any other detail that allows direct and effective communication to be established (for example, a telephone number or an operational contact form).
Registration details (if the entity is registered)
- Registration details in the Commercial Register or another public register in which the entity is, where applicable, registered. Commercial companies must state these details.
Administrative authorisation (if the activity requires it)
- When the activity is subject to a prior administrative authorisation regime, the details of that authorisation and the identifying details of the competent body responsible for supervision must be indicated.
Regulated professions (professional membership)
If the owner practises a regulated profession (for example, with compulsory professional membership), art. 10 requires the following to be added:
- The professional association to which they belong and the membership number.
- The official or professional academic qualification held.
- The EU State in which that qualification was issued and, where applicable, the corresponding homologation or recognition.
- The professional rules applicable to the practice of the profession and how to access them.
Prices (if the website displays them)
- When the website refers to prices, clear and accurate information must be provided about the price of the product or service, indicating whether or not it includes the applicable taxes and, where applicable, the corresponding charges.
Legal notice, privacy policy and cookie policy: three different documents
One of the most common errors on business websites is treating these three texts as if they were a single one or as if they were interchangeable. Each responds to its own rule and its own purpose. The following table summarises the difference:
| Document | Reference rule | What it regulates |
|---|---|---|
| Legal notice | Art. 10 LSSI-CE (Law 34/2002) | Identifies the owner of the website: name, NIF/CIF, address, contact and registration details. |
| Privacy policy | Arts. 13 and 14 GDPR | Informs about how personal data is processed: purposes, legal basis, periods, recipients and rights. |
| Cookie policy | Art. 22.2 LSSI-CE | Documents the storage devices (cookies, pixels) installed on the user's equipment. |
The practical consequence is clear: an impeccable legal notice does not cover the information obligations regarding personal data, and a complete privacy policy does not exempt you from identifying the owner. A standard business website needs all three documents, each with its own content, permanently linked from the site's footer. The detail of the full set of legal pieces of a website is addressed in the checklist of legal requirements for a website.
Common mistakes in the legal notice
When reviewing the legal notices of business websites, the failures recur frequently. The most common are:
- The NIF/CIF or the address is missing. The trade name is given but not the company name or the tax identification, which are details required by art. 10.
- The registration details are not stated. Registered commercial companies that omit the registration details in the Commercial Register.
- Ineffective contact. A legal notice with no email or any means allowing direct communication fails the requirement of direct and effective contact.
- Outdated details. Address, name or email that are no longer valid after a change of registered office or legal form.
- A hard-to-access document. Art. 10 requires permanent, easy, direct and free access. A legal notice that is hidden, inside a downloadable PDF or accessible only after several clicks, does not meet that criterion; the standard is a permanent link in the website's footer.
- Confusing documents. Mixing the legal notice with the privacy policy and the cookie policy into a single text, leaving incomplete the specific content that each rule requires.
- Copying generic templates without adapting them. Reusing a legal notice from another website without replacing the identifying details or adjusting the sections that depend on the activity (regulated profession, administrative authorisation, prices).
- Omitting professional membership in regulated professions. Websites of regulated activities that do not include the professional association, membership number or applicable professional rules.
"The legal notice is not the minor formality of the website, it is the signature of whoever operates it. A company that does not clearly state who is behind its site is already sending a signal before the user reads anything else."
Mario P. Talamillo · Managing Partner, Certix®
Legal notice checklist for a company
Quick checkpoints to review the legal notice of a corporate website. Not all apply to all cases: the identifying block is common; the rest depend on the legal form and the activity.
- Full company name of the owner.
- NIF or CIF.
- Address or an address that allows direct communication.
- Email and, where applicable, another means of direct and effective contact.
- Registration details in the Commercial Register or another public register, if the entity is registered.
- Details of the administrative authorisation and the supervisory authority, if the activity requires it.
- Professional association, membership number, qualification and applicable rules, in regulated professions.
- Clear information about prices and taxes, if the website displays them.
- Permanent link to the legal notice from the footer of every page.
- Updated details that match the real situation of the company.
- Separate and complete documents: legal notice, privacy policy and cookie policy.
Frequently asked questions
What is the legal notice of a website and what is it for?
It is the document that identifies the person or company that owns the site. It fulfils the general information obligation of art. 10 of the LSSI-CE (Law 34/2002): to provide, in a permanent, easy, direct and free manner, the provider's identifying details (name, NIF/CIF, address and a means of direct contact). It does not regulate personal data or cookies: it is the layer that identifies the owner.
Who is required to have a legal notice on their website?
Providers of information society services, a status that is presumed when the website involves an economic activity for its owner. In practice: companies, self-employed professionals and practitioners whose website serves as a showcase, an acquisition channel or a sales channel, even if it does not process online payments. Only the strictly personal page with no economic purpose falls outside.
Is the legal notice the same as the privacy policy?
No. The legal notice fulfils art. 10 of the LSSI-CE and identifies the owner of the website. The privacy policy fulfils arts. 13 and 14 of the GDPR and informs about the processing of personal data. The cookie policy fulfils art. 22.2 of the LSSI-CE. They are three different documents, each with its own legal basis and content; mixing them into a generic text leaves obligations uncovered.
What data must a company's legal notice include?
Under art. 10 LSSI-CE: company name, NIF/CIF, address and a means of direct and effective contact. If the company is registered, the registration details in the Commercial Register. If the activity requires administrative authorisation, those details and the supervisory authority. In regulated professions, the professional association, membership number, qualification and applicable rules. And, if the website displays prices, a clear indication about taxes.
References and resources to go deeper
- Complete guide to the LSSI-CE (Law 34/2002)
- Legal requirements for a website: GDPR, LSSI-CE and complete checklist
- Certix data protection consultancy
- Contact a Certix expert
This content is purely informational and educational; it does not constitute specialised legal advice in any case. The application of the regulations to each specific case requires individual analysis. Spanish regional or sectoral regulations may add specific requirements to those described.