The legal framework
Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) implements the GDPR: the digital age of consent is 14 (article 7); the rights of access, rectification, erasure, portability, restriction and objection are exercised against the controller with a reply within one month and a free complaint to the AEPD, which can impose fines of up to 20 million euros or 4 % of turnover (more than 100 million in 2024, with records against banks, telecoms and platforms); the law adds digital rights: disconnection at work, digital testament (article 96), the right to be forgotten in search engines and social networks (articles 93 and 94), and protection of minors. Article 197.7 of the Penal Code (since 2015) punishes with 3 months to 1 year the unauthorised sharing of intimate images or recordings obtained with consent in private, aggravated if the victim is a partner or former partner, a minor or vulnerable; article 197.1 punishes interception and access to data with 1 to 4 years, and the Penal Code as reformed in 2025 punishes sexual deepfakes. The AEPD opened in 2019 the Priority Channel (canalprioritario.aepd.es) for the urgent removal of sexual or violent content shared without consent, acting within hours with fines of up to 10,000 euros for the sharer. Dating apps established outside Spain answer to their lead authority (Ireland for Tinder and Bumble), with the AEPD as a concerned authority.
British residents in Spain are protected by the GDPR as applied by the AEPD, which is stricter and faster than the UK's ICO in enforcement; UK residents dealing with a Spanish company (a property portal, a clinic, a bank) are protected too, because the GDPR applies to any controller established in the EU. The UK GDPR, largely identical, governs UK-established companies; the two regimes recognise each other's adequacy for data transfers, so a British customer's data may move between the two countries freely.
The AEPD's Priority Channel has no British equivalent: an intimate image shared without consent can be taken down within hours on an administrative order, without a court. In the UK the route is a report to the police (sharing intimate images is an offence under the Online Safety Act 2023 and the Sexual Offences Act) and a request to the platform, with the Revenge Porn Helpline's assistance; a victim in either country can use both systems.
Key points
| Law | GDPR and Organic Law 3/2018 (LOPDGDD); AEPD as regulator (fines up to 20 million euros or 4 %) |
|---|---|
| Rights | Access, rectification, erasure, portability, restriction, objection; right to be forgotten in search engines and networks; digital testament |
| Minors | Digital consent at 14 (13 in the UK) |
| Intimate images | Unauthorised sharing: 3 months to 1 year, aggravated if partner or former partner (article 197.7); sexual deepfakes punished; AEPD Priority Channel for removal within hours |
| Complaint | Free to the AEPD after the controller's reply or silence within a month |
| UK residents | GDPR rights against Spanish controllers; UK-EU adequacy allows free data flows; ICO and AEPD cooperate |
| Figures | More than 100 million euros of AEPD fines in 2024; more than 20,000 complaints a year; the Priority Channel handles hundreds of cases, mostly young women |
In practice
- Exercise your rights with the app or company (form, email of the data protection officer) and, without a reply within a month, complain online to the AEPD with a copy of your request; the AEPD decides within months and can fine. A UK resident may complain to the ICO, which will forward to the AEPD, or directly to the AEPD in Spanish or English.
- Faced with an intimate photo or video shared without consent: capture the evidence (URL, date, profile), use the AEPD's Priority Channel (removal within hours), report to the Policía Nacional or Guardia Civil (article 197.7) and notify the platform; do not negotiate with the sharer.
- Requesting access to your data from a dating app reveals messages, locations and internal profiles; request complete erasure when closing the account (uninstalling is not enough).
- Children under 14 cannot consent on their own: dating apps require 18, and access by minors is reported to the AEPD and the platform.
- To de-index search results under your name, use Google's or Bing's form with an appeal to the AEPD; INCIBE's 017 line advises on account security.
Cost and coverage
Exercise of rights, Priority Channel and complaints to the AEPD free; civil actions with a lawyer (legal aid according to income).
Recent changes
The AEPD exceeded 100 million euros of fines in 2024; the Penal Code was reformed in 2025 to punish sexual deepfakes; the Organic Law on the protection of minors in digital environments (2025) strengthened age verification; the Priority Channel extended its scope to AI-generated content. The UK-EU adequacy decisions were renewed in 2025.
Where to go
- AEPD (aepd.es): complaints and Priority Channel (canalprioritario.aepd.es).
- Policía Nacional and Guardia Civil: reports for sharing intimate images.
- 017 — INCIBE: security of accounts and devices.
- In the UK: the ICO (ico.org.uk) and the Revenge Porn Helpline (revengepornhelpline.org.uk).
Worth knowing
The AEPD's Priority Channel is unique in Europe: a shared intimate image can be removed within hours without waiting for a judge. Use it before anything else, and report afterwards: the offence under article 197.7 exists even if the photo was sent voluntarily to a partner. And a British resident's rights are as strong as a Spaniard's — the GDPR does not ask for nationality.
Frequently asked questions
I live in the UK and a Spanish company is misusing my data — who do I complain to?
Either the ICO, which forwards cross-border complaints to the AEPD under the cooperation arrangements, or the AEPD directly through its online form, which accepts complaints from anyone about controllers established in Spain. Write to the company's data protection officer first, citing article 15 or 17 of the GDPR, and keep proof of the date: the AEPD asks whether you did.
Someone in Spain has shared intimate images of me — what can I do from the UK?
Use the AEPD's Priority Channel online (it accepts reports from anyone, in Spanish or English) for removal within hours; report to UK police (sharing intimate images without consent is an offence in England and Wales) and, through them or directly, to the Spanish police, since the offender is in Spain (article 197.7); ask the Revenge Porn Helpline for help with platforms. In case of blackmail, do not pay and report it as extortion.
Is the digital age of consent different in Spain?
Yes: 14 in Spain, 13 in the UK. Below 14 a Spanish service must obtain a parent's consent for a child's account; dating apps require 18 in both countries. Parents can demand the deletion of a Spanish account opened by a child under 14 without their consent, and report the platform to the AEPD.
Official sources and links
- Organic Law 3/2018 on Personal Data Protection and digital rights — BOE
- AEPD — Priority Channel — urgent removal of intimate content
- ICO — complaints about organisations abroad — UK regulator
- Administración General del Estado — administracion.gob.es — official portal of Spanish public services, with pages in English
- Boletín Oficial del Estado (BOE) — Spanish legislation, official and consolidated texts
- British Consulates in Spain — gov.uk — living in Spain guide, consular help, lists of English-speaking lawyers