A website is no longer merely a digital shop window. It is a tool for attracting customers, communicating and, in many cases, collecting and processing personal data. However, while companies devote resources to design, search engine positioning or advertising, they often neglect an essential aspect: ensuring that their website complies with the law.
This set of obligations, known as web compliance or digital regulatory compliance, encompasses the legal, technical and organisational measures required to ensure that a website complies with the applicable regulations and to reduce the legal risks arising from its use.
Which regulations may apply to a website?
The regulatory framework that may apply to a website is extensive. The main pieces of legislation include the General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), the Spanish Law on Information Society Services and Electronic Commerce (LSSI-CE) and, with increasing relevance, the European Artificial Intelligence Regulation.
For online shops, consumer protection, electronic contracting and digital commerce regulations also apply.
Furthermore, depending on the content and functionalities of the website, rules concerning intellectual property, trademarks, image rights or digital advertising may also apply.
Key aspects of web compliance
In general, the compliance requirements of a website must include:
- Technical and organisational security measures that guarantee the confidentiality, integrity and availability of personal data.
- Technical means that enable the collection and recording of users’ express consent to the processing of their data.
- Legal notice: identifies the website owner, including their name or company name, tax identification number and other relevant details, as required by the LSSI-CE.
- Privacy policy: explains how the data collected will be processed and sets out users’ rights, in compliance with the GDPR and the LOPDGDD.
- Cookie policy and banner: provides information about the use of cookies and requests the user’s prior consent before installing them.
- Terms and conditions of use or sale: when a website sells products or services, users must be informed about matters such as prices, payment methods, returns, guarantees and the right of withdrawal.
- Artificial intelligence policy: provides information about the use of artificial intelligence systems where applicable.
- AI image portal: the AI Act requires deepfakes to be visibly identified on websites and e-commerce platforms.
Publishing legal texts is not enough: the risk of “copying and pasting”
Copying legal texts from another website may create a false sense of compliance, but it does not guarantee that the website complies with the applicable regulations. Incorrect cookie settings, an outdated privacy policy or improperly configured forms can create risks for any business.
Legal texts must be tailored to the circumstances of each business and be consistent with the website. A generic document may create a false sense of security, but it will not prevent a potential infringement and may consequently cause harm to your website, such as a lack of transparency.
The difficulty of remaining up to date
Moreover, website compliance is not static. Every new feature added to the site, such as forms, analytics tools, chat systems or artificial intelligence applications, may require a legal review.
For all these reasons, web compliance should form part of a company’s overall risk assessment. Periodic reviews of the website make it possible to identify changes and adapt both the legal texts and the procedures and tools being used.
In this regard, at PONTI & PARTNERS, we offer specific services of legal compliance, data protection and regulatory compliance services, as website compliance should not be regarded as a secondary formality, but rather as an essential part of any digital project. It not only protects businesses against potentially substantial financial penalties, but also strengthens user trust and provides the business with legal certainty.
Article by Imma Martí.
