Digital Consumer Protection

Distance Contracts: General Framework

Online contracts between a professional and a consumer are governed by Royal Legislative Decree 1/2007 (TRLGDCU), transposing Directive 2011/83/EU.

Mandatory Pre-contractual Information

Before the consumer is bound, the professional must clearly provide: trader identity, main product/service characteristics, total price (including taxes and shipping), payment and delivery conditions, withdrawal right existence and deadline, and contract duration and termination conditions.

In Spain: The purchase button must contain "order with payment obligation" or equivalent wording.

Right of Withdrawal: 14 Days

The consumer may withdraw without reason within 14 calendar days from: receipt of goods (for products) or contract conclusion (for services and digital content).

Exceptions (Art. 103 TRLGDCU)

Withdrawal does not apply to: digital content where execution began with express consent and withdrawal waiver, fully performed services, custom-made goods, periodical press, and sealed goods unsuitable for return for health/hygiene reasons.

The professional must refund all payments within 14 days of the withdrawal communication.

Digital Content and Services: Directive 2019/770

Directive (EU) 2019/770 (transposed by Law 4/2022 in Spain) covers digital content (music, movies, apps, games, ebooks) and digital services (SaaS, streaming, social networks, cloud storage). It also applies when the consumer "pays" with personal data.

Conformity Guarantee

Digital content must: match the contract description, be fit for ordinary purposes, have standard quality, and receive updates (including security) for a reasonable period.

Guarantee period: 2 years from supply (one-time) or throughout the contract (continuous supply like SaaS or streaming).

Consumer remedies for non-conformity: (1) restoration to conformity at no cost, (2) proportional price reduction, (3) contract termination.

Dark Patterns in Digital Commerce

Common manipulative design techniques: confirmshaming, roach motel (easy subscription, hard cancellation), hidden costs, forced continuity, and trick questions. The Omnibus Directive (2019/2161) and DSA reinforce the prohibition of these practices.

Programmatic Advertising

Online advertising based on personal data (profiling) is subject to GDPR (explicit consent), ePrivacy Directive (cookie consent), and DSA (transparency). Absolute prohibitions: profiling-based ads targeting minors (DSA Art. 28) and ads based on special data categories (ethnicity, sexual orientation, health data).