Spain strengthens control over large tech companies in an 'intensified' implementation phase of digital regulations

Spain is entering a phase of increased regulatory pressure on large tech companies, although the national implementation of the Digital Services Act (DSA) remains stalled in Parliament. At the same time, the European regulatory ecosystem —GDPR, DMA, DSA, AI Act, and NIS2— is moving towards a more demanding oversight model, with potentially much higher sanctions than those traditionally applied in the Spanish market.

GDPR in Spain: full steam ahead

Regarding data protection, the enforcement of the GDPR continues to be particularly intense. The AEPD has recently imposed significant sanctions, and Spanish courts have also begun issuing rulings with a major economic impact in the realm of unfair competition and the use of personal data.

Investigation and evidence: the main bottleneck

One of the main challenges in the effective oversight of platforms is the information asymmetry: much of the critical evidence is in the hands of the tech operators themselves.

At this point, the contribution of Daniel López, partner at ECIJA (privacy and digital regulation), is particularly relevant, as he highlights the structural problem affecting any investigation:

The platforms control much of the evidence that regulators need, which creates a significant information imbalance.

Analyzing tracking technologies, classification algorithms, or adtech systems requires multidisciplinary teams (legal, technical, forensic, data), and the complexity is exacerbated by the cross-border dimension, procedural sequencing issues, and the scope of procedural challenges.

According to his interpretation, Spain is moving towards more 'integrated' investigations: privacy, content governance, advertising transparency, and competition tend to be addressed together, rather than as separate silos.

Therefore, he recommends that companies prepare by strengthening internal auditability, the ability to explain algorithmic decisions and data processing, and updating risk assessments of the DSA tailored to the Spanish context.

Delays of the DSA at the national level and the horizon of 2026

At the European level, the Commission is advancing with a firm approach (with sanctions already foreseen under the DMA and the DSA). However, at the national level, the implementation of the DSA depends on the approval of the corresponding governance framework and providing the competent authority with sufficient powers and resources. In Spain, complete implementation could arrive by 2026, although this is not guaranteed.

What companies should expect

The change is clear: more oversight and more 'evidence' requirements. The trend suggests that compliance will no longer be merely documental, but increasingly demonstrable, traceable, and auditable, especially regarding data, digital advertising, and recommendation systems.

Access the full article published on Law.com here.