Spain Recording Laws: One-Party Consent Rules and Penalties (2026)

How Spain's One-Party Consent Standard Works

Spain permits any participant in a conversation to record it secretly. You do not need to tell the other person you are pressing record. This applies whether you are on a phone call, sitting across a table, or speaking through a video platform.

The rule traces back to the Spanish Constitution and has been confirmed repeatedly by the Constitutional Court and the Supreme Court (Tribunal Supremo). The logic is straightforward: the right to secrecy of communications protects you from third parties listening in on your conversations. It does not protect you from the person you are actually speaking with choosing to keep a record of what was said.

Third-party recording is a different matter entirely. If you are not part of a conversation and you intercept it, you commit a criminal offense.

Constitutional Foundation: Article 18.3

Article 18.3 of the Spanish Constitution (Constitucion Espanola) guarantees the secrecy of communications. The text states that postal, telegraphic, and telephone communications are inviolable, except pursuant to a judicial order.

This right shields conversations from external intrusion. A police officer cannot tap your phone without a judge signing off. Your neighbor cannot bug your living room. But the constitutional protection runs between the parties to a communication and the outside world. It does not run between one participant and another.

The Constitutional Court drew this distinction clearly in its landmark 1984 ruling, and Spanish courts have maintained it ever since.

STC 114/1984: The Ruling That Settled One-Party Consent

On November 29, 1984, the Constitutional Court issued Sentencia 114/1984. The case involved a recording made by one participant in a conversation without the knowledge of the other.

The court held that recording your own conversation, even without informing the other party, is a lawful act. It does not violate the constitutional right to secrecy of communications (Article 18.3) and does not violate the right to privacy (Article 18.1).

The reasoning: Article 18.3 protects against interference by outsiders. A party to the conversation is not an outsider. They already have full access to the content being spoken. Choosing to preserve that content through a recording does not constitute an intrusion.

STC 114/1984 also confirmed that such recordings are admissible as evidence in judicial proceedings. The recording does not become unlawful evidence simply because the other party was unaware. The court found no constitutional obstacle to submitting a participant-made recording before a tribunal.

This ruling remains the foundation of Spain's one-party consent framework four decades later.

Codigo Penal Article 197: The Criminal Privacy Statute

The Codigo Penal (Criminal Code), specifically Article 197, defines the criminal offenses related to privacy invasion and unauthorized interception of communications. This is the statute that carries teeth.

Article 197.1: Core Prohibition

Article 197.1 punishes anyone who, without consent, seizes papers, letters, emails, or other documents, or intercepts telecommunications, or uses technical devices for recording, transmission, or reproduction of sound, image, or communication signals in order to discover the secrets or violate the privacy of another.

Penalty: 1 to 4 years in prison and a fine of 12 to 24 months.

The critical phrase is "without consent" and "of another." A participant recording their own conversation has consent by definition. They are not violating someone else's privacy through interception. They are preserving a conversation they are already part of.

Article 197.1 targets the outsider: the person who plants a recording device in a room they are not in, the individual who taps a phone line they are not on, or the hacker who intercepts digital communications between other people.

Article 197.2: Unauthorized Data Access

This section covers the unauthorized seizure, use, or modification of personal or family data stored in files, databases, or electronic systems.

Penalty: 1 to 4 years in prison and a fine of 12 to 24 months.

Article 197.3: Dissemination of Intercepted Material

If a person disseminates, reveals, or transfers to third parties data, facts, or images discovered through the acts described in sections 1 and 2, the penalty increases.

Penalty: 2 to 5 years in prison.

This distinction matters. Recording a conversation you are part of is legal. But what you do with that recording afterward is a separate question. Sharing it publicly in a way that harms the other person's privacy can cross into criminal territory.

Article 197.4: Aggravated Offenses

When the offenses in sections 1 and 2 are committed by persons responsible for files, computer systems, or records, or when carried out through unauthorized use of personal data, the penalties increase.

Penalty: 3 to 5 years in prison.

Article 197.6: Profit Motive

When any of the acts described in sections 1 through 4 are committed for financial gain, penalties are imposed in their upper half. If the offense involves especially sensitive data (health, sexual orientation, political beliefs, religious affiliation), the penalty jumps.

Penalty: Up to 4 to 7 years in prison for especially sensitive data.

Article 197.7: Intimate Images and Organic Law 10/2022

Article 197.7 addresses a specific and increasingly common problem: sharing intimate images or recordings that were originally obtained with consent.

The scenario is familiar. Someone shares intimate photos or videos with a partner. The relationship ends. The former partner distributes the material without consent. Before Article 197.7, prosecuting this conduct was difficult because the initial recording was consensual.

Original Provision

Article 197.7 punishes anyone who, without authorization, distributes, reveals, or transfers to third parties images or audiovisual recordings of a person that were obtained with their consent in a private setting, when the disclosure seriously harms their personal privacy.

Penalty: 3 months to 1 year in prison, or a fine of 6 to 12 months.

Organic Law 10/2022 Amendment

Organic Law 10/2022 (Ley Organica de Garantia Integral de la Libertad Sexual) expanded the scope. The amendment added a new paragraph punishing not just the person who originally obtained the images but also anyone who subsequently shares them without the victim's consent.

This closed a loophole. Before the amendment, forwarding intimate images received from someone else fell into a legal gray zone. After the reform, the chain of distribution is covered. If you receive intimate images and share them further without the subject's permission, you face the same criminal liability.

Aggravating Circumstances

Penalties are imposed in their upper half when:

• The victim is a minor or a person with a disability requiring special protection.
• The offender is or was the victim's spouse, partner, or ex-partner, regardless of cohabitation status.
• The distribution was carried out for profit.

Recording Phone Calls in Spain

Phone call recording in Spain follows the same one-party consent principle established by STC 114/1984. If you are a party to the call, you may record it without telling the other person.

This applies to landline calls, mobile calls, VoIP calls through platforms like WhatsApp or Zoom, and any other voice communication where you are a participant. No statute requires you to announce the recording or play a beep tone during personal calls.

The Tribunal Supremo reaffirmed this principle in its ruling STS 145/2023 of March 2, 2023, confirming that a recording made by one interlocutor does not violate secrecy of communications. The more recent STS 753/2024 further clarified the procedural rules for submitting such recordings as judicial evidence.

Third-party recording of phone calls remains criminal. Intercepting a call between two other people without judicial authorization falls squarely under Article 197.1.

In-Person Recording

Face-to-face conversations follow identical rules. If you are present and participating, you may record. If you are not part of the conversation, recording it is an interception.

A hidden voice recorder in your pocket during a meeting you attend is lawful. A hidden recorder placed in a room where a conversation takes place without you is not.

Spanish courts have drawn this line consistently. The Constitutional Court's framework treats the medium of communication as irrelevant. What matters is whether the person making the recording is a participant.

Recording in Public Places

Spain does not have a blanket prohibition on recording in public spaces. Filming or photographing in streets, parks, plazas, and other open public areas is generally permitted.

Privacy expectations shift based on context. A person shouting in a public square has limited privacy expectations. A quiet conversation on a park bench between two individuals has greater protection. Courts apply proportionality analysis, weighing the right to information and expression against the right to privacy on a case-by-case basis.

Commercial photography or filming in public spaces may require permits depending on local municipal regulations, separate from the privacy analysis.

Recording Police Officers

Recording police in Spain has a complicated legal history, shaped by the controversial Organic Law 4/2015 on Citizen Security, widely known as the "Ley Mordaza" (Gag Law).

Organic Law 4/2015, Article 36.23

Article 36.23 originally classified as a serious offense the "unauthorized" use of images or personal data of security force members when such use could endanger the personal or family safety of the officers, the safety of protected facilities, or the success of an operation.

Fine: 601 to 30,000 euros.

This provision drew intense criticism from press freedom and civil liberties organizations, who argued it chilled the documentation of police conduct.

STC 172/2020: Constitutional Court Clarification

On November 19, 2020, the Constitutional Court issued STC 172/2020, its first major ruling on the Citizen Security Law. The court struck down the word "unauthorized" from Article 36.23, holding that the previous wording was unconstitutional.

The practical effect: a private citizen can record police action without needing authorization. Recording itself is not the offense. The offense is disseminating footage in a manner that genuinely endangers officer safety, the safety of their families, protected facilities, or active operations.

This means you can film a traffic stop, record an arrest, or video a police checkpoint. You can keep the footage. You can use it as evidence in a complaint or judicial proceeding.

What you cannot do is publish footage in a way that creates a concrete safety risk to officers or compromises an ongoing operation. The restriction applies to the manner of dissemination, not to the act of recording.

Practical Considerations

Police officers in Spain cannot legally order you to delete your recordings. If an officer demands you erase footage, that demand has no legal basis after STC 172/2020. Officers who confiscate recording devices without judicial authorization may face disciplinary or criminal consequences.

That said, confrontations with officers over recording rights do occur in practice. Knowing the legal framework and remaining calm during such encounters is advisable.

Workplace Recording

Workplace recording in Spain involves an intersection of criminal law, labor law, and data protection regulation.

Employees Recording Conversations

An employee who participates in a workplace conversation may record it under the one-party consent rule. This includes meetings with supervisors, disciplinary hearings, salary negotiations, and conversations with HR representatives.

Spanish labor courts (Jurisdiccion Social) regularly admit participant-made recordings as evidence in wrongful dismissal and harassment cases. The Tribunal Supremo has held that such recordings are valid evidence when the employee is exercising their right to defend their legitimate interests.

The recording must not be altered or manipulated before submission. Courts will reject recordings that show signs of editing, and presenting doctored evidence can itself constitute an offense.

Employer Surveillance of Employees

Employer surveillance is governed primarily by Article 89 of Organic Law 3/2018 (LOPDGDD) and the broader GDPR framework.

Video surveillance in the workplace is permitted if:

• Employees are informed that cameras are present.
• The monitoring serves a legitimate purpose (security, compliance with labor obligations).
• Cameras are not placed in rest areas, changing rooms, bathrooms, or dining areas (Article 89.2 LOPDGDD).
• Recorded images are kept for a maximum of one month unless needed as evidence of a specific incident.

Audio surveillance faces much stricter limits. Article 89.3 of the LOPDGDD permits sound recording only when the activities carried out in the workplace generate relevant risks to the safety of facilities, goods, or people. This is a high bar. Routine audio monitoring of office conversations is not permitted.

Spanish labor courts apply a proportionality test. The employer must demonstrate that the surveillance measure was necessary, that less intrusive alternatives were inadequate, and that the monitoring was proportional to the risk being addressed.

GDPR and Data Protection (LOPDGDD)

Spain implements the EU General Data Protection Regulation through Organic Law 3/2018 (Ley Organica de Proteccion de Datos Personales y Garantia de los Derechos Digitales, LOPDGDD). The Agencia Espanola de Proteccion de Datos (AEPD) is the national supervisory authority.

Voice Recordings as Personal Data

The AEPD has confirmed that voice recordings constitute personal data because a voice can identify an individual. Any entity that records, stores, or processes voice recordings must comply with GDPR requirements.

Legal Basis Requirements

Under Article 6 of the GDPR, processing voice recordings requires one of the following legal bases:

• Consent: The data subject freely and specifically agrees to the recording.
• Contractual necessity: The recording is needed to perform a contract with the data subject.
• Legal obligation: A law or regulation requires the recording.
• Legitimate interest: The controller has a legitimate interest that outweighs the data subject's rights (commonly used for quality assurance in call centers).

One-party consent under criminal law and GDPR consent are different concepts. You can legally record your own conversation without the other party's knowledge under the Codigo Penal framework. But if you are a business processing that recording, you still need a GDPR-compliant legal basis.

Business Call Recording Obligations

Businesses that record customer calls must:

• Inform callers at the start of the call that it is being recorded.
• State the purpose of the recording.
• Identify the data controller.
• Explain the caller's rights (access, rectification, deletion, portability).

The AEPD has issued guidance confirming that call recording for quality assurance can proceed under the legitimate interest basis, provided the caller is informed and given the option to object.

AEPD Enforcement

The AEPD is one of Europe's most active data protection authorities. It has issued substantial fines for GDPR violations, including cases involving improper recording practices. Fines under the GDPR can reach 20 million euros or 4% of global annual turnover, whichever is higher.

In 2026, the AEPD fined biometric verification company Yoti nearly 950,000 euros for violations including invalid consent mechanisms and excessive data retention. Businesses handling voice recordings without proper documentation and transparency face real enforcement risk.

Penalties Summary

Violation	Law	Penalty
Unauthorized interception of communications	Codigo Penal Art. 197.1	1 to 4 years prison + fine of 12 to 24 months
Unauthorized access to personal data in files	Codigo Penal Art. 197.2	1 to 4 years prison + fine of 12 to 24 months
Disseminating intercepted data or images	Codigo Penal Art. 197.3	2 to 5 years prison
Privacy offenses by data custodians	Codigo Penal Art. 197.4	3 to 5 years prison
Privacy offenses for profit with sensitive data	Codigo Penal Art. 197.6	4 to 7 years prison
Non-consensual sharing of intimate images	Codigo Penal Art. 197.7	3 months to 1 year prison or fine of 6 to 12 months
Unauthorized hacking of information systems	Codigo Penal Art. 197 bis	6 months to 2 years prison
Disseminating police footage endangering safety	LO 4/2015, Art. 36.23	Fine of 601 to 30,000 euros
GDPR violations (processing without legal basis)	GDPR / LOPDGDD	Up to 20 million euros or 4% global turnover

Business Compliance Checklist

Companies operating in Spain that record communications should address the following.

Identify your legal basis under GDPR. Before recording any call or meeting, determine which Article 6 basis applies. Document that determination in your Records of Processing Activities (ROPA).

Provide clear notice. Inform all parties at the start of a call or meeting that recording will occur. State who is recording, why, and how long the recording will be retained.

Limit retention. Define how long recordings are stored and automate deletion at the end of that period. The LOPDGDD caps workplace video retention at one month in most cases. Apply similar discipline to audio recordings.

Restrict access. Only authorized personnel should access stored recordings. Maintain access logs and review them periodically.

Honor data subject requests. Individuals have the right to access, correct, delete, and port their personal data under the GDPR. Build processes to respond to these requests within the one-month statutory deadline.

Conduct a Data Protection Impact Assessment (DPIA). If your recording activities involve systematic monitoring of individuals, a DPIA is mandatory under Article 35 of the GDPR. The AEPD has published a list of processing activities that trigger this requirement.

Train employees. Staff involved in recording, storing, or handling recordings should understand the legal framework and the company's policies. Document this training.