- Likely yes if you sell or take bookings online from consumers and you have 10 or more people, or more than €2 million in turnover or balance sheet.
- Likely exempt if you are a microenterprise that provides services. Microenterprises that make or sell physical products are not exempt.
- The target is WCAG 2.1 AA. The cost depends on how many templates and booking or checkout steps your site has, not on a flat rate.
Ley 11/2023 requires private businesses that sell products or services to consumers online to make their websites accessible. Title I has applied since 28 June 2025. Many small firms on the Costa del Sol are exempt, but only if they are a microenterprise (fewer than 10 people and turnover or balance sheet of no more than €2 million) and they provide services. If you are a villa rental agency with 12 staff, a clinic with an online booking form, or a shop with checkout, you should assume the law applies to you. This article is a practical guide, not legal advice. Check the BOE text or ask a lawyer before you decide you are exempt.
What Ley 11/2023 actually requires
For most local businesses, the part that matters is Title I and the rules on e-commerce. Article 2.2.f places e-commerce services sold to consumers inside Title I, and Title I took effect on 28 June 2025. Any site where a product or service can be bought or contracted counts. That includes booking flows, not just shopping carts.
So a brochure site with a phone number and no way to buy anything is in a different position from a site where a guest can reserve a table, a villa or a treatment.
Pure B2B offers are generally out of scope, because the European Accessibility Act (EAA) covers services provided to consumers. If your customers are other companies only, you are probably not covered. If you build or run sites for firms that sell to private individuals, such as villa rentals, restaurants, clinics or shops with online checkout, check the rule against that consumer-facing side.
The microenterprise exemption, step by step
Article 3.3 exempts microenterprises that provide services from the accessibility requirements and from any related obligation. Two details trip people up.
First, the definition. A microenterprise has fewer than 10 people and annual turnover or balance sheet total of no more than €2 million. Exceeding one threshold is enough to lose the exemption. A company with 12 employees and €800,000 turnover is not exempt.
Second, the exemption is for services. Microenterprises that make or sell physical products are not covered by it. A small shop in Málaga with two staff and an online checkout is therefore not automatically exempt, while a two-person consultancy probably is.
This matters locally because Spain's business base is made up mostly of very small firms. According to the INE business register (DIRCE), Spain had 3,310,824 active companies at 1 January 2025. Of those, 1,800,443 had no employees (54.4%), and 81.6% had two or fewer. In real estate activities (Actividades inmobiliarias), 94.4% had two or fewer. Many local firms may be exempt on headcount, but not necessarily on turnover, so check both.
At the other end, INE counts 85,467 companies with 10 to 19 employees and 76,005 with 20 or more. These mid-size firms are clearly in scope if they sell online to consumers.
Quick check for Costa del Sol businesses
| Your situation | Likely position | Why |
|---|---|---|
| Villa rental company, 12 staff, online booking | In scope | Over the headcount threshold, sells a service to consumers online |
| Restaurant group, 25 staff, online reservations | In scope | Not a microenterprise, booking flow counts |
| Sole-trader therapist with a contact form only | Likely exempt | Microenterprise providing services, nothing sold online |
| Three-person boutique with online checkout | Not exempt by default | Sells physical products, so the services exemption does not apply |
| Small studio selling only to other companies | Generally out of scope | B2B offers are not consumer services |
| Supplier to a town council | Indirectly affected | Public bodies follow a separate decree (see below) |
Treat the "likely" rows as a starting point. Edge cases, like a business that sells to both consumers and companies, need a closer read of the law.
What "accessible" means in practice
The technical benchmark is EN 301 549, which for websites in practice means WCAG 2.1 level AA. Spain has no separate technical regulation spelling out how to meet the law, so WCAG 2.1 AA is the reference you build and test against.
WCAG 2.2 became a W3C Recommendation on 5 October 2023. According to Wikipedia's summary, it adds 9 success criteria and removes 4.1.1 Parsing. The current harmonised EN 301 549 (v3.2.1) still points to WCAG 2.1 AA, and a newer version based on WCAG 2.2 is not yet officially cited.
A sensible build target is therefore 2.1 AA plus the 2.2 AA additions, such as Target Size (2.5.8) and Accessible Authentication (3.3.8).
For a booking or checkout flow, the things to test include:
- Every interactive element can be used with a keyboard alone.
- Form fields have real labels and clear error messages.
- Date pickers, guest selectors and payment steps can be completed without a mouse.
- Buttons and links are large enough to tap (Target Size), and login does not depend on solving a puzzle (Accessible Authentication).
Penalties and who enforces them
Penalties come through article 30 of Ley 11/2023, which refers to the sectoral sanction regime. Where there is none, it falls back to Title III of RDL 1/2013. That gives a range of €301 up to €1,000,000.
Secondary sources disagree on how the tiers split. One lists €30,000 for minor, €150,000 for serious and €600,000 for very serious infractions, as in Level Access's overview of Spain's laws. Another lists €30,001 to €300,000 for serious and up to €1,000,000 for very serious. So the safe statement is "up to €1,000,000", and you should check the BOE text for the exact tiers before relying on any figure.
On enforcement, oversight sits with the autonomous communities, which designate the control authorities. For Costa del Sol businesses, Andalusia's regional authority is the relevant one. The usual trigger is a complaint from a user or an association that could not complete a purchase, not an inspection out of the blue.
Enforcement is also getting more organised. Real Decreto 143/2026 of 25 February created the UTAC, a technical unit attached to the Ministry of Derechos Sociales, Consumo y Agenda 2030. According to Lawwwing's one-year review, it supports and coordinates the surveillance authorities for the law.
If you sell to the public sector
Public bodies follow a different rule. Real Decreto 1112/2018 applies to public bodies' sites and apps, requires WCAG 2.1 AA, and requires an accessibility statement and a feedback mechanism, as this guide to the decree explains. A private firm selling to a council is not directly bound by it, but it is indirectly affected.
What it costs to fix
We can't give you an honest flat figure, and we are wary of anyone who does without seeing the site. The cost depends on a few things you can check yourself:
- How many distinct templates you have. A five-page site with one booking form is a different job from a platform with hundreds of listing pages and several checkout paths.
- Where the problems sit. Issues inside your own code are in your hands. Problems inside a third-party booking engine, chat widget or payment form depend on that supplier, and may mean changing tool.
- What the site is built on. A clean, modern codebase is easier to fix than a heavily customised theme with many plugins.
- Whether you need an audit first. Knowing what fails, ranked by how much it blocks a purchase, keeps the work focused on the flows that carry the risk.
At Authect, every project is scoped and priced individually, and the accessibility target goes into the scope from day one rather than being added as an extra later. See how we price or use the project planner to rough out the scope before you talk to anyone.
A sensible order of work
- Decide if you are in scope. Count people, check turnover and balance sheet, and note whether you sell services or physical products to consumers online.
- Test the money path first. Try to complete a booking or purchase using only a keyboard, then with a screen reader. If you get stuck, a customer or an association could get stuck the same way, and a complaint is the usual trigger for enforcement.
- Fix by impact. Booking, checkout, login and contact forms first. Marketing pages second.
- Check third-party tools. Ask your booking, payment and chat vendors whether they meet WCAG 2.1 AA, and get the answer in writing.
- Build it into new work. If you are planning a redesign, set WCAG 2.1 AA plus the 2.2 additions as a requirement in the brief.
If your business is in the area, see our pages for Marbella and Málaga, and our website development service, which covers booking and e-commerce flows. Examples of our projects are on the work page.
FAQ
Does Ley 11/2023 apply to my small business in Málaga?
It depends on size and what you sell. A microenterprise that provides services (fewer than 10 people and no more than €2 million turnover or balance sheet) is exempt under article 3.3. A business with 10 or more people, or one that sells physical products online, is not exempt on those grounds. Check the BOE text for your case.
Which standard should my website meet?
EN 301 549, which in practice means WCAG 2.1 level AA. Spain has no separate technical rule. Building to 2.1 AA with the WCAG 2.2 AA additions, such as Target Size and Accessible Authentication, is a sensible target for new work.
How much is the fine for an inaccessible website?
Fines can go up to €1,000,000 under the sanction regime that article 30 points to. Sources disagree on the exact tiers for minor and serious infractions, so check the BOE text rather than relying on a single figure. In practice, enforcement usually starts with a complaint from a user or an association.
Who would act against my business?
Oversight sits with the autonomous communities, so for the Costa del Sol it is Andalusia's regional authority. The UTAC, created by Real Decreto 143/2026, supports and coordinates these authorities.
