⚖️
Age verification: what exists and what is coming
Spain does not yet have a single porn age-verification statute in force. What exists today is the EU Digital Services Act, coordinated nationally by the CNMC; the draft organic law on the protection of minors in digital environments moving through the Cortes; and Cartera Digital, the government age-verification wallet that issues anonymous proofs of adulthood a site can check. The AEPD has been explicit that age verification must not require identifying the user, and has pushed back on sites running facial biometrics themselves. The build that survives is a third-party verifier plus Cartera Digital support, so the law landing is a configuration change rather than a rewrite.
💳
Payments and chargeback survival
Spanish acquirers, Redsys-based gateways and Bizum do not serve adult, and Stripe and PayPal exclude it by policy. The working set is Verotel, SegPay, CCBill and Epoch, with 3-D Secure 2 mandatory for EEA cards. Selling to Spanish consumers puts you inside the Ley General para la Defensa de los Consumidores: clear pre-contract information, a documented cancellation route, honest recurring-billing disclosure. Chargeback ratio is what actually kills adult merchants, and a clear billing descriptor plus a visible cancellation link does more for survival than any anti-fraud plugin.
🌐
Spanish, Catalan and the coastal audiences
Spanish first, and Catalan is worth serious consideration for Barcelona - it is a genuine ranking and trust factor there, not a courtesy. English and Russian cover the Costa del Sol, Alicante, Tenerife and Barcelona international audiences, with Romanian and Ukrainian as common additions. Search behaviour differs enough between regions that city-level landing pages built on separate original copy outperform one national page, provided the copy is genuinely different rather than a template with the city name swapped.
🔐
Hosting, LSSI-CE and DSA duties
Host in the EU. Spain enforces the LSSI-CE, which requires the site to publish identifying information about the operator, and DSA duties sit on top: a notice-and-action mechanism, a contact point, and statements of reasons when you remove content. Micro and small enterprises are exempt from most of the heavier online-platform obligations but not from the hosting-tier ones, so even a small operator needs a working abuse channel that a human reads. We set that up as part of the build rather than leaving an unmonitored mailbox.