Spain's New Rules For Tourists Spark Outrage Among Hoteliers

Spain has introduced stricter rules for collecting personal information from customers renting properties or cars, sparking concerns about privacy and bureaucracy. Under the new system, effective December 1, 2025, hotels, campsites, travel agencies, and car rental companies must now report more detailed information about their customers to the government using a digital platform.

Reports suggest that the government aims to improve security and help combat terrorism and organised crime. However, businesses that fail to comply with these rules could face fines of up to Euro 30,000 (USD 31,500).

Previously, hotels and similar establishments had collected basic details like names, emails, and passport numbers. But now, they must gather much more, including birthdates, phone numbers, and payment methods. The necessary level of information is even higher for car rentals and lodging, with companies having to collect over 40 pieces of information for accommodations and over 60 for car rentals.

Many in the tourism industry feel this is too much. The Confederation of Spanish Hoteliers and Tourist Accommodation (CEHAT) has voiced concerns about the burden on businesses and has even considered legal action against the new rules. Travel agencies have also expressed their frustration, warning that these requirements might discourage tourists and be too expensive for smaller businesses to implement.

While the government sees these measures as a step toward greater safety, the tourism sector worries about the impact on privacy, the added administrative burden, and the potential for losing customers.

The latest policy changes, such as the increased data collection requirements for hotels, car rentals, and travel agencies, underscore Spain’s focus on enhancing national security. By collecting detailed customer information, the government aims to combat threats like terrorism and organised crime. While these measures align with broader European Union efforts to improve security across member states, they have sparked debates about privacy and administrative burdens for businesses.

(With inputs from multiple reports)