# Spain eSIM: Ley 25/2007's Local SIM Registry, Explained

Source: https://esimrules.com/destinations/spain/
Author: Nadezhda Semenova — Entrepreneur, co-founder of the travel service Trippy (https://esimrules.com/about/)
Updated: 2026-09-12

> A Spain eSIM sits outside Ley 25/2007, which logs a local prepaid SIM buyer's name, passport and nationality. Orange 5G, from $3.99. Checked 15 Aug 2026.

## Does this apply to you? (the register is real — and it is kept by the operator)

eSIM Spain is Guay Mobile: an Orange-network profile carrying a number no Spanish operator issued, so Ley 25/2007’s register, which logs only a local prepaid Subscriber Identity Module (SIM) buyer, has nothing to log here. Spain runs a real identity register for prepaid SIM cards, and Spanish law puts the paperwork on the operator, not on you. Ley 25/2007’s additional provision has required this since 8 November 2007.

A Spanish mobile operator selling prepaid activation must log the buyer’s name, surname, nationality and identity-document number before the card works. This project read 58 competitor pages that mention Spain — 216,899 words combined. None of them prints this paragraph — this eSIM Spain page does.

The eSIM sold on this site does not trigger that log. It is not sold by a Spanish operator, and it is not a local prepaid SIM. It is a data profile that roams on Orange’s network under a foreign number, set up before you land.

That is one half of the picture, and only one half. Walk into a Movistar, Orange or Vodafone shop in Madrid or Málaga to buy a local prepaid SIM, and the same law reaches you directly, at the counter, in person. The next four sections read that law’s own text: the register duty, the exact line that logs your nationality, who is allowed to ask for that data, and who Spain fines when the paperwork is skipped. The section after that spells out what a shop counter actually asks a foreign buyer for. Product details and pricing for this eSIM sit under “What you get,” further down.

## What Spanish law requires before a prepaid SIM is sold

The duty sits in one place. Ley 25/2007’s additional provision (*disposición adicional única*) runs eight paragraphs. Paragraph 1 opens with the register duty itself.

> “Los operadores de servicios de telefonía móvil que comercialicen servicios con sistema de activación mediante la modalidad de tarjetas de prepago, deberán llevar un libro-registro en el que conste la identidad de los clientes que adquieran una tarjeta inteligente con dicha modalidad de pago.”

> Translation: “Mobile telephony service operators that market services with an activation system through the prepaid-card mode must keep a register-book recording the identity of the customers who acquire a smart card under that payment mode.” (Additional provision, paragraph 1, Ley 25/2007)

That duty falls on the operator, not on you as a buyer. The same paragraph adds a second duty, and it applies before the sale, not after.

> “Los operadores informarán a los clientes, con carácter previo a la venta, de la existencia y contenido del registro, de su disponibilidad en los términos expresados en el número siguiente y de los derechos recogidos en el artículo 38.6 de la Ley 32/2003.”

> Translation: “Operators shall inform customers, prior to the sale, of the existence and content of the register, of its availability under the terms set out in the following paragraph, and of the rights recognized in article 38.6 of Law 32/2003.” (Additional provision, paragraph 1, Ley 25/2007)

A shop must say the register exists before it takes your money. It must also say what it holds. One document proves who you are: “documento acreditativo de la personalidad.” A Spanish national shows a Documento Nacional de Identidad (DNI), a visitor a passport. The law treats both the same way. The next section names what goes into the register-book from that document.

Paragraph 1 also covers a company, not just a person. A tax card proves identity instead of a DNI or passport. The register-book then holds the firm’s name and tax code, not a person’s name.

## The line that records your nationality

Spain’s prepaid-SIM register logs five fields on every buyer, and one of them is nationality, written into the law’s own text since 2007.

> “La identificación se efectuará mediante documento acreditativo de la personalidad, haciéndose constar en el libro-registro el nombre, apellidos y nacionalidad del comprador, así como el número correspondiente al documento identificativo utilizado y la naturaleza o denominación de dicho documento.”

> Translation: “Identification shall be carried out by means of a document proving identity, with the register-book recording the buyer’s given name, surname and nationality, as well as the number of the identification document used and its nature or type.” (Additional provision, paragraph 1, Ley 25/2007)

Five fields, read straight off that sentence: given name, surname, nationality, document number, document type. Fifty-eight of the competitor pages collected for this site mention Spain at least five times. None of them quotes this line. None mentions the nationality field at all. The closest any gets is a per-gigabyte (GB) price table — nothing that reads like an eSIM Spain buyer’s actual legal question.

Read the sentence again for what it does not say. It sets no citizenship test for who may buy. You, a resident and a Spanish national all clear the same single requirement: a document proving identity. None of you is turned away for holding the wrong passport. What the law adds is a recording duty. If you buy a local SIM, whatever your passport says about your nationality goes into the register-book alongside your name, surname and document details — the same as for every other buyer, without exception written anywhere in this paragraph.

## Who can ask for those records, and who gets fined

Spain names five categories of recipient for this register’s data. The list is closed — nobody outside it gets access under this provision. Paragraph 2 spells out who they are, in one sentence that runs the length of the list itself.

> “Desde la activación de la tarjeta de prepago y hasta que cese la obligación de conservación a que se refiere el artículo 5 de esta Ley, los operadores cederán los datos identificativos previstos en el apartado anterior, cuando para el cumplimiento de sus fines les sean requeridos por los agentes facultados, los miembros de las Fuerzas y Cuerpos de Seguridad del Estado y de los Cuerpos Policiales de las Comunidades Autónomas con competencia para la protección de las personas y bienes y para el mantenimiento de la seguridad pública, el personal del Centro Nacional de Inteligencia en el curso de las investigaciones de seguridad sobre personas o entidades, así como los funcionarios de la Dirección Adjunta de Vigilancia Aduanera.”

> Translation: “From the activation of the prepaid card until the data-retention duty under article 5 of this Law ends, operators shall transfer the identifying data referred to in the previous paragraph, when required for their purposes by authorized agents, members of the State Security Forces and Corps and of the Autonomous Communities' police corps with competence for the protection of persons and property and for the maintenance of public security, personnel of the National Intelligence Centre in the course of security investigations concerning persons or entities, and officials of the Customs Surveillance Deputy Directorate.” (Additional provision, paragraph 2, Ley 25/2007)

Five named recipients, no catch-all: authorized agents, State Security Forces and Corps, the regional police corps of the Comunidades Autónomas, National Intelligence Centre (CNI) staff on security investigations, and Customs Surveillance officials. Buy a local SIM, and your entry sits with the operator until Spain’s data-retention duty ends. Only these five can ask for it. Paragraph 4 repeats the same closed list for a second purpose. That purpose: investigating and prosecuting a crime under the Criminal Code or a special criminal statute.

Paragraph 5 sets the penalty. It is addressed to the operator, never to the buyer.

> “Es infracción muy grave el incumplimiento de la llevanza del libro-registro referido.”

> Translation: “Failure to keep the register-book referred to is a very serious infraction.” (Additional provision, paragraph 5(a), Ley 25/2007)

That is the top tier. A repeated or systematic gap in the register — “reiterada o sistemáticamente incompleta” — sits one tier down, at “grave.” A single, non-repeated gap sits at “leve,” the lightest tier. Grave and leve reach further than the book itself. Both also cover a failure to hand data over when the law says to. None of the three tiers describes a buyer showing the wrong document. This paragraph gives a buyer no offense to commit.

One correction belongs here, checked against the primary text directly. Paragraph 5, quoted above, is not 2007-original wording. A note attached to it in the BOE text names the change: “Se modifica el apartado 5 por la disposición final 4.4 de la Ley 9/2014, de 9 de mayo.” Ley 9/2014 made that change, in force since 11 May 2014 (BOE-A-2014-4950). The three-tier penalty above is that post-2014 text. Paragraphs 1 through 4 carry no such note. The register duty, the ID method, the nationality field and the recipient list stand as enacted in 2007. “Sources and freshness,” below, says more on how that was checked.

## Buying a local Spanish SIM: what you will actually be asked for

A local Spanish prepaid SIM, bought at a Movistar, Orange or Vodafone counter, comes with the ID check above attached. A passport works, and nothing in the law turns a foreign buyer away. The clerk asks for “documento acreditativo de la personalidad” in the law’s own words. A passport satisfies that phrase for a non-Spanish national exactly as a DNI does for a Spanish one.

No article in the additional provision limits who may buy by citizenship. Expect the register entry above — name, surname, nationality, document number and document type — to be taken from that passport at the till.

This eSIM sits outside that specific transaction, and it is worth stating precisely why, rather than in a phrase that oversells it. It is not that this profile “gets around” a rule aimed at it — nothing here defeats or evades paragraph 1. The provision addresses a different transaction: a Spanish operator activating a local prepaid card at the point of sale. This site’s profile is neither. It is sold by a foreign operator and it roams into Spain on a number that is not Spanish, so the paragraph’s own wording never reaches it. Buy the local SIM instead, and the register duty above is exactly what meets you at the counter.

## What you get: Guay Mobile on Orange, 5G, data-only

This eSIM Spain profile is Guay Mobile: a data-only profile roaming on Orange’s 5G network, with no ID step at checkout, sold in twelve plans from $3.99 to $43.99. KYC is not required to activate it (Airalo catalog data, checked 15 August 2026). That follows from the profile sitting outside the register duty described above, not from any gap in Spanish law.

The install window runs 365 days from purchase, and the usage clock starts at first connection, not at the moment of purchase or install. APN configures itself automatically on both iOS and Android. The profile is rechargeable online, and the catalog listing states no expiry on the balance once loaded.

| Plan | Price |
|---|---|

The 5 GB / 30-day plan is the one most short trips land on; a 1 GB / 7-day plan covers a long weekend.

## Before you fly, and on landing

**Install the profile before departure, on Wi-Fi, not at the airport.** The QR (Quick Response) code or install link needs a working connection to complete, and a connection on arrival is not guaranteed. The 365-day install window means buying weeks ahead costs nothing.

Nothing activates at install. A profile that shows as installed but inactive before boarding is normal. The clock starts at first connection to Orange’s network, once you land and turn on data roaming for the new profile.

Running the Spain eSIM alongside a home SIM works on any dual-SIM phone. Set the Spain eSIM as the data line. Turn off cellular data on the home SIM rather than the whole line, so nothing pulls a roaming charge by accident.

This profile is data-only and carries no phone number. Anything that verifies you by SMS to a Spanish number — a local bank’s one-time code, a delivery app, a loyalty sign-up at a Spanish shop — sits outside what it can do. That follows from being data-only, not from any identity rule in the sections above.

The catalog lists this profile as 5G, checked 15 August 2026.

If this is your first eSIM install, the Spain profile works the same way as anywhere else. [The iPhone install guide](/guides/install-esim-iphone/) and [the Android install guide](/guides/install-esim-android/) cover the QR-scan and manual-entry paths in full. For a dated look at Airalo’s own track record across destinations, see [the Airalo review](/reviews/airalo/).

## FAQ

## Sources and freshness

Checked against Ley 25/2007, de 18 de octubre (BOE-A-2007-18243). That is Spain’s law on data tied to phone and internet records. The consolidated text sits at boe.es. It was saved locally as a 45,357-character file and read in full on 15 August 2026. Every paragraph cited above — 1 through 5 of the additional provision — was read directly from that text.

The freshness check searched the BOE’s own amendment markers inside the additional provision’s block. Those markers are “Se modifica,” “Se añade,” “Se deroga.” The search returned one hit. That hit reads: “Se modifica el apartado 5 por la disposición final 4.4 de la Ley 9/2014, de 9 de mayo” (BOE-A-2014-4950). It attaches to paragraph 5, in force since 11 May 2014. No marker attaches to paragraphs 1 through 4. That text stands as enacted in 2007. Across the whole file, the same markers appear four times total. The other three touch articles 6, 7 and 10, not the prepaid-card provision.

Not read for this page: Spain’s wider telecommunications framework beyond this one statute. Also unread: Movistar’s, Orange’s and Vodafone’s own point-of-sale terms. Enforcement records for paragraph 5 were not read either. Nor was Orange’s coverage outside major cities. That gap sits in the Airalo catalog data too.

The competitor pages collected for this site were checked before writing, not assumed empty: 58 of them mention Spain at least five times, 216,899 words combined. That net is wider than pages built only around Spain. It includes Holafly’s Spanish-language site and Monito’s Europe roundup. A case-insensitive search covered all 58 pages. It checked “libro-registro,” “ley 25,” “registro,” “nacionalidad” and “pasaporte.” Zero hits. This project holds no search-engine results page (SERP) snapshot for the query “esim spain” itself. Six SERP captures mention “Spain” in passing, under unrelated queries. None targets Spain. They run under five other queries instead: “airalo turkey review,” “countries where esim is banned,” “is airalo banned in india,” “airalo review,” and “cheapest esim for europe.” No traveller forum thread collected for this site mentions Spain either.

Plans, pricing, network, and the install and top-up windows come from Airalo’s own catalog data. That data covers Guay Mobile, checked 15 August 2026. Airalo can change any of it without notice. This page reads Spanish statute law as of 15 August 2026. Recheck it before relying on it for anything beyond ordinary travel use.

> *Sources cited only — expert review pending. For individualized advice, consult a licensed professional.*

## FAQ

Does Spain's SIM registration law apply to a travel eSIM?
No, not the one sold on this site. Ley 25/2007 addresses a Spanish operator who activates a local prepaid card. This eSIM comes from a foreign operator instead. It roams on a foreign number too. That rule does not reach it. This profile does not defeat the rule — the rule was written for another transaction.

What does Spain's prepaid SIM register actually record?
Five fields sit on every buyer's record. They are given name, surname, nationality, document number, and document type. Paragraph 1 of Ley 25/2007 states this directly. It applies to every buyer. No citizenship exception is written anywhere in the text.

Can a foreigner buy a prepaid SIM card in Spain?
Yes. The law sets no citizenship bar. A passport counts as the "documento acreditativo de la personalidad" the law requires. A DNI does the same job for a Spanish national. What changes for a foreign buyer is what goes into the register. What does not change: whether the sale is allowed.

Who gets fined if a Spanish operator skips the register?
The operator, never the buyer. Paragraph 5 calls a failure to keep the register-book "infracción muy grave" — a very serious infraction. That duty falls on the operator running the till. It does not fall on the person who bought the card.

Who can access the data in Spain's prepaid SIM register?
This list is closed. Five categories, no more, can ask for the data: authorized agents, State Security Forces and Corps, regional police corps of the Comunidades Autónomas, National Intelligence Centre staff on security investigations, and Customs Surveillance officials. Paragraph 2 names all five. Nobody outside that list gets access under this provision.

Is Ley 25/2007's prepaid-SIM rule still current law?
The register duty is current. So are the identification method and the nationality field. All three stand unamended since the rule took effect on 8 November 2007. The penalty paragraph is current too, for a separate reason: it was rewritten. Ley 9/2014 did the rewriting. The "very serious infraction" wording above is that 2014 text, not the 2007 original.