Mandatory legal notices on a Portuguese holiday property's website in 2026

In 2026 a holiday property's website in the Algarve must link to the electronic Livro de Reclamações, Portugal's official complaints book, name the region's consumer arbitration centre (CIMAAL), identify the business, give privacy information and ask for consent before any cookie that is not strictly needed. Properties licensed as alojamento local (AL, the Portuguese licence for holiday lets and small guesthouses) must also show their registration number. A link to the EU's online dispute resolution (ODR) platform should be removed, because the platform has closed.

What we found on 94 home pages

In November 2026 we checked the 109 websites that tourist establishments in the eastern Algarve (Sotavento) list in Portugal's national tourism register, and 94 opened. We looked for the notices on the home page only, so a site may have them elsewhere. We found no link to the complaints book on the home page of 29 (31%), no mention of an alternative dispute resolution body on 76 (81%) and no privacy policy link on 17 (18%). One still links to the ODR platform. AL properties were not part of the study, because their register has no website field.

On 7 November 2026, while preparing our Raio-X check, we looked at livinstaysalgarve.com, a client site we built, and found the complaints book link and the CIMAAL line missing. Both went into the footer that evening.

The electronic complaints book

Article 5.º-B of Decree-Law 156/2005 requires every business to have the electronic complaints book (no. 1) and to show access to the platform on its website "in a visible place and prominently" (no. 2). In practice that means registering the property on livroreclamacoes.pt and putting a link to it in the footer of every page. Electronic complaints must be answered within 15 working days (no. 4), and the paper book is still required at the property (no. 6).

Tourist establishments and AL are both in the decree's annex, and inspection falls to ASAE, the authority that also runs food and economic inspections (article 11.º). Failing nos. 1 to 3 is a "serious" economic offence (article 9.º). Before opening a case, ASAE must send a warning and allow 90 days to put it right (article 9.º-A).

Alternative dispute resolution: CIMAAL

Article 18.º of Law 144/2015 requires businesses to tell consumers which alternative dispute resolution bodies they are bound to, by membership or by mandatory arbitration, and to give those bodies' websites. The information must be on the website and in written contracts or another durable medium (no. 2). In our reading, your booking confirmation e-mail is one of those durable media.

Since 2019, consumer disputes worth up to the value threshold of the first-instance courts (the "alçada") must go to arbitration whenever the consumer chooses it (article 14.º of the Consumer Protection Act). CIMAAL gives that limit as 5,000 euros. In our reading this binds every property to its competent arbitration centre, and in the Algarve that centre is CIMAAL. Its 2026 rules make it competent when the consumer lives in its area or the contract was made there, and for disputes with consumers from other EU countries when the business is based in its area (article 6.º). The European Commission's list shows it handles hotel and holiday accommodation disputes in English, French, Portuguese and Spanish.

One line is enough, ideally in both Portuguese and English. In English: "In the event of a dispute, the consumer may refer it to CIMAAL, Centro de Arbitragem de Conflitos de Consumo do Algarve, www.consumoalgarve.pt, Av. 5 de Outubro, 55, r/c dto., 8000-075 Faro, +351 289 823 135." Failing this duty is a "minor" economic offence (article 23.º), inspected by ASAE (article 22.º).

The EU ODR platform has closed

Regulation (EU) 2024/3228 shut the platform down: it stopped accepting complaints on 20 March 2025, and the regulation that obliged online sellers to link to it was repealed with effect from 20 July 2025. A link to it now sends guests to a service that no longer exists. Take it out and keep the CIMAAL line.

ASAE fines by band

The complaints book, dispute resolution and AL registration number offences follow Portugal's economic offences regime (article 18.º):

A microenterprise has fewer than 10 workers, a small company 10 to 49, a medium company 50 to 249 (article 19.º). The first column applies to owners who trade as individuals.

Registration number and business identity

For AL, article 17.º(2) of Decree-Law 128/2014 says advertising, commercial documents and merchandising must show the property's name or logo and its registration number. In our reading, the property's own website is advertising. Breaking this rule is a minor offence (article 23.º(2), with the fines in the table above), and advertising an AL that is unregistered or whose registration is out of date is serious (article 23.º(1)). ASAE and the local council both inspect (article 21.º).

For tourist establishments (hotels, quintas licensed as agroturismo or casas de campo, and the like), Decree-Law 39/2008 only asks advertising to show the name or logo (article 42.º). The duty to display the national tourism register (RNT) number falls on booking platforms (article 42.º-A) and, in our reading, the decree does not impose it on the hotel's own site.

For everyone, the e-commerce law (Decree-Law 7/2004, article 10.º) requires the site to show, easily and directly, the name or company name, the address, an e-mail for direct contact, registrations in public registers with their numbers, and the NIF (tax number). The fine runs from €2,500 to €50,000, with both limits raised by a third for companies (article 37.º), and ANACOM, the communications regulator, is the central supervisor (article 35.º). In our reading the RNT or AL number counts as one of those public registrations, so showing it next to the NIF covers both points.

Privacy

When the site collects a guest's data, through a booking or contact form, article 13 of the GDPR requires you to say, at that moment, who the controller is and how to reach them, what the data is for and on what legal basis, who receives it (booking engine, payment provider), whether it leaves the EU, how long it is kept, what rights the guest has, and that they can complain to the supervisory authority, which in Portugal is the CNPD. Article 14 covers data that reaches you another way, such as a booking made through an online travel agency.

The ceiling for these failures is 20 million euros or 4% of worldwide turnover, whichever is higher (article 83(5)). It is a ceiling, and the actual amount depends on the case.

Cookies and consent

Article 5.º of Law 41/2004 only allows storing or reading information on a visitor's device with prior consent, based on clear and complete information. The exceptions are what is strictly needed to transmit the communication or to provide the service the visitor asked for, such as keeping a booking in progress. Visitor statistics, advertising pixels and embedded videos or maps that set cookies need consent before they load.

The CNPD enforces this (article 15.º). The fine runs from €1,500 to €25,000 for individuals and from €5,000 to €5,000,000 for companies (article 14.º(1)(e)).

Accessibility: the European Accessibility Act

Decree-Law 82/2022 transposes Directive (EU) 2019/882 and has applied since 28 June 2025 to services provided to consumers from that date (article 39.º). The services covered include e-commerce (article 2.º(3)(g)), which the directive defines as services provided at a distance, through websites and apps, at a consumer's request, with a view to concluding a consumer contract. Microenterprises providing services are excluded (article 2.º(5)): fewer than 10 people and annual turnover or balance sheet total up to 2 million euros.

Our reading, which you should confirm with a lawyer: a booking engine where the guest picks dates and pays on the property's own site is an e-commerce service, and a business with 10 or more people, or with both turnover and balance sheet above 2 million euros, is covered. Besides the technical requirements, the provider has to explain publicly how the service meets them (article 13.º).

ANACOM supervises e-commerce services under this decree (article 28.º). For serious offences the fine runs from €650 to €1,500 for individuals and from €12,000 to €24,000 for companies. Providing a service that does not meet the requirements is very serious: the fine starts at €2,000 for an individual or €24,000 for a company and goes up to the maximum of Portugal's general regime for administrative offences (article 29.º). In our study, 26 of 91 sites scored below 80 for accessibility in the Lighthouse lab test, mobile profile.

What to do this week

1. Open your home page on a phone and look in the footer for the complaints book link and the CIMAAL line.
2. Check that the property is registered on the electronic complaints book and that someone reads the e-mail address linked to it.
3. Remove any link to the EU ODR platform.
4. Add the CIMAAL line, in Portuguese and English, to your booking confirmation e-mail.
5. Create or review a "Legal information" page with your name, NIF, address, e-mail and RNT or AL number.
6. Read your privacy policy and check that it states how long data is kept and mentions the CNPD.
7. Ask whoever runs your site for a list of what loads before a visitor accepts cookies.
8. If you have 10 or more people, ask your booking engine supplier for its accessibility information and talk to a lawyer.

Our free Raio-X Digital checks these notices on your site. The e-mail records that stop forged messages in your name are in our article on SPF, DKIM and DMARC, and looking after your domain is covered in our article on expired domains.

This article is general information about Portuguese law in November 2026, not legal advice.