5G regulation and law in Spain

The deployment of 5G, (including SA and non-Standalone (NSA, mobile networks, in Spain covered 92% of the population in Spain by June 2023 1 :

According to Spanish telecommunications regulator CNMC, on December 31^st, 2023, SA 5G coverage was 33.4% of the Spanish population 2 .

This is the information provided by the three main mobile telecommunications network operators (Digi is not relevant in this market for the time being):

• Telefónica launched SA 5G services in 11 cities in July 2023. These were Avila, Barcelona, Castellon, Ferrol, Gran Canaria, Madrid, Malaga, Palma de Mallorca, Segovia, Seville and Vigo 3 . Now, itcovers most cities with more than 250,000 inhabitants.
• MasOrange has SA 5G services in 72 Spanish cities 4 .
• Vodafone only provides SA 5G services to companies, not to individuals 5 .

In 2023, the Ministry provided funding amounting to EUR 1 bn (USD 1.05bn) to provide SA 5G services in rural areas, allowing 1.8 m additional inhabitants to have access to this service 6 . In 2024, the Ministry launched a second phase of the program, with additional funding.

Regarding the quality of SA 5G networks, the average data ratio in the Spanish SA 5G networks is much higher than in other parts of Europe, according to Ookla 7 :

Although all three main 5G network operators (Telefónica, Vodafone and MasOrange) have been actively providing services to industry (e.g. private networks for industries such as ports or refineries) with the 700 MHz and the 3.4 to 3.8 GHz, there has not to date been enough economic or technological demand to justify reserving a substantial part of this spectrum for direct use by the industry through self-supply. Per conditions accepted in the public tenders, the operators must provide services in certain main airports, ports, train stations and roads, as well in a number of municipalities. There are public subsidies for investing in 5G coverage in roads, railways and rural areas (Order ETD/507/2022).

The technical features of the 26 GHz band (lower penetration, less signal propagation, more broadband capacity and speed, less latency and shorter range) mean it is possible to directly allocate some frequencies within this band to industry, for use in specific premises, to any number of recipients and without an auction. In this sense, 450 MHz within the 26 GHz spectrum band (in particular, 24.25 -24.70 GHz) has been reserved, on a non-exclusive basis, for self-provision and industrial uses, according to Royal Decree 16/2023 of 17 January, which modified spectrum regulation, as well as Order ETD/625/2023, of 12 June.

The public tender for the 700 MHz band (see below) included the stipulation that operators  provide service in airports, ports, railway stations, some roads and other infrastructures, but no specific spectrum has been reserved for these infrastructures. In the 26 GHz band, those infrastructures may use the 24,25 -24,70 GHz frequencies too.

Moreover, spectrum auction regulations establish the maximum number of frequencies that can be held by each operator, thus preventing the hoarding of frequencies and maintaining free competition: 

• In the 3.4 to 3.8 GHz band, the limit is 120 MHz (Clause 14, Order ETD/1248/2020). This limit was later increased to 140 MHz in 2023 8 , following the announcement of the Orange-MasMovil merger project in 2022. 
• In the 700 MHz band, the limit is 2x15 MHz (there is another joint limit of 2x35 MHz together with the frequencies in the 800 MHz and 900 MHz) (Order ETD/534/2021). In 2023 this limit was modified in the case of programs publicly funded for the increase of 5G coverage in cities under 10.000 inhabitants 9 . 
• In the 26 GHz auction (2022), there is a 1 GHz limit (Clause 14, Order ETC/1059/2022).

Spain was one of the first countries in the European Union to complete the assignment of the entire 5G spectrum 10 . 

There have been five relevant public tenders to award frequencies for 5G: 

• A first auction in 2015-2016 (Order IET/2718/2015, of 11 December) granted a limited number of (2x20MHz) spectrum rights in the 3.5 GHz band. Now these spectrum rights can be used for 5G, by virtue of the technology neutrality principle. See below for the spectrum allocation. 
• A second auction in 2018 (Order ETU/531/2018) with 40x5 MHz in the 3.6 to 3.8 band See below for the spectrum allocation. 
• A third auction in 2020 (Order ETD/1248/2020) with 20 MHz in the 3.4 to 3.6 GHz band See below for the spectrum allocation. 
• A fourth auction in 2021 (Order ETD/534/2021) with 2x10, 2x10, 2x5, 2x5, 5, 5 and 5 MHz in the 700 MHz band. Orange was awarded 2x10 MHz, Telefónica 2x10 MHz and Vodafone 2x10 MHz. 
• A fifth auction in 2022 (Order ETD/1059/2022) with 12x200 MHz state concessions amounting a total 2,400 MHz and 38 regional concessions amounting to a total 400 MHz, all of them in the 26 GHz band. Some of these concessions were not allocated. Telefónica was awarded 1 GHz, Vodafone 400 MHz, and Orange 400 MHz. 

The 5G frequencies in the 3.4 to 3.8 GHz band were reordered in 2021-2022 as follows (see in https://www.cnmc.es/prensa/reorganizacion-espectro-5g-cnmc-20211104): 

When terrestrial digital television frequencies are finally made available (a result that should have happened on 14 February 2024, according to Royal Decree 16/2023), a sixth auction will take place, this time in the 700 MHz band. 

Then, in 2024 and as a consequence of the MasMovil-Orange merger and the creation of MasOrange, the limit in the 3.4 to 3.8 GHz band (even after this limit increased to 140 MHz, as explained above) was exceeded by MasOrange by 50 MHz. However,t MasOrange was forced to sell 20 MHz to Digi in this same band as a consequence of the merger-approval remedies imposed by the European Commission, and afterwards MasOrange decided to sell a further 20 MHz to Telefonica 11 . In November 2024, MasOrange has still 10 MHz in excess of the limit and will be forced to either give up these frequencies (in which case the Ministry will possibly call another public tender, that would be the seventh one) or to sell them to another operator in the short term. 

Telefónica Movistar also uses 4G spectrum bands (1800 MHz and 2100 MHz) for 5G, using DSS (Dynamic Spectrum Sharing), with lesser 5G features. 

There are previous requirements for winning frequencies under these tenders: 

• In all tenders, the tenderer must be qualified as an operator, in accordance with the definition in the General Telecommunications Law.
• The tenderer shall demonstrate sufficient economic, financial, technical or professional solvency. Annual turnover in the three years previous to the auction is required (in the 2018 auction, EUR 90m (USD 94.5m). The telecommunication networks installed, and the relevant electronic communication services rendered by the tenderer during the three years before the auction should have a certain value (in the 2018 auction, EUR 42m (USD 44.1m)).
• Together with its application, the tenderer shall file, , documentary proof of a bank or similar guarantee to take part in the auction.
• See above the limits on the amount of frequencies to be awarded in each auction. 

Within the limits above, spectrum was awarded based on price. 

As a general rule: 

• The concessions grant non-exclusive rights (this meaning that future concessions on other spectrum bands could be granted). No future indemnity for new players.
• Service and technology neutrality.
• Spectrum rights cannot be sold to third parties during the first two years. Afterwards, only with previous administrative authorisation. 

Regarding the term: 

• First auction (2015-2016, 3.5 GHz band) ending 31 December 2030. This term was extended with a possible 10-year extension in June, 2024 12 .
• Second auction (2018, 3.6 to 3.8 band) for 20 years. This term was extended with a possible 10-year extension in June, 2024 (ibidem).
• Third auction (2020, 3.4 to 3.6 GHz band) ending 4 December 2038. This term was extended with a possible 10-year extension in June, 2024 (ibidem).
• Fourth auction (2021, 700 MHz band) for  20+20 years.
• Fifth auction (2022, 26 GHz band) for 20+20 years. 

These are the coverage obligations in the 700 MHz auction (2021):

• Telefónicby June 2025 must cover all municipalities of over 20,000 inhabitants.
• The same applies to Orange and Vodafone, but in municipalities of over 50,000 residents. 

In the 700 MHz auction, there are additional coverage obligations for airports, ports, train stations and roads (all of them listed). 

Regarding the 2018 tender: 

• Price: minimum EUR 2.5m (USD 2.62m) / 5MHz. Total price resulting from the tender: EUR 437m 13  (USD 459m)
• Annual taxes: Operators must pay EUR 868m (USD 911.6m) for spectrum use during the licence duration

Regarding the 2021 700 MHz tender: 

• Price: minimum EUR 995.5m (USD 1.045bn). Total price resulting from the tender: EUR 1,183.09m (USD1.242bn). Telefonica paid EUR 310.09m (USD 325.7bn), Vodafone EUR 350m (USD 367.6m) and Orange EUR 523m (USD 549m).
• Annual taxes: Operators must pay an annual fee. 

And regarding the 2022 26 GHz tender: 

• Minimum price and total price (the same): EUR 36.2m (USD 38m). Telefónica paid EUR 20m (USD 21m), Vodafone EUR and Orange EUR 8m (USD 8.4m) each.
• Annual taxes: Operators must pay an annual fee. 

We have no information on any procedure initiated by the regulator in order to declare non-compliance with any conditions imposed by the 5G concessions. 

There has been some debate regarding possible extension of the spectrum concessions already granted, adopted in June, 2024 14 14  as mentioned above. 

The general 5G framework is defined in the Agenda España Digital 2025 (Hoja de Ruta para la Transformación Digital). It has already been partly implemented through spectrum auctions, namely coverage obligations in the 700 MHz auction. 

The national recovery plan, as defined in the Acuerdo del Consejo de Ministros (27 April 2021), was approved by the European Commission’s Recovery, Transformation and Resilience Plan.

In this context, the  UNICO Redes 5G 15  15 program is granting a number of subsidies regarding the deployment of 5G, especially in rural areas as mentioned above. 

On 14 February 2024 the spectrum used by digital terrestrial television should have been made available (Royal Decree 16/2023), allowing the sixth spectrum auction (700 MHz band) to take place. This auction hasn’t started yet. 

Furthermore, as mentioned above, there is the possibility of a 10 MHz band being made available by MasOrange in the 3.4 to 3.8 GHz band as a consequence of the merger, and if this occurs then a seventh spectrum auction will take place. 

The 5G specific rules (apart from general spectrum and radio emissions regulations) are in the tender conditions. 

Yes, there are some network sharing agreements.

Digi has the smallest network in the market and therefore the greatest need for network sharing. 

Digi in July 2024 executed a 16-year network sharing agreement with Telefónica, until 2041 16 . The agreement will be effective on 1 January 2025  and  covers both Domestic Roaming and RAN Sharing Services 17 .

Vodafone has had a network sharing agreement with MasOrange since 2006, last updated in 2019 18 . 

MasOrange obviously has a network sharing agreement with Totem Towers, the Orange Group towers company carve-out.

The three main network operators, Telefónica, MasOrange and Vodafore, executed an agreement in May 2024 to share their networks in cities and towns with fewer than 10,000 inhabitants using the 700 MHz band 19 . 

On 29 October 2024, MasOrange and Ericsson announced a project to launch Open RAN in the Spanish market on the MasOrange 5G network. The agreement includes a significant enhancement of 5G coverage, an extensive deployment of 5G antennas and a 5G antennas, a large deployment of 5G antennas Massive MIMO TD’ (Multiple Input Multiple Output and Time Division Duplexing) (press note available in Spanish only here). 

Art. 14.2 of the 28 June  General Telecommunications Act 11/2022   says that 5G network operators, like any other operator, must make interconnection agreements with other operators that request such agreements, and the regulator CNMC has an arbitrator rule. 

The Ministry can also impose passive network sharing obligations when it is unavoidable and there is no alternative and under reasonable and just conditions (art. 92 Law 11/2022). This applies mostly to the building and sharing of towers in difficult locations. 

The regulator CNMC supports subsidies for passive infrastructure for high-speed broadband services in unprofitable areas 20 . 

In Spain there is a Royal Decree-Law 7/2022, of 29 March, on requisites to guarantee the security of networks and services for 5G electronic communications. 

The Cyber Resilience Act (CRA Regulation (EU) 2024/2847, of 23 October) introduces EU-wide cybersecurity requirements for the design, development, production and making available on the market of hardware and software products 21 21  . 

On 20 November 2024 the CRA was published in the Official Journal of the EU (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402847). The CRA defines: 

• Rules for placing on the market of products with digital elements through a process of conformity assessment (self-assessment or third-party conformity assessment, depending on the category of the product) to demonstrate fulfilment of specific cybersecurity requirements, resulting in attribution of a CE marking, and
• Requirements for the design, development and production of such products and stipulations on economic operators, as well as processes put in place and reporting obligations for manufacturers to ensure cybersecurity throughout the life cycle of such products, as well as economic operator obligations in these processes. 

In Spain the UNICO 5G Cybersecurity Program calls for the creation of a public center to ensure compliance with the requirements, including certification, derived from the 5G Cybersecurity Act, which in turn implements the European Union Toolbox for 5G Network Security (https://espanadigital.gob.es/en/lines-action/unico-5g-cybersecurity). 

The 5G reference operations centre, funded in part by the Transformation, Recovery and Resilience Plan, with the following tasks:

• Acquiring 5G cybersecurity skills or monitor and ensure that the security measures in the Security Scheme are implemented
• Determining the critical nature of 5G infrastructure elements
• Developing improvement proposals to increase monitoring and defence in 5G networks
• Develop R&D capabilities in terms of security

This Operations Centre shall, as far as possible, provide an adequate response capability to 5G cybersecurity incidents and provide support and assistance to the different actors involved. Actors bound by this Regulation may also establish 5G Security Operations Centres (https://www.telefonica.com/en/communication-room/blog/5g-national-security-framework-boosting-network-security/). 

At EU level, eleven EU countries have taken 5G security measures to impose restrictions on high-risk telecommunications suppliers such as Huawei and ZTE 22 , in a move that the European Commission had previously said  was fully justified 23  and was similar to measures taken in 2023 24 . The other 16 EU countries haven’t imposed such restrictions. 

On 12 November 2024, Henna Virkkunen, the incoming European Commissioner for Tech Sovereignty, Security and Democracy, during her confirmation hearing, declared herself dissatisfied with the fact that some national governments haven’t excluded so-called high-risk telecom infrastructure companies – China’s Huawei and ZTE – from critical infrastructure.  (New EU tech chief to discuss 5G security measures with national governments | Euronews). 

Spain is one of the largest European countries (together with Germany, Italy, Poland, Portugal and Austria) purchasing significant amounts of 5G equipment from Chinese vendors (see Strand Consult´s  “The Market for 5G RAN in Europe: Share of Chinese and Non-Chinese Vendors in 31 European Countries” report, mentioned here). 

In December 2022, a reported 38% of the Spanish 5G network was based on Huawei equipment 25 .

Spanish security agencies have approved some Huawei equipment: for instance, Decision 1A0/38132/2020, of 20 May 2020, of the Spanish National Cryptologic Centre (CCN-CERT) certified the security of the Huawei 5900 Series 5G gNodeB Software V100R015C00SPC108 product.

With one exception (the Programa ÚNICO 5G Redes Activas), the Spanish government hasn’t adopted measures to assess risk associated with 5G suppliers (as it is supposed to do according to art. 22 of the Royal Decree-Law 7/2022 of 29 March, on 5G security). Based on statements by the Minister for Digital Transformation and the Civil Service (available in Spanish only here) there is no  plan to issue a list of high-risk providers and  there are no European regulations that require adoption of such a list. 

On 12 July 2024 Spain’s Department of National Security mentioned that Germany reached an agreement with Huawei and ZTE from the German 5G mobile core network (available in Spanish only here), with telecoms operators planning to gradually exclude components from Chinese companies. 

In 2024 the National Security Framework (NSF) for 5G networks and services was enacted and published (Royal Decree 443/2024 of 30 April). The NSF provides that the Government, by means of an agreement adopted by the Council of Ministers, may classify certain 5G suppliers as high risk (art. 15), but this provision has not been applied (with one exception below). 

The EU is pressing Spain to approve a new 5G cybersecurity act establishing criteria in order to identify high-risk suppliers 26 . 

The only exception so far has been the Programa UNICO 5G Redes Activas, with subsidies for rural deployment of SA 5G amounting to more than EUR 1 bn (USD 1.05bn).  Operators using Huawei and ZTE (or other high-risk company, even in the absence of a list) equipment, components, system integrations and software were excluded, per the EU 5G Cybersecurity Toolbox 27 . 

As a result of the above, Huawei has filed a judicial appeal against the decision to exclude its clients from the Programa Unico 5G Redes Activas, arguing that it is not a high-risk supplier. The judicial procedure is now starting 28 . 

 Standardization of 6G isn’t finished yet, and is being made in two different levels 29 : ITU (which is critical for access to a large set of frequency bands, called IMT) and 3GPP (a private organization). 

ITU has denominated future 6G future standards “IMT-2030”, and has established 2030 as the target for commercialization of the first 6G services. According to Ericsson (ibidem), the planned calendar is the following: 

China has submitted proposals to ITU. These proposals address three critical issues regarding 6G standardization 30 .

Regarding 3GPP, the task of  6G standard approval will be performed through traditional releases: the standards will be included in Releases19 31  to 21, with the aim of allowing 6G commercialization by 2030, as is the case with ITU. This is the expected timeline, according to Ericsson:

 In Spain, the central government is offering grants, financed by the European NextGenerationEU funds of the Recovery Plan that aims to strengthen the R&D ecosystem around the next generation of mobile technology by fostering public-private collaboration (Source: here).