Geolocation and Stalkerware Against a Partner: Defence Lawyers (Arts. 197 and 197 ter CP)
Criminal defence in cases involving the installation of control, tracking or spying applications on a partner's phone without consent, with overlap with gender-based violence and the offence of stalking.
Installing a monitoring, geolocation, or message-reading app (stalkerware) on a partner's phone without their consent falls under the offence of discovery and disclosure of secrets under Article 197.1 of the Spanish Criminal Code (CP), with imprisonment of 1 to 4 years and a fine of 12 to 24 months; if the data obtained is disseminated or transferred to third parties, the penalty rises to imprisonment of 2 to 5 years (Art. 197.3 CP). Article 197 ter CP separately punishes, with imprisonment of 6 months to 2 years or a fine of 3 to 18 months, anyone who produces, acquires, or supplies to third parties the spyware program itself or the access passwords, extending the line of protection to whoever provides the tool. Spying on a partner's phone is rarely an isolated act: in the context of gender-based violence it typically triggers the jurisdiction of the Violence against Women Sections of the Tribunal de Instancia, and when the surveillance is persistent it may concur with the offence of stalking under Art. 172 ter CP. At Alonso Sala we examine the computer forensic evidence, the chain of custody of the device, and whether genuine consent or a legitimate use for parental control actually existed.
What conduct Arts. 197 and 197 ter CP punish
Installing control, geolocation or message-reading applications on a partner's phone without their consent —the phenomenon known as stalkerware— falls squarely within the offence of discovery and disclosure of secrets under article 197 of the Spanish Criminal Code. Article 197.1 CP punishes anyone who, in order to discover the secrets or breach the privacy of another and without their consent, seizes their papers, letters, e-mail messages or any other personal documents or effects, intercepts their telecommunications, or uses technical devices to listen to, transmit, record or reproduce sound or images, or any other communication signal. Installing an app that forwards WhatsApp messages, logs calls, captures screenshots or transmits the device's GPS position in real time fits fully within this conduct.
Article 197.2 CP extends protection to anyone who, without authorisation, seizes, uses or alters, to the detriment of a third party, reserved personal data recorded in files or on computer media. For its part, the article 197 ter CP separately sanctions the preparatory stage: it punishes anyone who, without due authorisation, produces, acquires for their own use, imports or in any way facilitates to third parties a computer program designed or adapted mainly to commit these offences, or a password, access code or similar data allowing access to an information system. In other words, the legislator brings the protective threshold forward and pursues whoever supplies the tools, not only whoever uses them.
Applicable penalties and aggravating factors
The basic offence under article 197.1 CP is punishable by imprisonment of one to four years and a fine of twelve to twenty-four months. If the offender disseminates, discloses or transfers the obtained data or images to third parties, article 197.3 CP provides for an autonomous penalty of imprisonment of two to five years. Article 197.5 CP is particularly relevant: where the conduct affects data revealing ideology, religion, beliefs, health, racial origin or sexual life, or the victim is a minor or a person with a disability requiring special protection, the penalties are imposed in their upper half; and article 197.4 provides for additional aggravations relating to the offender's status (those in charge of the files) or to the unauthorised use of the data. The article 197 ter CP, in turn, provides for imprisonment of six months to two years or a fine of three to eighteen months. Where the offence is committed through a legal entity, article 197 quinquies CP allows a fine of six months to two years to be imposed on it.
Overlap with gender-based violence and stalking
Spying on a partner's phone rarely appears in isolation. In contexts of gender-based or domestic violence, geolocation and the monitoring of communications are often the instrument of a pattern of control, which may trigger the jurisdiction of the Violence against Women Sections of the Tribunal de Instancia and aggravate the criminal response. Where surveillance is persistent and seriously disrupts the victim's daily life, the offence of stalking under article 172 ter CP may also apply, punishing repeated surveillance, pursuit or seeking of physical proximity. For more on these related offences, see our pages on harassment and stalking (art. 172 ter CP) and on illegal access to data and computer systems.
Elements of the offence and lines of defence
The prosecution must establish the absence of consent of the device's owner, the intent to discover secrets or breach privacy, and the authorship of the installation or use of the software. In many proceedings the critical point is the computer forensic evidence: how the device was obtained, whether the chain of custody was respected, whether the forensic image is reliable and whether the detected software was actually installed by the accused. The defence may dispute the existence of prior consent, the shared ownership of the device or account, the absence of intrusive purpose in legitimate parental control or family-location tools, or the nullity of evidence obtained in breach of fundamental rights.
How to act and our intervention
Whether you are under investigation or have suffered this type of surveillance, the early intervention of a criminal lawyer is decisive. We analyse the police report, the expert evidence and the digital proof, assess the legal classification and design the most appropriate procedural strategy. Our firm, located at Velázquez 27, Madrid, offers specialist criminal defence in offences against privacy. You can contact us on 91 078 65 74 for an assessment of your case.
Penalties & Consequences
| Type / Scenario | Criminal Penalty |
|---|---|
| Basic offence (art. 197.1 CP) | Imprisonment of one to four years and a fine of twelve to twenty-four months for seizing messages, intercepting telecommunications or capturing images or sound from a partner's phone without consent. |
| Dissemination and aggravations (arts. 197.3 and 197.5 CP) | Disseminating, disclosing or transferring the obtained data to third parties is punishable by imprisonment of two to five years (art. 197.3); and the penalties are imposed in their upper half if they affect sensitive data or the victim is a minor or a person with a disability requiring special protection (art. 197.5). |
| Facilitating programs (art. 197 ter CP) | Imprisonment of six months to two years or a fine of three to eighteen months for anyone who produces, acquires or facilitates to third parties spyware or access passwords to commit these offences. |
* Penalties shown are indicative. The actual penalty depends on case circumstances, applicable mitigating and aggravating factors.
Our Defense Strategy
Analysis of the computer forensic evidence
We review the forensic image of the device, the chain of custody and the reliability of the expert report to detect irregularities that may invalidate the proof of the spyware.
Examination of consent and ownership
We examine whether prior consent existed, whether the device or account was jointly owned and whether the tool had a legitimate family-control purpose, as opposed to an intrusive use of privacy.
Defence against aggravating factors and concurrences
We assess the application of arts. 197.3 and 197.5 CP, the possible overlap with gender-based violence and the stalking offence under art. 172 ter CP, and put forward the most favourable classification and the applicable concurrences.
Privacy Crimes in Spain: Discovery & Disclosure of Secrets — Defence Guide
Privacy crimes — discovery and disclosure of secrets (Art. 197 CP), illegal access to computer systems (Art. 197 bis), and non-consensual image sharing (Art. 197.7) — are among the fastest-growing offences in Spain. The digital environment has made private communications, intimate images and personal data especially vulnerable. These offences carry prison sentences of up to 5 years and require specialised technical defence combining legal expertise with digital forensics.
Penalty Table: Privacy Crimes
| Offence | Article | Description | Penalty |
|---|---|---|---|
| Discovery of secrets (basic) | Art. 197.1 | Seizing letters, emails, or intercepting telecommunications | 1 – 4 years prison |
| Disclosure to third parties | Art. 197.3 | Revealing or transferring discovered secrets | 2 – 5 years prison |
| Sensitive data (health, sexuality, ideology) | Art. 197.5 | Discovery/disclosure involving specially protected data | 3 – 5 years prison |
| Illegal access to computer systems | Art. 197 bis | Unauthorised access breaching security measures | 6 months – 2 years |
| Non-consensual image sharing (sexting) | Art. 197.7 | Sharing intimate images obtained with consent | 3 months – 1 year |
| Professional perpetrator | Art. 197.4 | Crime committed by person in charge of data files | Upper half + disqualification |
Key Defence Strategies
Consent Defence
If the victim gave express consent to access their communications or devices, the crime is excluded. The defence must prove that consent was freely given, specific and not obtained through deception.
Fruit of the Poisonous Tree
If the prosecution's evidence was obtained through illegal means (hacked WhatsApp, unauthorised wiretap), it is inadmissible under Art. 11.1 LOPJ. Challenging the chain of custody is critical.
Lack of Criminal Intent (Dolo)
If the access was accidental or by mistake (opening someone else's email by confusion, finding an unlocked phone), there is no criminal intent. The prosecution must prove the accused acted knowingly.
Whistleblowing Protection
EU Whistleblowing Directive (2019/1937) protects employees who report illegal activity through proper channels. Revealing secrets to expose crime may be justified, though procedure matters.
IP Attribution Challenge
An IP address alone may not identify the perpetrator. Shared connections (Wi-Fi, VPN, corporate networks) create reasonable doubt about who actually accessed the data.
Statute of Limitations
Basic privacy crimes prescribe in 5 years. Digital evidence is volatile — logs, IPs and server records may be deleted. Early action by both prosecution and defence is essential.
Key Case Law
The Supreme Court confirmed that accessing a partner's unlocked phone constitutes the crime of Art. 197.1 CP. The absence of a password does not imply consent. Privacy is presumed regardless of security measures.
Following the European Court of Human Rights case law on employer monitoring of employee communications, the Court ruled that such monitoring requires prior, clear policy notification. Without it, evidence is inadmissible and the employer may face criminal liability.
Clarified that Art. 197.7 requires images obtained WITH victim's consent (within a relationship) and shared WITHOUT consent. Images obtained covertly constitute a different offence (Art. 197.1).
Why Choose Us?
Need a criminal defense lawyer for this type of offense? Here's how we work:
Need urgent criminal defence?
Contact our specialist criminal defence lawyers. We evaluate your case confidentially.
Tools for your case
We also serve
View all locations →This page is for information purposes only and does not constitute legal advice: every case requires individual assessment. How this content is produced and verified: editorial policy.
Do you need specialised legal assistance?
The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.