Checking in to a hotel or holiday let in Spain: why you are asked for so much data

You are on the train from the airport, two bars of signal, when the message arrives: "Please complete your online check-in before arrival." Ten fields in, the form wants your passport scanned, a selfie and something called a "número de soporte" that you have never heard of. Relax: most of it is the law talking, and the rest you can politely decline. Spanish law requires every hotel, holiday let, campsite and private host to record the details of each guest and send them to the police within 24 hours of arrival. Your host has no choice in the matter, and Spaniards on holiday in their own country fill in exactly the same form.

The 30-second version

• Document type: choose Passport. If you hold a non-Spanish ID card, choose Other.
• Número de soporte: leave it blank. It only exists on Spanish ID cards. Stuck? See the fix.
• Passport photo or selfie: the law asks for neither. You can ask to skip them.
• Tourist tax: genuine in Catalonia, the Balearic Islands, Santiago de Compostela, A Coruña and Vigo. Check the amount.
• The link itself: open it from your booking platform or your host's known email, never from a message out of the blue. How to tell.

What will the online check-in ask for?

Your identity, a way to contact you and the facts of your booking, plus whatever extras your host has switched on. The link may come from your host, from a hotel app or from the booking platform itself: Booking.com runs its own online check-in, and until December 2026 Airbnb is piloting a service in Spain with Chekin, a Spanish check-in provider. Whichever you get, Chekin, Partee or a hotel system such as Mews, the screens follow a familiar order:

1. Your details: name, date of birth, home address, phone or email.
2. Your document: type and number, often filled in for you when the camera reads the two lines of characters at the bottom of your passport's photo page.
3. A photo of the document or a selfie, if your host has turned them on.
4. A signature, drawn with your finger on the screen.
5. A payment step: the tourist tax where it applies, sometimes a deposit or an upgrade.

Here is how each request stands in law:

What every guest must give at check-in in Spain, and what you can say no to.Download image

Stuck on the "número de soporte"?

Choose "Passport" as your document type and leave the field blank. The support number is the serial number of the plastic card itself, printed on the Spanish identity card (the DNI) and on the residence card that foreigners living in Spain carry. Think of your bank account number and the long number on your debit card: replace the card and the second one changes while the first stays put. Passports have no equivalent, and the Ministry of the Interior's system only makes the field compulsory when the document is a Spanish identity or residence card.

On your phone, right now:

1. In "Document type" or "Tipo de documento", pick Passport ("Pasaporte"). On a non-Spanish ID card, pick Other ("Otro").
2. Type your passport number exactly as printed on the photo page.
3. Leave "Número de soporte" or "Support number" empty. Many forms hide it once you pick Passport.
4. If the form still refuses to move on, stop there. Inventing a number puts false data on a police record, and your host can finish the registration with what you have already entered.

Then send your host this message through the booking platform. The Spanish version is there for hosts who are more at home in Spanish than in English:

What can you refuse?

The extras. The registration itself is a legal duty, and a host may turn you away if you will not give the data the law requires, as Airbnb points out in its guidance for Spain.

The photo of your passport is the first extra. Spain's data protection authority, the AEPD, told hosts in a note of June 2025 that they should not ask for a copy of your identity document at all. A copy carries far more than the police register needs, your photograph for a start, and it is exactly what an identity thief would want. The AEPD suggests gentler ways to confirm who you are online, such as matching your name against the card you paid with or sending a code to your phone. It has fined a four-star hotel in Girona for scanning a guest's identity card, and a hotel in Mallorca that scanned the passports of Dutch guests saw its €30,000 fine halved on appeal and upheld. Check-in software leaves the choice to the host: Partee lets hosts switch document photos off and says plainly that the law does not require them.

The selfie is the second. A face matched against your passport photo is biometric data, one of the special categories that the GDPR, the EU's data protection regulation, protects most strictly. Using it to confirm your identity generally needs your explicit consent, and consent only counts if you have a real alternative. Chekin's selfie check is a feature the host switches on and can make optional.

If you would rather keep both to yourself, this message usually does it, in English or in Spanish. Offering to show your passport in person works because the AEPD lists it as a valid check: whoever lets you in compares the form with your document and hands it straight back.

Why is my host charging me a tourist tax?

Because in the places that charge one, the law makes your host collect it from you and pay it to the tax office. Spaniards call it the tasa turística, the tourist tax. The business running your accommodation acts as the "sustituto del contribuyente", the legal stand-in that collects the tax from guests and answers for it to the tax authority. That is why the request often appears at the end of the online check-in: Chekin, for one, calculates and charges it there.

Tourist tax per person in Spain, October 2026. Cruise rates excluded.Download image

Checking the figure takes ten seconds: rate × paying guests × nights, up to the cap. Two adults in a four-star hotel in Barcelona for three nights pay €8.40 × 2 × 3, which is €50.40. A couple with a ten-year-old in a holiday flat in Mallorca for a week in August pay €2 × 2 × 7, which is €28, and the child pays nothing. The same week in November costs €7, because of the low-season discount.

Anywhere else in Spain, a tax on your stay should make you ask questions. The Basque Country has approved a tax that its towns, San Sebastián among them, will collect from 1 January 2027. The Valencia region scrapped its tax in 2023 before it was ever charged, and Andalusia, home to Seville and Málaga, has none. Two small footnotes: some Catalan towns may add up to €4 a night from October 2026 if they have passed their own bylaw, and Mogán, in Gran Canaria, still charges €0.15 a night while it appeals a court ruling that annulled the fee.

Is this check-in link genuine?

Judge a message by where it came from. In July 2026 INCIBE, Spain's national cybersecurity institute, warned that fraudsters were posing as hotels on WhatsApp and by email, quoting real booking details down to the reservation number, to lure guests to fake pages that harvest personal and payment data. A message that knows your dates proves nothing.

Signs you can relax:

• the link arrives in your booking platform's message thread or from the email your host has used before. Booking.com only displays links the property has approved, and its own example of one is an online check-in tool;
• the form asks for the data in the infographic above and nothing stranger;
• any payment is the tourist tax, it matches your sums, or it is a deposit the listing mentioned.

Signs to stop and ask your host through the platform:

• the message comes from a number you do not recognise, however friendly;
• it says your booking will be cancelled unless you act in the next few hours;
• it asks you to "confirm" or re-enter your card to keep the reservation;
• it pushes you to pay outside the platform.

Where does your data go?

To the police database, and to your host's register for three years if your host is a business. In most of Spain the host sends your details to the Ministry of the Interior through its SES.HOSPEDAJES platform. In Catalonia they go to the Mossos d'Esquadra and in the Basque Country to the Ertzaintza, the regional police forces. Hotels and other professional hosts must keep the register for three years after you leave, while a private individual letting a room only has to send it.

The check-in platform normally works on your host's behalf as a processor, which leaves your host responsible for what happens to your data. Processors can be fined in their own right too, as in the Miljödata case, where Sweden's regulator fined a software supplier after an attack on the systems it ran for its customers. Chekin says it deletes document images straight after verification. If an image of yours has been kept, you can ask the host what it holds and ask for the image to be deleted, although the registration data itself must stay in the register. If you get no straight answer, you can complain to the AEPD. And if spotting this kind of thing appeals to you, The Inspector, our free GDPR game, puts you in a startup's office with sixteen objects and asks you to find the eight that break the rules.

Why does Spain do this at all?

Because when Europe took down its internal borders, the hotel reception desk inherited part of the border post's job. Spanish hotels were filing guest cards with the police long before online booking, and in 1990 the Schengen countries made the practice common ground. To make up for the checkpoints they were removing, they agreed in Article 45 of their implementing convention that accommodation managers would have foreign guests fill in and sign a registration form and prove their identity, with the forms kept for the police to prevent threats, investigate crimes and trace missing people. Ireland, which stays outside Schengen, is not bound by that article, and the UK left the EU in 2020. Neither point changes your check-in, because Spain's own rule covers every guest, its own citizens included.

That rule is the Real Decreto 933/2021 (the Spanish regulation that sets what every accommodation provider must record about its guests and when to send it to the police). It added booking platforms, private hosts and the details of how each stay was paid. After several grace periods the Ministry of the Interior switched on its online platform on 2 December 2024, the change British coverage has labelled the new "Spain tourist registration rules".

Is Brussels about to scrap it?

Possibly in part, and none of it changes what you do this week. On 4 June 2026 the European Commission sent Spain a letter of formal notice, the first step of an infringement procedure, under the EU rules on how police may use personal data. It considers the data collected excessive, payment details included, police access too loosely defined and three years of storage disproportionate. The Ministry of the Interior has reportedly put on hold the order that was meant to flesh out the decree, but the decree itself stays fully in force while the procedure runs. If the Commission gets its way, expect shorter forms and shorter storage. Until then, your host still has to send your details and you still have to give them.

Frequently asked questions

Do I have to give my passport number to an Airbnb host in Spain?

Yes. Private hosts have the same registration duty as hotels, and Airbnb accepts that a host may refuse a guest who will not provide the required data. Give it through Airbnb or the check-in link your host shares there.

What is the número de soporte on a passport?

There is none. The support number exists only on Spanish identity and residence cards, so choose "Passport" as your document type and leave the field blank. If the form still blocks you, message your host.

Can my host keep a copy of my passport?

Your host should not ask for one. Spain's data protection authority says the register only needs the details in the form, so you can ask to type them in or show your passport on arrival.

Do I have to take a selfie to check in?

No Spanish law requires one. A selfie match is an optional feature some check-in platforms offer, and because it uses biometric data you can ask your host for another way to confirm your identity.

Do children need to be registered?

Yes, and the adult travelling with them gives their details. The form also asks how each child is related to the adults in the group, and anyone aged 14 or over signs their own registration.

Why does my host want the check-in done before I arrive?

Because the law gives your host only 24 hours from the start of your stay to send your details to the police. Properties with self check-in or key boxes need the data before you turn up, since nobody will be at the door to take it.