It's legal in Spain, as long as you are 18 or over. If you're not in Spain, watch out! There's a long history of people all over the world receiving letters inviting them to buy tickets in El Gordo and assuring them that the sender of the letter is an official agent. The reality is that no legal Spanish lottery, and no agent of a legal Spanish online lottery, will ever send such a letter – or email, or WhatsApp notification, or text message, or any other kind of communication – to someone outside Spain.
Why not? Because El Gordo, in common with all other legal Spanish lotteries, is only open to Spanish residents. You don't have to be a citizen, but you do have to live there. And not on holiday – Spain must be your permanent residence. As long as you meet that requirement, yes, El Gordo is entirely is entirely legal.
Scams are becoming reasonably frequent in connection with El Gordo. One that has been reported with increasing frequency takes the form of a letter or, more often, an email, advising the recipient that the sender – purporting to be a legal, authorized agent of the Spanish national lotteries – bought a ticket in El Gordo for the recipient (wasn't that kind?) and – great news! – the ticket has won!
All the recipient has to do is send his or her bank details and the money will be deposited to their account. The very generous sender of this communication will only retain 10% of the winnings to cover their costs. You should treat one of these emails or letters exactly as you treat any other request for information about your bank account: ignore it.
Having said all that, it is not impossible for someone who is not resident in Spain but is determined to have a flutter on El Gordo. There are websites that set up addresses making them resident in countries that are not actually where they live.
Selecting the right website is important, because if you don't then you might as well have responded to one of those scams we just talked about – and, in fact, that's exactly what you have done. But make the right choice and you will find you're dealing with an organization that has integrity, that really will invest your money on your behalf, and really will share your winnings with you.