A bomb disposal team was only 15 metres away when the small device exploded, media reported.
Poor weather meant there were few people on the Noja beach but a police call to evacuate the area sent tourists running, blocking the road out of town to the city of Bilbao, media said.
The third explosion was next to a Red Cross post in Laredo, close to where the first device went off, officials said.
A woman was slightly injured when she was hit by a rock sent flying by the fourth explosion on a golf course at Noja.
A pregnant woman was treated for shock after the bomb exploded while she ate lunch nearby, a government official said.
Early on Sunday a small blast occurred outside a bank in the town of Getxo, damaging a cash dispenser and breaking windows.
ZAPATERO AND ETA
ETA (Euskadi ta Askatasuna, or Basque Country and Freedom), usually gives a warning before attacking civilian targets. It does not warn of attacks on police, politicians or officials.
The group is listed as a terrorist organisation by Spain, the United States and the European Union. It has killed more than 800 people since 1968, usually with car bombs or shootings.
Zapatero has ruled out further peace talks and says the guerrillas' only option is a unilateral surrender.
Spain's conservative Popular Party opposition has questioned Zapatero's will to force ETA to lay down arms and says he still toys with the idea of resuming the peace process.
"We'll always support the government in its fight against terrorism so long as its aim is - as I presume it is - to defeat the organization," said Popular Party leader Mariano Rajoy on Sunday.
The Cantabria blasts were the first attributed to ETA since May 14 when the separatists exploded a bomb without warning at the Civil Guard barracks in Legutiano, killing policeman Juan Manuel Pinuel-Villalon and injuring 4 others.
Later that month, police in southwest France arrested Francisco Javier Lopez Pena and three other ETA chiefs.

