> ## Documentation Index
> Fetch the complete documentation index at: https://docs.botbrains.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Cold Calling Laws in Bulgaria

> Is AI cold calling legal in Bulgaria? Art. 261 of the Electronic Communications Act requires consent for marketing calls to consumers. No do-not-call list.

export const reviewed_0 = "October 2026"

In Bulgaria, an AI agent may only make marketing calls to consumers who agreed to them beforehand. The rule is Art. 261(1) of the Electronic Communications Act (Закон за електронните съобщения, ZES), and it covers calls with or without human intervention. A sales rep needs the same consent as your AI agent. Calls to companies fall outside that rule, and Bulgaria has no do-not-call register for phone numbers.

<Note>
  This page summarizes the law as of {reviewed_0} to help you plan AI phone calls. It isn't legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.
</Note>

## At a glance

| Call | To consumers (B2C) | To businesses (B2B) |
| - | - | - |
| Inbound service call | <Icon icon="circle-check" color="#16a34a" /> Allowed. Disclose the AI and the recording. | <Icon icon="circle-check" color="#16a34a" /> Allowed. Disclose the AI and the recording. |
| Outbound service call | <Icon icon="circle-check" color="#16a34a" /> Allowed | <Icon icon="circle-check" color="#16a34a" /> Allowed |
| Marketing callback the person asked for | <Icon icon="circle-check" color="#16a34a" /> Allowed. Keep proof of the request. | <Icon icon="circle-check" color="#16a34a" /> Allowed |
| Marketing call by an AI agent to existing customers | <Icon icon="circle-dashed" color="#6b7280" /> Unclear. The customer exception names messages, not calls. Get consent. | <Icon icon="circle-check" color="#16a34a" /> Allowed. Respect objections. |
| Cold marketing call by an AI agent | <Icon icon="signature" color="#d97706" /> Consent required | <Icon icon="circle-check" color="#16a34a" /> Allowed. Respect objections. |
| Marketing call by a human to existing customers | <Icon icon="circle-dashed" color="#6b7280" /> Unclear. The customer exception names messages, not calls. Get consent. | <Icon icon="circle-check" color="#16a34a" /> Allowed. Respect objections. |
| Cold marketing call by a human | <Icon icon="signature" color="#d97706" /> Consent required | <Icon icon="circle-check" color="#16a34a" /> Allowed. Respect objections. |

## Is AI cold calling legal in Bulgaria?

Only with prior consent when you call consumers. Art. 261(1) ZES allows marketing calls `със или без човешка намеса` (with or without human intervention) only `при предварително получено съгласие на потребителя` (with the consumer's prior consent), which they can withdraw at any time.

**AI or human, the rule is the same.** EU law ([Directive 2002/58/EC, Art. 13](https://eur-lex.europa.eu/eli/dir/2002/58/oj)) only requires consent for "automated calling systems without human intervention." Bulgaria covers every marketing call, so it doesn't matter whether your AI agent counts as automated or a human supervises it.

**Businesses aren't covered.** Since an amendment in 2021, a "consumer" in the act is a natural person who uses the phone outside their trade or profession (§1 item 49 of the Additional Provisions). Read literally, Art. 261(1) doesn't protect companies or professionals at work, and a [May 2026 law firm guide](https://www.linklaters.com/en/insights/data-protected/data-protected---bulgaria) agrees. No regulator has confirmed this, and it's unclear how Art. 257(9) ZES, which lets phone operators carry marketing calls only with their end user's written consent, affects callers.

**GDPR still applies to B2B calls.** Legitimate interest can cover them ([GDPR Recital 47](https://eur-lex.europa.eu/eli/reg/2016/679/oj)), but stop when the person objects (Art. 21(3)). A sole trader on a private mobile may count as a consumer, so get consent when you can't tell.

## Cold calls by a human

The same rule applies: consent for consumers, none for businesses, and honor every objection. Persistent, unsolicited sales calls to consumers are also an aggressive practice under Art. 68к item 3 of the Consumer Protection Act (Закон за защита на потребителите, CPA).

## Existing customers and callback requests

**Existing customers.** Art. 261(2) ZES lets you market your own similar products to customers whose contact details you got in a sale. They must be able to refuse for free at that point and later, and you must honor every refusal (Art. 261(4)). Whether this exception covers calls remains open:

* Art. 261(1) lists calls (`повиквания`), messages (`съобщения`), and email as distinct channels, but Art. 261(2) only allows `изпращане на съобщение` (sending a message).
* The CRC's [General Requirements](https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=166529) for telecom operators (Art. 27) treat such a message as something the recipient's device can store, like an SMS or email.
* On the other hand, the act defines a message as any information exchanged through a public electronic communications service (§1 item 68), and a call carries such information. The [May 2026 law firm guide](https://www.linklaters.com/en/insights/data-protected/data-protected---bulgaria) says phone marketing gets the same exemptions as email.
* A [Bulgarian law firm guide from August 2026](https://gdprbg.com/blog/spam-imejli-sms-i-gdpr.html) calls the point disputed. We found no CRC, CPDP, or court decision on it.

Get consent before your AI agent or a human calls existing consumers with offers.

**Callback requests.** A person who asks for a callback has consented to that call. Keep proof, and stay on the topic they asked about. If you call for a partner, the consent must name that partner.

## Do-not-call register: None for phone numbers

Bulgaria has no do-not-call register for phone numbers. The Commission for Consumer Protection (KZP) keeps a [register of company email addresses](https://kzp.bg/bg/elektronno-podavane-na-zayavlenie) that refuse unsolicited commercial messages (Art. 6 of the Electronic Commerce Act), but it doesn't cover phones. For consumers you need consent anyway. For businesses, keep your own list of everyone who objected and check it before each call.

## Consent for AI calls

Consent must be voluntary, specific, informed, and unambiguous ([GDPR Art. 4(11) and Art. 7](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). It should name your company and every partner that relies on it, say that an AI agent may call, state the purpose, and explain how to withdraw.

**You carry the burden of proof** (GDPR Art. 7(1)). Store the consent text, form version, phone number, and timestamp per contact. We found no Bulgarian retention period for consent records, so keep the proof as long as you rely on the consent.

**Purchased lists are risky.** The [EDPB consent guidelines](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) require that the consent names every company relying on it. Ask any data vendor for the exact consent text, the collection method, and the evidence. botBrains asks for this evidence too, see [Before you start outbound campaigns](/concepts/phone/countries#before-you-start-outbound-campaigns).

## Tell callers they're talking to an AI

Since August 2, 2026, [Article 50 of the EU AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#art_50) requires that people know they're talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can't count on the exception for obvious cases when your AI agent sounds human. The [default introduction](/concepts/phone#introductions) already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the [Consumer Rights Directive](https://eur-lex.europa.eu/eli/dir/2011/83/oj/eng) also requires you to name your company, anyone you call for, and the commercial purpose at the start.

Under Art. 49(6) CPA, when you call a consumer to conclude a contract, state at the start your company name, the company you call for if any, and the commercial purpose. For financial services, Art. 59в(3) CPA also requires you to say if you record or may record the call.

For outbound marketing calls, replace the bracketed purpose with your own:

```text theme={null}
Здравейте, обажда се {agent_name} от {project_name}. Аз съм изкуствен интелект. Обаждам се във връзка с [цел на обаждането]. Разговорът се записва. Можете по всяко време да натиснете звездичката, за да възразите срещу записа. Ако не желаете повече обаждания от нас, просто ми кажете.
```

For inbound calls:

```text theme={null}
Здравейте, аз съм {agent_name} от {project_name}. Аз съм изкуствен интелект. Разговорът се записва. Можете по всяко време да натиснете звездичката, за да възразите срещу записа. С какво мога да Ви помогна?
```

[Guidance](/concepts/guidance) tells your AI agent how to handle "don't call me again," and a [Unitool](/concepts/unitools) can write the objection to your CRM.

## Call recording

**Recording your own calls isn't a crime.** Art. 246(1) ZES and Art. 171(3) of the Criminal Code only target recording or interception by someone outside the call. Your company is a party.

**GDPR sets the conditions.** You need a lawful basis, usually legitimate interest or the contract, and a notice at the start ([GDPR Art. 6 and Art. 13](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Consent isn't required. For recordings that prove a sale, Art. 247 ZES asks you to announce the recording, its purpose, the retention period, and the right to refuse. A star-key objection covers the last point.

**Voice isn't automatically biometric data.** It becomes biometric data only when you process it to identify someone ([GDPR Art. 4(14) and Art. 9](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Recording for quality doesn't do that.

In botBrains, pressing the star key stops the recording and discards it, and the transcript stays. botBrains stores recordings, transcripts, and call data in the EU.

## Caller ID and calling hours

We found no Bulgarian rule on marketing prefixes or calling hours. Show a real number anyway, since Art. 261(5) ZES bans marketing messages that don't identify the sender. The caller sees your botBrains number, and botBrains provisions Bulgarian numbers on request.

Call at reasonable hours and don't keep calling the same person (Art. 68к CPA). botBrains starts outbound calls one at a time with **Dial** or through the API and doesn't enforce calling hours or screen lists, so you handle both. On voicemail, the AI agent hangs up without leaving a message.

## Sector rules

| Situation | Rule |
| - | - |
| Any consumer contract by phone | Confirm the offer on a durable medium. It binds the consumer only after they sign or accept in writing (Art. 49(7) and Art. 54а CPA), so your AI agent can't close a binding sale on the call. |
| Electricity, gas, or district heating | If supply should start within the 14-day withdrawal period, the consumer must request it explicitly on a durable medium (Art. 49(9) and Art. 50 CPA). |
| Phone and internet services | Give the consumer a contract summary before the contract. If you send it later, the contract takes effect only when the consumer confirms (Art. 228а ZES). |
| Financial services | Since September 24, 2026, Art. 59б to 59ж CPA add distance-contract rules, including a recording notice at the start of the call. |

## Fines and enforcement

| Breach | Regulator | Maximum fine |
| - | - | - |
| Marketing call to a consumer without consent | Communications Regulation Commission (CRC) | BGN 5,000, about EUR 2,556 (Art. 335, 336 ZES) |
| Ignoring a refusal from an existing customer | CRC | BGN 10,000, about EUR 5,113 (Art. 340 ZES) |
| Persistent unsolicited calls to consumers | KZP | 4% of Bulgarian turnover, or EUR 50,000 without turnover data (Art. 210б CPA) |
| No identification at the start of a sales call | KZP | EUR 3,000 per case (Art. 204 CPA) |
| No lawful basis, or ignoring an objection | Commission for Personal Data Protection (CPDP) | EUR 20 million or 4% of worldwide turnover (GDPR Art. 83) |
| No AI disclosure | AI Act market surveillance | EUR 15 million or 3% of turnover (AI Act Art. 99(4)) |

The ZES still states fines in leva, converted at the [fixed euro rate of BGN 1.95583](https://trade.ec.europa.eu/access-to-markets/en/news/bulgaria-adopts-euro-1-january-2026). The KZP [refers complaints](https://kzp.bg/bg/potrebiteli/protect/spam) about phone spam to the CRC. We found no published Bulgarian case on AI or robocall campaigns as of October 2026, and no pending bill that would change the consent rule.

## Sources

* Electronic Communications Act (Закон за електронните съобщения), Art. 228а, 246, 247, 257(9), 261, 335, 336, 340, and §1 items 49 and 68 of the Additional Provisions: [lex.bg](https://lex.bg/laws/ldoc/2135553187)
* Consumer Protection Act (Закон за защита на потребителите), Art. 49, 50, 54а, 59б to 59ж, 68к, 204, and 210б: [lex.bg](https://lex.bg/laws/ldoc/2135513678)
* Electronic Commerce Act (Закон за електронната търговия), Art. 6: [lex.bg](https://lex.bg/laws/ldoc/2135530547)
* Criminal Code (Наказателен кодекс), Art. 171: [lex.bg](https://lex.bg/laws/ldoc/1589654529)
* GDPR, Art. 4, 6, 7, 9, 13, 21, 83, and Recital 47: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
* EU AI Act, Art. 50 and 99: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
* Directive 2002/58/EC on privacy and electronic communications, Art. 13: [EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
* KZP, unsolicited commercial messages: [kzp.bg](https://kzp.bg/bg/potrebiteli/protect/spam)
* KZP, register of company email addresses: [kzp.bg](https://kzp.bg/bg/elektronno-podavane-na-zayavlenie)
* CRC, complaints under the ZES: [crc.bg](https://crc.bg/bg/rubriki/271/jalbi)
* CRC, General Requirements for public electronic communications, Art. 27 (Decision No. 406 of December 2, 2021): [dv.parliament.bg](https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=166529)
* CPDP: [cpdp.bg](https://cpdp.bg/)
* EDPB Guidelines 05/2020 on consent: [edpb.europa.eu](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
* European Commission, Bulgaria adopts the euro: [trade.ec.europa.eu](https://trade.ec.europa.eu/access-to-markets/en/news/bulgaria-adopts-euro-1-january-2026)
* Data Protected: Bulgaria, law firm guide, May 2026: [linklaters.com](https://www.linklaters.com/en/insights/data-protected/data-protected---bulgaria)
* Spam emails, SMS, and calls under GDPR, law firm guide, August 2026: [gdprbg.com](https://gdprbg.com/blog/spam-imejli-sms-i-gdpr.html)

## Next steps

<Columns cols={2}>
  <Card title="Phone integration" icon="phone" href="/concepts/phone">
    Set up your phone line, introductions, and outbound calls.
  </Card>

  <Card title="Calling laws by country" icon="globe" href="/concepts/phone/countries">
    Compare consent rules for AI calls across the EU, the UK, and the US.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.