This page summarizes the law as of October 2026 to help you plan AI phone calls. It isn’t legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.
At a glance
Is AI cold calling legal in Luxembourg?
Only with prior consent when you call a natural person. Article 11 (1) of the 2005 law says that direct marketing with “systèmes automatisés d’appel et de communication sans intervention humaine (automates d’appel)” is only possible toward “l’abonné ou l’utilisateur ayant donné son consentement préalable.” In English: you may only use automated calling systems without human intervention for direct marketing toward a subscriber or user who gave prior consent. Article 11 (3) sets the same rule for every other channel, including calls by a human. The rule protects natural persons only. Article 11 (5) limits both rules to “l’abonné qui est une personne physique,” the subscriber who is a natural person. The subscriber is whoever holds the phone contract (Art. 2 (a)). Article 11 protects a sole trader with a line in their own name, but not a line that a company holds. You usually can’t tell who holds a mobile contract, so treat mobile numbers as personal unless you know otherwise. Consumers get a second layer. Under Art. L. 222-11 (1) of the Consumer Code, a business needs a consumer’s prior consent to contact them by automated calling system, phone, fax, or email. AI or human makes no difference. Luxembourg requires consent for every marketing call to a natural person and for none to company-held lines. So it doesn’t matter whether your AI agent counts as an automated calling system under Art. 13(1) of Directive 2002/58/EC, or whether a human supervises it. We found no guidance from the National Commission for Data Protection (CNPD) and no court decision on AI voice agents. The GDPR still covers business calls. An employee’s name and number are personal data. You can rely on legitimate interest (GDPR Recital 47), but say in the first call where you got the data (Art. 14) and stop when someone objects (Art. 21).Cold calls by a human
The same rules apply. Calls to consumers and sole traders need prior consent under Article 11 (3), so Luxembourg has no opt-out model for natural persons. Calls to lines a company holds don’t need consent, but keep a block list of everyone who objects.Existing customers and callback requests
Existing customers. The customer exception in Article 11 (2) only covers email. Marketing calls to customers who are consumers or sole traders need prior consent, for example a separate checkbox at checkout. Callback requests. A person who asks for a callback has consented to that call. Collect requests through your own channels, such as a landing page for your ads. Say in the form that an AI agent will call, and stick to the topic the person asked about. Service calls. Article 11 only covers direct marketing (“prospection directe”). Appointment reminders, order and support follow-ups, and debt collection don’t need consent, as long as they don’t promote anything. Keep sales offers out of these calls.Do-not-call register: None in Luxembourg
Luxembourg has no do-not-call register for phone calls. Marketing calls to natural persons need consent anyway, so no list could replace it. Subscribers can keep their number out of public directories (Art. 10 of the 2005 law), but that doesn’t change whether you may call. Keep your own block list of everyone who withdraws consent or objects, and check it before every call.Consent for AI calls
Consent must be free, specific, informed, and unambiguous, given by a statement or a clear positive act (CNPD, GDPR Art. 4(11)).
Purchased lists and partners. Consent must name every company that relies on it (European Data Protection Board (EDPB) Guidelines 05/2020). A vendor’s promise isn’t evidence, so ask for the exact consent text, the collection method, and evidence per contact. When you call for a partner, name that partner at the start (Art. L. 222-4 (5) Consumer Code).
Retention. No law sets an expiry date or a retention period. Keep the evidence while you rely on the consent and for as long as someone could bring a claim.
Before your first campaign, botBrains asks for your consent evidence. See before you start outbound campaigns.
Tell callers they’re talking to an AI
Since August 2, 2026, Article 50 of the EU AI Act requires that people know they’re talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can’t count on the exception for obvious cases when your AI agent sounds human. The default introduction already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the Consumer Rights Directive also requires you to name your company, anyone you call for, and the commercial purpose at the start. The Consumer Code adds a rule for sales calls to consumers. At the start, state your identity, the company you call for, and the commercial nature of the call (Art. L. 222-4 (5)). For financial services, state your identity and the commercial purpose (Art. L. 222-15 (1)). People in Luxembourg speak Luxembourgish, French, and German on the phone. Replace the topic placeholder with the purpose the person agreed to. Replace the reason and duration placeholders with why you record and how long you keep recordings, as Art. 4 (3)(d) of the 2005 law requires. Outbound marketing call in Luxembourgish, French, and German:Call recording
Criminal law. Art. 2 of the law of August 11, 1982 punishes anyone who records words that a person speaks in private without that person’s consent. It makes no exception for a party to the call. Keeping or using such a recording is a crime too (Art. 4). Telecom law. Art. 4 (2) of the 2005 law bans storing communications without the user’s consent. Art. 4 (3)(d) makes an exception for recordings that prove a commercial transaction or another commercial communication. Tell the parties beforehand that you record, why, and how long you keep recordings, and delete them at the latest when the period to contest the transaction ends. What this means for you. As a rule, you need the consent of the person called, and notice alone only works for evidence of transactions (Loyens & Loeff). The default botBrains introduction announces the recording and lets callers press the star key to object, which stops the recording and discards it. The transcript stays. No court has decided whether staying on the line counts as consent, so for quality or training recordings, mention transcripts and consider asking for a clear yes. Data protection. You need a lawful basis (GDPR Art. 6) and must tell the caller at the start (Art. 13). A voice only becomes biometric data when you process it to identify someone (Art. 4(14), Art. 9), which recording for quality or transcripts doesn’t do. botBrains stores recordings, transcripts, and call data in the EU.Caller ID and calling hours
Show your number. We found no Luxembourg rule that requires marketing calls to show a number. People can reject calls with a hidden number (Art. 7 (3) of the 2005 law). The caller sees your botBrains number, and botBrains provisions Luxembourg numbers on request. Spoofing. The Luxembourg Regulatory Institute (ILR) lets operators block calls from abroad that show a spoofed Luxembourg geographic number, and it’s revising that rule (government answer, March 2026). Test that your number shows before a campaign. Calling hours. Luxembourg law sets no calling hours. Harassing someone with repeated, ill-timed calls is a crime, prosecuted on complaint (Art. 6 and 10 of the 1982 law). Persistent unwanted phone solicitations are an aggressive practice toward consumers (Art. L. 122-7, item 3, Consumer Code). botBrains doesn’t enforce calling hours, so plan timing and frequency yourself.Sector rules
Fines and enforcement
We found no published CNPD decision or court ruling on marketing calls, robocalls, or AI calls in Luxembourg.
What’s changing. Bill 8476 would make the CNPD the main market surveillance authority for the AI Act. On September 1, 2026, the government still called it a draft (press release, bill 8476). The ILR is also revising its anti-spoofing rule. We found no pending change to Article 11.
Sources
- Law of May 30, 2005 on privacy in electronic communications, consolidated: Art. 2, 4, 7, 10, 11, 12, 12bis
- Consumer Code, consolidated September 27, 2026: Art. L. 122-7, L. 222-4, L. 222-9, L. 222-11, L. 222-15, L. 222-20
- Law of August 11, 1982 on the protection of privacy: Art. 2, 4, 6, 10
- Directive 2002/58/EC: Art. 13
- GDPR: Art. 4, Art. 6, Art. 7, Art. 9, Art. 13, Art. 14, Art. 21, Art. 83, Recital 47
- EU AI Act: Art. 50, Art. 99
- EDPB Guidelines 05/2020 on consent
- CNPD: consent for phone and email prospecting
- Government of Luxembourg: answer to parliamentary question 3690 on spoofing, CNPD and AI Act press release
- Chamber of Deputies: bill 8476 on the AI Act
- Loyens & Loeff: employee monitoring and call recording in Luxembourg
Next steps
Phone integration
Set up your phone line, introductions, and outbound calls.
Calling laws by country
Compare consent rules for AI calls across the EU, the UK, and the US.