> ## Documentation Index
> Fetch the complete documentation index at: https://docs.botbrains.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Cold Calling Laws in Luxembourg

> Is AI cold calling legal in Luxembourg? Art. 11 of the 2005 ePrivacy law requires consent for calls to individuals. No do-not-call list, recording and AI rules.

export const reviewed_0 = "October 2026"

In Luxembourg, every marketing call to a natural person needs that person's prior consent, whether an AI agent or a human makes it. [Article 11 of the law of May 30, 2005](https://legilux.public.lu/eli/etat/leg/loi/2005/05/30/n4/consolide/20201225) sets this rule for consumers and sole traders, and the Consumer Code repeats it for consumers. Lines that a company holds fall outside Article 11, but the General Data Protection Regulation (GDPR) still protects the employee you reach. Luxembourg has no do-not-call register, and recording a call needs consent except as evidence of a transaction.

<Note>
  This page summarizes the law as of {reviewed_0} to help you plan AI phone calls. It isn't legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.
</Note>

## At a glance

| Call | To consumers (B2C) | To businesses (B2B) |
| - | - | - |
| Inbound service call | <Icon icon="circle-check" color="#16a34a" /> Allowed. Disclose the AI and the recording. | <Icon icon="circle-check" color="#16a34a" /> Allowed. Disclose the AI and the recording. |
| Outbound service call | <Icon icon="circle-check" color="#16a34a" /> Allowed | <Icon icon="circle-check" color="#16a34a" /> Allowed |
| Marketing callback the person asked for | <Icon icon="signature" color="#d97706" /> Consent required. The request counts as consent. | <Icon icon="circle-check" color="#16a34a" /> Allowed |
| Marketing call by an AI agent | <Icon icon="signature" color="#d97706" /> Consent required, also from existing customers. Luxembourg has no customer exception for calls. | <Icon icon="circle-check" color="#16a34a" /> Lines a company holds: allowed. Respect objections.<br /><Icon icon="signature" color="#d97706" /> Sole traders and personal lines: consent required. |
| Marketing call by a human | <Icon icon="signature" color="#d97706" /> Consent required, also from existing customers. Luxembourg has no customer exception for calls. | <Icon icon="circle-check" color="#16a34a" /> Lines a company holds: allowed. Respect objections.<br /><Icon icon="signature" color="#d97706" /> Sole traders and personal lines: consent required. |

## Is AI cold calling legal in Luxembourg?

Only with prior consent when you call a natural person. Article 11 (1) of the 2005 law says that direct marketing with "systèmes automatisés d'appel et de communication sans intervention humaine (automates d'appel)" is only possible toward "l'abonné ou l'utilisateur ayant donné son consentement préalable." In English: you may only use automated calling systems without human intervention for direct marketing toward a subscriber or user who gave prior consent. Article 11 (3) sets the same rule for every other channel, including calls by a human.

**The rule protects natural persons only.** Article 11 (5) limits both rules to "l'abonné qui est une personne physique," the subscriber who is a natural person. The subscriber is whoever holds the phone contract (Art. 2 (a)). Article 11 protects a sole trader with a line in their own name, but not a line that a company holds. You usually can't tell who holds a mobile contract, so treat mobile numbers as personal unless you know otherwise.

**Consumers get a second layer.** Under [Art. L. 222-11 (1) of the Consumer Code](https://legilux.public.lu/eli/etat/leg/code/consommation/20260927), a business needs a consumer's prior consent to contact them by automated calling system, phone, fax, or email.

**AI or human makes no difference.** Luxembourg requires consent for every marketing call to a natural person and for none to company-held lines. So it doesn't matter whether your AI agent counts as an automated calling system under [Art. 13(1) of Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2002/58/oj), or whether a human supervises it. We found no guidance from the National Commission for Data Protection (CNPD) and no court decision on AI voice agents.

**The GDPR still covers business calls.** An employee's name and number are personal data. You can rely on legitimate interest ([GDPR Recital 47](https://gdpr-info.eu/recitals/no-47/)), but say in the first call where you got the data ([Art. 14](https://gdpr-info.eu/art-14-gdpr/)) and stop when someone objects ([Art. 21](https://gdpr-info.eu/art-21-gdpr/)).

## Cold calls by a human

The same rules apply. Calls to consumers and sole traders need prior consent under Article 11 (3), so Luxembourg has no opt-out model for natural persons. Calls to lines a company holds don't need consent, but keep a block list of everyone who objects.

## Existing customers and callback requests

**Existing customers.** The customer exception in Article 11 (2) only covers email. Marketing calls to customers who are consumers or sole traders need prior consent, for example a separate checkbox at checkout.

**Callback requests.** A person who asks for a callback has consented to that call. Collect requests through your own channels, such as a landing page for your ads. Say in the form that an AI agent will call, and stick to the topic the person asked about.

**Service calls.** Article 11 only covers direct marketing ("prospection directe"). Appointment reminders, order and support follow-ups, and debt collection don't need consent, as long as they don't promote anything. Keep sales offers out of these calls.

## Do-not-call register: None in Luxembourg

Luxembourg has no do-not-call register for phone calls. Marketing calls to natural persons need consent anyway, so no list could replace it. Subscribers can keep their number out of public directories ([Art. 10 of the 2005 law](https://legilux.public.lu/eli/etat/leg/loi/2005/05/30/n4/consolide/20201225)), but that doesn't change whether you may call.

Keep your own block list of everyone who withdraws consent or objects, and check it before every call.

## Consent for AI calls

Consent must be free, specific, informed, and unambiguous, given by a statement or a clear positive act ([CNPD](https://cnpd.public.lu/fr/dossiers-thematiques/elections/campages-electorales/communication11.html), [GDPR Art. 4(11)](https://gdpr-info.eu/art-4-gdpr/)).

| Requirement | What it means for you |
| - | - |
| Before the first call | Collect it through forms, contracts, or inbound calls. |
| From the subscriber or user | The person who holds the contract or uses the line can consent (Art. 11 (1), (3)). |
| Specific | Name your company and the purpose, and say that an AI agent may call. |
| Provable | You carry the burden of proof ([GDPR Art. 7(1)](https://gdpr-info.eu/art-7-gdpr/), Art. L. 222-11 (2) Consumer Code). Keep the consent text, form version, timestamp, and phone number. |
| Revocable | People can withdraw consent at any time ([GDPR Art. 7(3)](https://gdpr-info.eu/art-7-gdpr/)). |

**Purchased lists and partners.** Consent must name every company that relies on it ([European Data Protection Board (EDPB) Guidelines 05/2020](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)). A vendor's promise isn't evidence, so ask for the exact consent text, the collection method, and evidence per contact. When you call for a partner, name that partner at the start (Art. L. 222-4 (5) Consumer Code).

**Retention.** No law sets an expiry date or a retention period. Keep the evidence while you rely on the consent and for as long as someone could bring a claim.

Before your first campaign, botBrains asks for your consent evidence. See [before you start outbound campaigns](/concepts/phone/countries#before-you-start-outbound-campaigns).

## Tell callers they're talking to an AI

Since August 2, 2026, [Article 50 of the EU AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#art_50) requires that people know they're talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can't count on the exception for obvious cases when your AI agent sounds human. The [default introduction](/concepts/phone#introductions) already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the [Consumer Rights Directive](https://eur-lex.europa.eu/eli/dir/2011/83/oj/eng) also requires you to name your company, anyone you call for, and the commercial purpose at the start.

The Consumer Code adds a rule for sales calls to consumers. At the start, state your identity, the company you call for, and the commercial nature of the call ([Art. L. 222-4 (5)](https://legilux.public.lu/eli/etat/leg/code/consommation/20260927)). For financial services, state your identity and the commercial purpose (Art. L. 222-15 (1)).

People in Luxembourg speak Luxembourgish, French, and German on the phone. Replace the topic placeholder with the purpose the person agreed to. Replace the reason and duration placeholders with why you record and how long you keep recordings, as Art. 4 (3)(d) of the 2005 law requires.

Outbound marketing call in Luxembourgish, French, and German:

```text theme={null}
Moien, hei ass {agent_name} vun {project_name}. Ech sinn eng kënschtlech Intelligenz. Dëst ass e kommerziellen Uruff iwwer [Theema], deem Dir zougestëmmt hutt. Dësen Uruff gëtt fir [Grond] opgeholl an [Dauer] laang gespäichert. Wann Dir dat net wëllt, dréckt zu all Moment op d'Tast mam Stär. Wann Dir keng Uriff méi vun eis wëllt, sot mer et einfach.
```

```text theme={null}
Bonjour, ici {agent_name} de {project_name}. Je suis une intelligence artificielle. C'est un appel commercial au sujet de [objet], auquel vous avez donné votre accord. Cet appel est enregistré pour [raison] et conservé [durée]. Si vous ne le souhaitez pas, appuyez à tout moment sur la touche étoile. Si vous ne voulez plus recevoir nos appels, dites-le-moi.
```

```text theme={null}
Guten Tag, hier ist {agent_name} von {project_name}. Ich bin eine KI. Dies ist ein Werbeanruf zu [Thema], dem Sie zugestimmt haben. Wir zeichnen das Gespräch für [Grund] auf und speichern es [Dauer]. Wenn Sie das nicht möchten, drücken Sie jederzeit die Sterntaste. Wenn Sie keine Anrufe mehr von uns wünschen, sagen Sie es mir einfach.
```

Inbound call in Luxembourgish, French, and German:

```text theme={null}
Moien, hei ass {agent_name} vun {project_name}. Ech sinn eng kënschtlech Intelligenz. Dësen Uruff gëtt fir [Grond] opgeholl an [Dauer] laang gespäichert. Wann Dir dat net wëllt, dréckt zu all Moment op d'Tast mam Stär. Wéi kann ech Iech hëllefen?
```

```text theme={null}
Bonjour, ici {agent_name} de {project_name}. Je suis une intelligence artificielle. Cet appel est enregistré pour [raison] et conservé [durée]. Si vous ne le souhaitez pas, appuyez à tout moment sur la touche étoile. Comment puis-je vous aider ?
```

```text theme={null}
Guten Tag, hier ist {agent_name} von {project_name}. Ich bin eine KI. Wir zeichnen das Gespräch für [Grund] auf und speichern es [Dauer]. Wenn Sie das nicht möchten, drücken Sie jederzeit die Sterntaste. Wie kann ich Ihnen helfen?
```

Use [guidance](/concepts/guidance) to tell the agent how to handle "don't call me again," and a [Unitool](/concepts/unitools) to write the objection to your CRM.

## Call recording

**Criminal law.** [Art. 2 of the law of August 11, 1982](https://legilux.public.lu/eli/etat/leg/loi/1982/08/11/n6/jo) punishes anyone who records words that a person speaks in private without that person's consent. It makes no exception for a party to the call. Keeping or using such a recording is a crime too (Art. 4).

**Telecom law.** Art. 4 (2) of the 2005 law bans storing communications without the user's consent. Art. 4 (3)(d) makes an exception for recordings that prove a commercial transaction or another commercial communication. Tell the parties beforehand that you record, why, and how long you keep recordings, and delete them at the latest when the period to contest the transaction ends.

**What this means for you.** As a rule, you need the consent of the person called, and notice alone only works for evidence of transactions ([Loyens & Loeff](https://www.loyensloeff.com/insights/news--events/news/employee-monitoring/)). The default botBrains introduction announces the recording and lets callers press the star key to object, which stops the recording and discards it. The transcript stays. No court has decided whether staying on the line counts as consent, so for quality or training recordings, mention transcripts and consider asking for a clear yes.

**Data protection.** You need a lawful basis ([GDPR Art. 6](https://gdpr-info.eu/art-6-gdpr/)) and must tell the caller at the start ([Art. 13](https://gdpr-info.eu/art-13-gdpr/)). A voice only becomes biometric data when you process it to identify someone ([Art. 4(14)](https://gdpr-info.eu/art-4-gdpr/), [Art. 9](https://gdpr-info.eu/art-9-gdpr/)), which recording for quality or transcripts doesn't do. botBrains stores recordings, transcripts, and call data in the EU.

## Caller ID and calling hours

**Show your number.** We found no Luxembourg rule that requires marketing calls to show a number. People can reject calls with a hidden number (Art. 7 (3) of the 2005 law). The caller sees your botBrains number, and botBrains provisions Luxembourg numbers on request.

**Spoofing.** The Luxembourg Regulatory Institute (ILR) lets operators block calls from abroad that show a spoofed Luxembourg geographic number, and it's revising that rule ([government answer, March 2026](https://wdocs-pub.chd.lu/docs/exped/2026/03/QP_62745_1774621682130.pdf)). Test that your number shows before a campaign.

**Calling hours.** Luxembourg law sets no calling hours. Harassing someone with repeated, ill-timed calls is a crime, prosecuted on complaint (Art. 6 and 10 of the 1982 law). Persistent unwanted phone solicitations are an aggressive practice toward consumers ([Art. L. 122-7, item 3, Consumer Code](https://legilux.public.lu/eli/etat/leg/code/consommation/20260927)). botBrains doesn't enforce calling hours, so plan timing and frequency yourself.

## Sector rules

| Sector | Rule | Source |
| - | - | - |
| Any contract with a consumer concluded by phone | Confirm the offer on a durable medium, such as email. The consumer is only bound after signing it or accepting it in writing. | [Art. L. 222-4 (6) Consumer Code](https://legilux.public.lu/eli/etat/leg/code/consommation/20260927) |
| Financial services sold at a distance | <Icon icon="signature" color="#d97706" /> Consent required. Marketing calls to consumers need prior consent. State your identity and the commercial purpose at the start. | Art. L. 222-15 (1), L. 222-20 (1) Consumer Code |
| Energy | We found no rule specific to phone sales. The written confirmation applies, and consumers can withdraw within 14 days. | Art. L. 222-9 Consumer Code |

## Fines and enforcement

| Breach | Authority | Maximum |
| - | - | - |
| Marketing call to a natural person without consent | Criminal courts, CNPD supervises | One year in prison and EUR 125,000 (Art. 11 (6), 2005 law) |
| Ignoring a court order to stop, which the CNPD can request | Criminal courts | EUR 50,000 (Art. 12bis, 2005 law) |
| Recording without consent or notice | Criminal courts | One year in prison and EUR 125,000 (Art. 4 (4), 2005 law) |
| Missing identification or written confirmation | Consumer protection minister, criminal courts | EUR 15,000, or 4% of turnover in coordinated EU actions (Art. L. 222-11 Consumer Code) |
| GDPR breaches, such as consent records or objections | CNPD | EUR 20 million or 4% of turnover ([GDPR Art. 83](https://gdpr-info.eu/art-83-gdpr/)) |
| AI disclosure | Not yet designated | EUR 15 million or 3% of turnover ([AI Act Art. 99(4)](https://artificialintelligenceact.eu/article/99/)) |

We found no published CNPD decision or court ruling on marketing calls, robocalls, or AI calls in Luxembourg.

**What's changing.** Bill 8476 would make the CNPD the main market surveillance authority for the AI Act. On September 1, 2026, the government still called it a draft ([press release](https://gouvernement.lu/fr/actualites/toutes_actualites/communiques/2026/09-septembre/01-margue-cnpd.html), [bill 8476](https://www.chd.lu/fr/dossier/8476)). The ILR is also revising its anti-spoofing rule. We found no pending change to Article 11.

## Sources

* Law of May 30, 2005 on privacy in electronic communications, consolidated: [Art. 2, 4, 7, 10, 11, 12, 12bis](https://legilux.public.lu/eli/etat/leg/loi/2005/05/30/n4/consolide/20201225)
* Consumer Code, consolidated September 27, 2026: [Art. L. 122-7, L. 222-4, L. 222-9, L. 222-11, L. 222-15, L. 222-20](https://legilux.public.lu/eli/etat/leg/code/consommation/20260927)
* Law of August 11, 1982 on the protection of privacy: [Art. 2, 4, 6, 10](https://legilux.public.lu/eli/etat/leg/loi/1982/08/11/n6/jo)
* [Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2002/58/oj): Art. 13
* GDPR: [Art. 4](https://gdpr-info.eu/art-4-gdpr/), [Art. 6](https://gdpr-info.eu/art-6-gdpr/), [Art. 7](https://gdpr-info.eu/art-7-gdpr/), [Art. 9](https://gdpr-info.eu/art-9-gdpr/), [Art. 13](https://gdpr-info.eu/art-13-gdpr/), [Art. 14](https://gdpr-info.eu/art-14-gdpr/), [Art. 21](https://gdpr-info.eu/art-21-gdpr/), [Art. 83](https://gdpr-info.eu/art-83-gdpr/), [Recital 47](https://gdpr-info.eu/recitals/no-47/)
* EU AI Act: [Art. 50](https://artificialintelligenceact.eu/article/50/), [Art. 99](https://artificialintelligenceact.eu/article/99/)
* [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
* CNPD: [consent for phone and email prospecting](https://cnpd.public.lu/fr/dossiers-thematiques/elections/campages-electorales/communication11.html)
* Government of Luxembourg: [answer to parliamentary question 3690 on spoofing](https://wdocs-pub.chd.lu/docs/exped/2026/03/QP_62745_1774621682130.pdf), [CNPD and AI Act press release](https://gouvernement.lu/fr/actualites/toutes_actualites/communiques/2026/09-septembre/01-margue-cnpd.html)
* Chamber of Deputies: [bill 8476 on the AI Act](https://www.chd.lu/fr/dossier/8476)
* Loyens & Loeff: [employee monitoring and call recording in Luxembourg](https://www.loyensloeff.com/insights/news--events/news/employee-monitoring/)

## Next steps

<Columns cols={2}>
  <Card title="Phone integration" icon="phone" href="/concepts/phone">
    Set up your phone line, introductions, and outbound calls.
  </Card>

  <Card title="Calling laws by country" icon="globe" href="/concepts/phone/countries">
    Compare consent rules for AI calls across the EU, the UK, and the US.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.