Skip to main content
In Malta, an AI agent may only make marketing calls to people and businesses who agreed in writing beforehand. Regulation 9(1) of the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01, sets this rule for consumers and companies alike. A human may make cold calls until the called party asks them to stop, and Malta has no do-not-call register. The Information and Data Protection Commissioner (IDPC) enforces these rules.
This page summarizes the law as of October 2026 to help you plan AI phone calls. It isn’t legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.

​
At a glance

Regulation 9(1) bans unsolicited direct marketing by “an automatic calling machine” to any subscriber or user. The ban applies “irrespective of whether such subscriber or user is a natural person or legal person, unless the subscriber or user has given his prior consent in writing.” The Maltese text asks for consent “bil-quddiem u bil-miktub” (beforehand and in writing). Who’s covered. Everyone. Malta makes no exception for companies, so AI calls to businesses need the same written opt-in as calls to consumers. The rule also protects sole traders and employees. Does an AI agent count? S.L. 586.01 doesn’t define an automatic calling machine. The ePrivacy Directive it transposes (Art. 13(1)) and Malta’s financial distance selling rules (S.L. 330.07, reg. 11(1)(a)) describe these as “automated calling systems without human intervention.” The IDPC says cold calling systems “that specifically involve human intervention are permissible.” No Maltese regulator or court has ruled on conversational AI agents. An AI agent that runs the conversation fits “without human intervention,” so treat it as automated. A human who only presses Dial or listens in doesn’t change that. Only a human who conducts the conversation makes it a live call. What “in writing” means. Under the Electronic Commerce Act, art. 5, an electronic record meets a legal writing requirement if you can still read it later. A stored web form or signed contract works. A spoken yes on an earlier call is unlikely to count.

​
Cold calls by a human

Live marketing calls are opt-out. Under Regulation 9(3), you must stop calling, free of charge, once the person or business asks. The IDPC notes that callers normally keep an exclusion list so the number isn’t dialed again. You still need a lawful basis, usually legitimate interest (GDPR Art. 6(1)(f)), and you must mention the right to object in the first call (Art. 21(4)). “Persistent and unwanted solicitations by telephone” of consumers are an unfair practice under the Consumer Affairs Act, First Schedule, paragraph 26.

​
Existing customers and callback requests

Malta has no soft opt-in for calls. Regulation 9(2) covers email to existing customers only, so AI calls to customers need written consent too. A human may call existing customers unless they objected. A callback the person asked for isn’t unsolicited, so Regulation 9(1) doesn’t apply. Collect the request in writing, for example on a web form that says an AI agent will call back, and keep it. Stick to what they asked about.

​
Do-not-call register: None in Malta

Malta has no national do-not-call register. S.L. 586.01 doesn’t create one, and the IDPC’s guidance points to each company’s own exclusion list instead. According to the IDPC, anyone may use the public telephone directory to contact listed subscribers, and individuals choose whether to appear in it (Regulation 8). Since AI calls need written consent anyway, screening a list wouldn’t make them lawful. Keep your own suppression list of people who withdrew consent or objected. Use guidance to tell the AI agent how to handle requests to stop calling, and a Unitool to write each objection to your CRM. Before you start, read Before you start outbound campaigns.

​
Tell callers they’re talking to an AI

Since August 2, 2026, Article 50 of the EU AI Act requires that people know they’re talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can’t count on the exception for obvious cases when your AI agent sounds human. The default introduction already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the Consumer Rights Directive also requires you to name your company, anyone you call for, and the commercial purpose at the start. We found no Maltese AI disclosure rule beyond the AI Act. These rules require you to identify yourself: Recommended introductions for outbound marketing calls. Replace the bracketed part:
English
Maltese
For inbound calls:
English
Maltese
Edit the text under Introductions.

​
Call recording

Confidentiality rule. Regulation 4(1) of S.L. 586.01 bars anyone “other than the user” from listening to, tapping, or storing a call without that user’s consent. Regulation 4(2) leaves legally authorized recording in lawful business practice, to provide evidence of a commercial transaction or other business communication, unaffected. We found no Maltese criminal offence for recording a call you take part in. Data protection. You need a lawful basis (GDPR Art. 6) and must tell callers at the start (Art. 13). In 2022, the IDPC reprimanded a company that didn’t tell a caller about the recording (IDPC decisions). Recording for quality or analysis may go beyond the evidence purpose in Regulation 4(2), so announce it and let callers object. The star key stops the recording and discards it, but the transcript stays. Voice as biometric data. A voice only counts as biometric data when you process it to identify someone (Art. 4(14), Art. 9). Recording for quality doesn’t. botBrains stores recordings, transcripts, and call data in the EU.

​
Caller ID and calling hours

Caller ID. We found no Maltese rule that requires a special prefix for marketing calls. Since November 1, 2024, operators filter calls from abroad that show a Maltese number starting with 1, 2, or 8. They block likely scam calls and calls from unauthorized providers (Malta Communications Authority (MCA) Decision Notice MCA/D/24-5278). The caller sees your botBrains number, so ask botBrains for a Maltese number and test delivery first. The MCA suggests calling +356 2400 2400 from your setup, where an announcement confirms that the MCA has authorized your provider. Calling hours. We found no statutory calling hours in Malta. botBrains doesn’t enforce calling hours or screen numbers, so you schedule calls yourself. On voicemail, the agent hangs up without a message.

​
Sector rules

​
Fines and enforcement

In June 2024, the IDPC fined a company €15,000. Its calling system had phoned a complainant twice after an objection (CDP/COMP/617/2023). In May 2026, it fined an insurer €1,000 and ordered fixes. A third-party company had called a man again for marketing, despite an earlier IDPC decision (CDP/COMP/193/2025). We found no Maltese case on AI or automated calls.

​
Sources

​
Next steps

Phone integration

Set up your phone line, introductions, and outbound calls.

Calling laws by country

Compare consent rules for AI calls across the EU, the UK, and the US.