> ## Documentation Index > Fetch the complete documentation index at: https://docs.botbrains.io/llms.txt > Use this file to discover all available pages before exploring further. # AI Cold Calling Laws in Malta > Is AI cold calling legal in Malta? Written consent for automated B2B and B2C calls under S.L. 586.01, no do-not-call register, recording, and AI disclosure. export const reviewed_0 = "October 2026" In Malta, an AI agent may only make marketing calls to people and businesses who agreed in writing beforehand. Regulation 9(1) of the [Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01](https://legislation.mt/eli/sl/586.1/eng), sets this rule for consumers and companies alike. A human may make cold calls until the called party asks them to stop, and Malta has no do-not-call register. The Information and Data Protection Commissioner (IDPC) enforces these rules. This page summarizes the law as of {reviewed_0} to help you plan AI phone calls. It isn't legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign. ## At a glance | Call | To consumers (B2C) | To businesses (B2B) | | - | - | - | | Inbound service call | Allowed. Disclose the AI and the recording. | Allowed. Disclose the AI and the recording. | | Outbound service call | Allowed | Allowed | | Marketing callback the person asked for | Allowed. Keep the written request. | Allowed. Keep the written request. | | Marketing call by an AI agent | Consent required, in writing. This includes existing customers. | Consent required, in writing. This includes existing customers. | | Marketing call by a human | Allowed, also to existing customers. Stop when asked. | Allowed, also to existing customers. Stop when asked. | ## Is AI cold calling legal in Malta? Regulation 9(1) bans unsolicited direct marketing by "an automatic calling machine" to any subscriber or user. The ban applies "irrespective of whether such subscriber or user is a natural person or legal person, unless the subscriber or user has given his prior consent in writing." The [Maltese text](https://legislation.mt/eli/sl/586.1/mlt) asks for consent "bil-quddiem u bil-miktub" (beforehand and in writing). **Who's covered.** Everyone. Malta makes no exception for companies, so AI calls to businesses need the same written opt-in as calls to consumers. The rule also protects sole traders and employees. **Does an AI agent count?** S.L. 586.01 doesn't define an automatic calling machine. The [ePrivacy Directive](https://eur-lex.europa.eu/eli/dir/2002/58/oj) it transposes (Art. 13(1)) and Malta's financial distance selling rules ([S.L. 330.07](https://legislation.mt/eli/sl/330.7/eng), reg. 11(1)(a)) describe these as "automated calling systems without human intervention." The [IDPC](https://idpc.org.mt/for-individuals/direct-marketing/) says cold calling systems "that specifically involve human intervention are permissible." No Maltese regulator or court has ruled on conversational AI agents. An AI agent that runs the conversation fits "without human intervention," so treat it as automated. A human who only presses **Dial** or listens in doesn't change that. Only a human who conducts the conversation makes it a live call. **What "in writing" means.** Under the [Electronic Commerce Act, art. 5](https://legislation.mt/eli/cap/426/eng), an electronic record meets a legal writing requirement if you can still read it later. A stored web form or signed contract works. A spoken yes on an earlier call is unlikely to count. ## Cold calls by a human Live marketing calls are opt-out. Under Regulation 9(3), you must stop calling, free of charge, once the person or business asks. The IDPC notes that callers normally keep an exclusion list so the number isn't dialed again. You still need a lawful basis, usually legitimate interest ([GDPR Art. 6(1)(f)](https://gdpr-info.eu/art-6-gdpr/)), and you must mention the right to object in the first call ([Art. 21(4)](https://gdpr-info.eu/art-21-gdpr/)). "Persistent and unwanted solicitations by telephone" of consumers are an unfair practice under the [Consumer Affairs Act](https://legislation.mt/eli/cap/378/eng), First Schedule, paragraph 26. ## Existing customers and callback requests Malta has no soft opt-in for calls. Regulation 9(2) covers email to existing customers only, so AI calls to customers need written consent too. A human may call existing customers unless they objected. A callback the person asked for isn't unsolicited, so Regulation 9(1) doesn't apply. Collect the request in writing, for example on a web form that says an AI agent will call back, and keep it. Stick to what they asked about. ## Do-not-call register: None in Malta Malta has no national do-not-call register. S.L. 586.01 doesn't create one, and the IDPC's guidance points to each company's own exclusion list instead. According to the IDPC, anyone may use the public telephone directory to contact listed subscribers, and individuals choose whether to appear in it (Regulation 8). Since AI calls need written consent anyway, screening a list wouldn't make them lawful. Keep your own suppression list of people who withdrew consent or objected. Use [guidance](/concepts/guidance) to tell the AI agent how to handle requests to stop calling, and a [Unitool](/concepts/unitools) to write each objection to your CRM. ## Consent for AI calls | Requirement | Detail | | - | - | | Form | Prior and in writing (Regulation 9(1)). A stored electronic record counts (Electronic Commerce Act, art. 5). | | Standard | Voluntary, specific, informed, and unambiguous, by a statement or clear affirmative action ([GDPR Art. 4(11)](https://gdpr-info.eu/art-4-gdpr/)). S.L. 586.01 uses the GDPR definition (Regulation 2). Pre-ticked boxes don't count. | | Scope | Name AI or automated calls, the purpose, and every company that will call. | | Proof | You must be able to show the consent ([GDPR Art. 7(1)](https://gdpr-info.eu/art-7-gdpr/)). Keep the form version, timestamp, and phone number for as long as you call. | | Withdrawal | As easy as giving it ([Art. 7(3)](https://gdpr-info.eu/art-7-gdpr/)). Stop calling right away. | | Purchased lists and partners | You stay responsible for vendors who call for you, as an IDPC fine on an insurer in May 2026 shows. Ask vendors for the exact consent text and proof. | Before you start, read [Before you start outbound campaigns](/concepts/phone/countries#before-you-start-outbound-campaigns). ## Tell callers they're talking to an AI Since August 2, 2026, [Article 50 of the EU AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#art_50) requires that people know they're talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can't count on the exception for obvious cases when your AI agent sounds human. The [default introduction](/concepts/phone#introductions) already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the [Consumer Rights Directive](https://eur-lex.europa.eu/eli/dir/2011/83/oj/eng) also requires you to name your company, anyone you call for, and the commercial purpose at the start. We found no Maltese AI disclosure rule beyond the AI Act. These rules require you to identify yourself: | Rule | What to say | Applies to | | - | - | - | | [Consumer Rights Regulations, S.L. 378.17](https://legislation.mt/eli/sl/378.17/eng), reg. 9(5) | Your identity, any company you call for, and the commercial purpose, at the start | Calls to consumers to close a distance contract | | [S.L. 330.07](https://legislation.mt/eli/sl/330.7/eng), reg. 5(3)(a) | Your identity and the commercial purpose, at the start | Retail financial services calls to consumers | | [GDPR Art. 13](https://gdpr-info.eu/art-13-gdpr/) and [Art. 21(4)](https://gdpr-info.eu/art-21-gdpr/) | Who you are, the purpose, and the right to object | Every call that uses personal data | Recommended introductions for outbound marketing calls. Replace the bracketed part: ```text English theme={null} Hello, this is {agent_name}, an AI agent calling for {project_name} about [purpose]. This call is recorded. Press the star key at any time to object to the recording. If you don't want more calls from us, just tell me and we won't call you again. ``` ```text Maltese theme={null} Bonġu, jien {agent_name}, aġent tal-intelliġenza artifiċjali, u qed inċemplek f'isem {project_name} dwar [skop]. Din it-telefonata qed tiġi rreġistrata. Agħfas il-buttuna tal-istilla f'kull ħin biex toġġezzjona għar-reġistrazzjoni. Jekk ma tridx li nerġgħu nċemplulek, għidli u ma nċemplulekx aktar. ``` For inbound calls: ```text English theme={null} Hello, this is {agent_name} from {project_name}. I'm an AI agent. This call is recorded. Press the star key at any time to object. How can I help you? ``` ```text Maltese theme={null} Bonġu, jien {agent_name} minn {project_name}. Jien aġent tal-intelliġenza artifiċjali. Din it-telefonata qed tiġi rreġistrata. Agħfas il-buttuna tal-istilla f'kull ħin biex toġġezzjona. Kif nista' ngħinek? ``` Edit the text under [Introductions](/concepts/phone#introductions). ## Call recording **Confidentiality rule.** Regulation 4(1) of S.L. 586.01 bars anyone "other than the user" from listening to, tapping, or storing a call without that user's consent. Regulation 4(2) leaves legally authorized recording in lawful business practice, to provide evidence of a commercial transaction or other business communication, unaffected. We found no Maltese criminal offence for recording a call you take part in. **Data protection.** You need a lawful basis ([GDPR Art. 6](https://gdpr-info.eu/art-6-gdpr/)) and must tell callers at the start ([Art. 13](https://gdpr-info.eu/art-13-gdpr/)). In 2022, the IDPC reprimanded a company that didn't tell a caller about the recording ([IDPC decisions](https://idpc.org.mt/decisions/)). Recording for quality or analysis may go beyond the evidence purpose in Regulation 4(2), so announce it and let callers object. The star key stops the recording and discards it, but the transcript stays. **Voice as biometric data.** A voice only counts as biometric data when you process it to identify someone ([Art. 4(14)](https://gdpr-info.eu/art-4-gdpr/), [Art. 9](https://gdpr-info.eu/art-9-gdpr/)). Recording for quality doesn't. botBrains stores recordings, transcripts, and call data in the EU. ## Caller ID and calling hours **Caller ID.** We found no Maltese rule that requires a special prefix for marketing calls. Since November 1, 2024, operators filter calls from abroad that show a Maltese number starting with 1, 2, or 8. They block likely scam calls and calls from unauthorized providers ([Malta Communications Authority (MCA) Decision Notice MCA/D/24-5278](https://www.mca.org.mt/consultations-decisions/decision-notice-preventative-measures-mitigate-cli-spoofing-and-vishing)). The caller sees your botBrains number, so ask botBrains for a Maltese number and test delivery first. The [MCA](https://www.mca.org.mt/content/scam-communications-using-electronic-communications-services-my-business-organisation-makes) suggests calling +356 2400 2400 from your setup, where an announcement confirms that the MCA has authorized your provider. **Calling hours.** We found no statutory calling hours in Malta. botBrains doesn't enforce calling hours or screen numbers, so you schedule calls yourself. On voicemail, the agent hangs up without a message. ## Sector rules | Sector | Rule | | - | - | | Financial services, including insurance | AI calls: consent required. They need the consumer's prior consent ([S.L. 330.07](https://legislation.mt/eli/sl/330.7/eng), reg. 11).
Other calls: allowed. Stop when the consumer objects (reg. 11). Give your identity and the commercial purpose first (reg. 5(3)(a)). Under Directive (EU) 2023/2673, the Malta Financial Services Authority (MFSA) will replace these rules ([MCCAA](https://mccaa.org.mt/wp-content/uploads/2026/05/user-guidelines_-consumer-rights-amendment-regulations.pdf)), so check its current rules. | | Phone contracts with consumers | Confirm the offer on a durable medium. The consumer is only bound after signing it or sending written consent (S.L. 378.17, reg. 9(6)). | | Debt collection and service calls | Allowed. These calls aren't direct marketing, so Regulation 9 doesn't apply. The Consumer Affairs Act bans persistent, unwanted phone solicitations of consumers, except as far as national law justifies them to enforce a contract (First Schedule, paragraph 26). | | Energy, telecoms, health, home renovation | We found no Maltese telemarketing rules specific to these sectors. | ## Fines and enforcement | Law | Regulator | Maximum | | - | - | - | | S.L. 586.01 | IDPC. The MCA can ask the IDPC to act (Regulation 16). | €23,293.73 per violation, plus €2,329.37 for each day it continues (Regulation 13) | | GDPR | IDPC | €20 million or 4% of worldwide turnover ([Art. 83](https://gdpr-info.eu/art-83-gdpr/)) | | Consumer Affairs Act and S.L. 378.17 | Malta Competition and Consumer Affairs Authority (MCCAA), through the Civil Court | €47,000 per infringement (Cap. 378, art. 106A, and S.L. 378.17, reg. 27). In coordinated EU actions, up to 4% of annual turnover in the countries concerned, or €2 million (art. 106A(3)). | | S.L. 330.07 | MFSA | €93,174.94 (reg. 25) | | EU AI Act, Art. 50 | Malta Digital Innovation Authority (MDIA) | €15 million or 3% of worldwide turnover ([Art. 99](https://artificialintelligenceact.eu/article/99/)). The MDIA may also impose up to €350,000 or 1% of turnover, plus €12,000 a day ([L.N. 226 of 2025](https://legislation.mt/eli/ln/2025/226/eng), reg. 11). | In June 2024, the IDPC fined a company €15,000. Its calling system had phoned a complainant twice after an objection ([CDP/COMP/617/2023](https://idpc.org.mt/wp-content/uploads/2024/07/4794_001.pdf)). In May 2026, it fined an insurer €1,000 and ordered fixes. A third-party company had called a man again for marketing, despite an earlier IDPC decision ([CDP/COMP/193/2025](https://idpc.org.mt/wp-content/uploads/2026/05/0583_001.pdf)). We found no Maltese case on AI or automated calls. ## Sources * [Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01](https://legislation.mt/eli/sl/586.1/eng) ([Maltese](https://legislation.mt/eli/sl/586.1/mlt)), Regulations 2, 4, 8, 9, 13, and 16 * [Consumer Rights Regulations, S.L. 378.17](https://legislation.mt/eli/sl/378.17/eng), Regulation 9 * [Consumer Affairs Act, Cap. 378](https://legislation.mt/eli/cap/378/eng), article 106A and First Schedule, paragraph 26 * [Distance Selling (Retail Financial Services) Regulations, S.L. 330.07](https://legislation.mt/eli/sl/330.7/eng), Regulations 5, 11, and 25 * [Electronic Commerce Act, Cap. 426](https://legislation.mt/eli/cap/426/eng), article 5 * [Artificial Intelligence Regulations, 2025, L.N. 226 of 2025](https://legislation.mt/eli/ln/2025/226/eng), Regulations 3 and 11 * [IDPC: Direct marketing](https://idpc.org.mt/for-individuals/direct-marketing/) and [IDPC decisions](https://idpc.org.mt/decisions/), including [CDP/COMP/617/2023](https://idpc.org.mt/wp-content/uploads/2024/07/4794_001.pdf) and [CDP/COMP/193/2025](https://idpc.org.mt/wp-content/uploads/2026/05/0583_001.pdf) * [MCA: Decision Notice on CLI spoofing and vishing scams](https://www.mca.org.mt/consultations-decisions/decision-notice-preventative-measures-mitigate-cli-spoofing-and-vishing) and [guidance for businesses](https://www.mca.org.mt/content/scam-communications-using-electronic-communications-services-my-business-organisation-makes) * [MCCAA: User guidelines on the Consumer Rights (Amendment) Regulations, 2026](https://mccaa.org.mt/wp-content/uploads/2026/05/user-guidelines_-consumer-rights-amendment-regulations.pdf) * [ePrivacy Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2002/58/oj), Art. 13 * GDPR [Art. 4](https://gdpr-info.eu/art-4-gdpr/), [6](https://gdpr-info.eu/art-6-gdpr/), [7](https://gdpr-info.eu/art-7-gdpr/), [9](https://gdpr-info.eu/art-9-gdpr/), [13](https://gdpr-info.eu/art-13-gdpr/), [21](https://gdpr-info.eu/art-21-gdpr/), [83](https://gdpr-info.eu/art-83-gdpr/); EU AI Act [Art. 50](https://artificialintelligenceact.eu/article/50/) and [Art. 99](https://artificialintelligenceact.eu/article/99/) ## Next steps Set up your phone line, introductions, and outbound calls. Compare consent rules for AI calls across the EU, the UK, and the US. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.