Skip to main content
In Spain, an AI agent may only make marketing calls to people and businesses who agreed beforehand. Article 66.1.a of the General Telecommunications Law (Ley 11/2022) requires prior consent for automated marketing calls, with no exception for companies or existing customers. From October 17, 2026, marketing calls must also come from a number in the new 400 range.
This page summarizes the law as of October 2026 to help you plan AI phone calls. It isn’t legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.

​
At a glance

Two deadlines are close. From October 17, 2026, carriers block marketing calls from numbers outside the 400 range. By December 28, 2026, large companies and providers of basic services must let callers reach a human during automated service calls.
Only with prior consent. Article 66.1.a gives every end user the right not to receive “llamadas automáticas sin intervención humana” (automated calls without human intervention) for commercial purposes without prior consent. End users include companies (Annex II, points 82 and 83), so B2B calls need consent too. For consumers, Article 96.3 of the consumer law (TRLGDCU) requires express consent. The legitimate interest route in AEPD Circular 1/2023 doesn’t apply to automated calls (Art. 1.2). An AI agent likely counts as automated. No court or regulator has ruled on conversational AI. The AEPD FAQ names a prerecorded message as its example, but the legal test is human intervention, and an AI agent talks without a human. The customer service law (Ley 10/2025, Art. 8.2) also groups “bots conversacionales” with answering machines. A human who supervises or could take over doesn’t change this. Treat AI calls as automated.

​
Cold calls by a human

Since June 29, 2023, Article 66.1.b requires consent or another GDPR legal basis for every marketing call. Circular 1/2023 accepts only legitimate interest as that basis: So B2B calls by a human work without consent, and cold calls to consumers need it.

​
Existing customers and callback requests

Existing customers. For calls by a human, the AEPD presumes legitimate interest when you offer your own products similar to what the customer bought (Circular 1/2023, Art. 3). This doesn’t extend to other companies in your group. Article 66.1.a has no customer exception, so AI calls need consent. Callback requests. A request for a callback is consent to that call, so make the form say that an AI agent will call. Ads that lead to a landing page with such a form work well.

​
Do-not-call register: Lista Robinson

You don’t need to screen people who consented to your calls (LOPDGDD Art. 23.4), so the list matters mostly for calls by a human. Consent must be voluntary, specific, informed, and unambiguous (GDPR Art. 4(11) and 7). It must cover automated calls, not just calls, and name your company (EDPB Guidelines 05/2020). You must prove who consented, when, how, for what, and what text they saw. In PS/00249/2025, a company called purchased leads. It couldn’t show the privacy policy behind the checkboxes or tie the entry to the person, so the AEPD found no valid consent. botBrains asks for consent evidence before automated marketing campaigns, see before you start outbound campaigns.

​
Tell callers they’re talking to an AI

Since August 2, 2026, Article 50 of the EU AI Act requires that people know they’re talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can’t count on the exception for obvious cases when your AI agent sounds human. The default introduction already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the Consumer Rights Directive also requires you to name your company, anyone you call for, and the commercial purpose at the start. Spanish law adds rules for the start of every marketing call: Use guidance to tell the agent how to handle objections, and a Unitool to write them to your CRM. Inbound calls. Customer service lines for consumers must offer a human, not only automated means (TRLGDCU Art. 21.2). By December 28, 2026, a human operator at companies covered by Ley 10/2025 must answer 95% of requests for a human within three minutes on average (Art. 8). Forward these callers to a colleague. Languages. Use Spanish. Consumers in Catalonia can choose Catalan (Catalan Consumer Code, Art. 128-1). Outbound marketing call in Spanish, then Catalan:
Inbound call in Spanish, then Catalan:

​
Call recording

Recording a call you take part in isn’t a crime (STC 114/1984). Intercepting other people’s calls is (Criminal Code Art. 197). Consent isn’t the only option. You need a GDPR legal basis, such as legitimate interest, and a notice at the start (GDPR Art. 6 and 13). The voice is biometric data only when you process it to identify the speaker (GDPR Art. 4(14) and 9). The AEPD recommends recording marketing calls as proof of compliance (Circular 1/2023, Art. 6). The default botBrains introduction gives the notice. If the caller presses the star key, botBrains stops the recording and discards it, and the transcript stays. botBrains stores recordings, transcripts, and call data in the EU.

​
Caller ID and calling hours

The 400 resolution ties the duty to companies covered by Ley 10/2025, but the government presents it as a rule for all marketing calls. Use a 400 number for every marketing call. The caller sees your botBrains number. botBrains provisions local numbers on request, so tell us if you need one for marketing. botBrains doesn’t enforce calling hours or screen lists, so you handle both.

​
Sector rules

* Ley 10/2025 covers two groups of companies in Spain. The first group is providers of basic services of any size: water, gas, and electricity, passenger transport, postal services, electronic communications, and financial services. The second group is companies in any other sector that sell to consumers and, in the previous financial year, had at least 250 employees, more than EUR 50 million in turnover, or more than EUR 43 million on the balance sheet. One of these thresholds is enough. Smaller companies in other sectors aren’t covered.

​
Fines and enforcement

Notable cases. In 2021, the AEPD fined Vodafone EUR 8.15 million for its partners’ marketing calls and messages, including calls to people on the Lista Robinson (PS/00059/2020). In 2026, it fined solar installer Más Sol Energía EUR 10,000 for calling a purchased lead without valid consent and not saying where the data came from. The person’s own recording was the evidence (PS/00249/2025). We found no Spanish case on AI agents or robocalls.

​
Sources

​
Next steps

Phone integration

Set up your phone line, introductions, and outbound calls.

Calling laws by country

Compare consent rules for AI calls across the EU, the UK, and the US.