Spain changed its rules on commercial calls in 2022, and a regulator circular in 2023 told companies how the new text would be applied. The short version for AI cold calling: fully automated calls need the person's prior consent, other commercial calls need consent or another lawful basis under GDPR, and there's no business-number exemption in the telecom law. One piece is still open. No text or ruling we found says whether a conversational AI voice agent counts as an "automated call".
This guide reads the primary texts, checked on 15 November 2026. It's general information, not legal advice. Have a Spanish lawyer review your campaign before you call.
Key Takeaways
Article 66.1.a of Spain's Ley 11/2022 gives people the right not to receive automated calls without human intervention unless they gave prior consent.
Article 66.1.b bars other unwanted commercial calls unless there's prior consent or another lawful basis under GDPR article 6.1, in force from June 2023.
A breach of article 66 is graded grave, with fines up to EUR 2,000,000, or minor, with fines up to EUR 100,000.
Companies must check exclusion lists such as Lista Robinson before they call, under article 23 of Spain's data protection law.
Topcalls AI calls start from $0.25/min, and Topcalls keeps no do-not-call list, so you own consent records and opt-outs.
1. Is AI cold calling legal in Spain?
AI cold calling is legal in Spain only when the call has a lawful basis: prior consent, or in some cases legitimate interest under GDPR. For a call placed by a fully automated system, the telecom law asks for prior consent. Spain's law has no general exemption for business numbers, so a B2B call still needs a basis.
The core rule is article 66.1 of the . Point (a) gives users the right "a no recibir llamadas automáticas sin intervención humana o mensajes de fax, con fines de comunicación comercial sin haber prestado su consentimiento previo para ello". Point (b) covers other commercial calls: no unwanted calls unless there's prior consent "o salvo que la comunicación pueda ampararse en otra base de legitimación de las previstas en el artículo 6.1" of GDPR.
Frequently Asked Questions
Get AI calling tips in your inbox
No spam. One email per week with actionable sales automation tips.
Voice AI for Apartment Leasing: 7 Call Ideas That Fill Units
Voice AI for apartment leasing: 7 call ideas, from after-hours inquiry call-backs to tour booking and renewals, plus the fair housing and consent rules.
In plain English: robots need a yes first. Calls with a person on the line can rest on consent or on another GDPR basis. The text of article 66 doesn't mention legal persons or B2B.
2. Does an AI voice agent count as an automated call?
Nobody has settled that yet, so plan for the stricter reading. Article 66.1.a speaks of calls "sin intervención humana", meaning with no human involved. A voice agent that holds a live conversation with no person on the call fits that wording on its face. We found no regulator decision or court ruling that decides it either way.
The AEPD's own circular leaves the point alone. Article 1.2 of Circular 1/2023 says it doesn't cover the right in article 66.1.a. So the legitimate-interest guidance below applies to calls with human involvement, and it isn't safe to assume it stretches to an AI agent.
The conservative setup is simple: get prior consent for every number an AI agent calls. If a lawyer tells you a lighter basis works for your case, that's your call to make with written advice. Topcalls AI voice agents don't change what the law asks of the caller.
3. What did the 2023 AEPD circular change?
The circular didn't change the law. It told companies how the AEPD, Spain's data protection authority, would apply article 66.1.b from 29 June 2023. It accepts legitimate interest as a basis for commercial calls, but it sets tight conditions and several duties that apply on every call.
Random numbers: commercial calls to randomly generated numbers need the user's prior consent (article 2).
Presumption of legitimate interest: the AEPD presumes it where there's a prior contract and the call is about similar products of the company's own (article 3). It won't presume a reasonable expectation where there's no contract and no request or interaction in the last year.
Exclusion lists: check them before calling (article 4).
On the call: state the company's identity and the commercial purpose, and tell the person they can withdraw consent or object. Treat any clear refusal as a withdrawal and act on it at once. Record calls to prove compliance (article 6).
A circular guides how the AEPD acts. It isn't a statute, and a court can read the law differently.
4. Can you cold call businesses in Spain?
You can call businesses only with a lawful basis, and Spain's data protection law gives B2B a helpful presumption. Article 19 of the LOPDGDD presumes legitimate interest for processing the professional contact details of people who work for a company, when you use only the data needed to reach them for business purposes.
The presumption is rebuttable, and article 66 has no B2B exemption of its own. The AEPD circular (article 5) repeats that presumption for people who work for a company, sole traders and liberal professionals, in the cases the LOPDGDD sets. The circular's preamble limits it to offers tied to their professional or business activity.
So a call to a sales director about business software has a stronger footing than a call to the same person about a personal product. For AI agents, the stricter reading in section 2 still applies. Keep the list tied to the person's role, call about your offer for that role, and keep a record of where you got the number.
5. Do you have to check Lista Robinson?
Yes, before you call people you have no consent from. Article 23.4 of the LOPDGDD says those who want to make direct marketing communications must first check the advertising exclusion systems that could affect them, and exclude the data of anyone who objected. The circular says the same in article 4.
Lista Robinson is the best-known system. It's run by Adigital and covers phone, post, email and SMS. Its FAQ says companies must check it when they want to send personalized advertising to someone who hasn't given express consent. People registered on the list can still be contacted by companies they consented to.
Topcalls doesn't keep a do-not-call list. Your team runs the check, removes the matches before you upload the list, and removes anyone who says stop. That fits Smart Campaigns, where you control who is in the list.
6. Does the AI have to say it's an AI?
Say it at the start, in plain words. Two texts point that way. The AEPD circular asks you to state your identity and the commercial purpose at the start of each call. And the EU AI Act, article 50(1), asks providers to design AI systems that interact with people so that the people are told they're dealing with an AI, unless that's obvious.
The Commission's AI Act Service Desk lists that obligation, and its Article 113 page says the Regulation applies from 2 August 2026. The 2026 omnibus changed other dates, but we found nothing that moved article 50(1). Article 50(1) puts the design duty on the provider. A campaign operator still shouldn't leave the person guessing.
A good opening runs one breath: "Hi, this is an automated assistant calling for Acme Software about your trial. This call may be recorded. You can ask me to stop at any time." See our AI disclosure laws guide for the wider picture.
7. What about the 400 prefix for commercial calls?
Spain created a dedicated number range, 400, for commercial calls, but it binds only companies inside the scope of Ley 10/2025 on customer service. A Resolution of 14 April 2026 (effective 17 April 2026) assigns the 400 code to commercial calls. It requires the range to be fully operational within six months.
Per the Resolution, companies within the scope of the law can't use any other range for commercial calls after that. 400 numbers work only for outbound commercial calls. The scope in Ley 10/2025 covers basic services of general interest and consumer-facing companies with at least 250 staff, over EUR 50 million turnover or over EUR 43 million balance.
An industry association has challenged the rule before the Audiencia Nacional, per a June 2026 interview, and we couldn't confirm the outcome of its request for interim measures. If you sell to Spanish consumers from a large company, check your status with a lawyer. If you're a smaller company, ask your carrier how it treats commercial calls, because Ley 10/2025 article 16.4 lets operators block calls with signs of commercial use from numbers without the specific code.
8. What are the fines for breaking the rules?
A breach of article 66 can cost up to EUR 2,000,000 if graded grave, or up to EUR 100,000 if graded minor, and the AEPD is the authority that sanctions it. The LGT lists the grave infraction in article 107.30, the minor one in article 108.11 and the fine caps in article 109.1.
Which grade applies to a given call is our reading of how the articles fit together, not a quoted rule. GDPR sits on top of it for the data you process, and the right to object to direct marketing at any time is in article 21 of the GDPR. Once someone objects, the data stops being used for that purpose.
9. How do you set up a compliant AI calling campaign for Spain?
Build the campaign around consent first and keep proof. Use a short checklist and keep the records for every number.
Decide the basis per list: consent, existing customers or B2B legitimate interest. Write it down.
For an AI agent, get prior consent for each number, with the wording on your form.
Check Lista Robinson and your own opt-out list before upload.
Open each call with who you are, why you're calling, that it's an automated assistant and how to opt out.
Set calling hours and retries per campaign. Topcalls dispatches calls only inside the hours and weekdays you set, with 1 to 10 attempts per lead.
Keep recordings and transcripts. Topcalls sends a webhook after each call with both.
It doesn't fit when you have no consent for the numbers, when the list came from a scrape or random dialing, or when nobody can handle opt-outs the same day. It also doesn't fit when your legal basis rests on a reading nobody has tested for AI agents.
In those cases, build consent first with forms, events or inbound requests, then call. Want to see how a consent-based Spanish campaign would run? Book a strategy call.
