Disclaimer
This resource is for general informational purposes and is not legal advice.
Spain Do Not Call Laws
Last reviewed:
Spain regulates outbound commercial calls nationally through Law 11/2022, Organic Law 3/2018, and AEPD Circular 1/2023. Businesses generally must have prior consent or another valid GDPR legal basis, and must consult the Lista Robinson advertising-exclusion system before direct-marketing campaigns where no such consent exists.
Compliance at a Glance
B2C Calls
Yes
B2B Calls
Partial
Scrubbing Frequency
Before every campaign.
Maximum Fine
Up to 40,000 euros for repeated violations.
Primary Regulators
Agencia Española de Protección de Datos (AEPD)
Relevant Regulations
Ley 11/2022 Telecomunicaciones
Ley Orgánica 3/2018
Circular 1/2023 de la AEPD
Do you need to screen phone numbers against the Lista Robinson?
Before making outbound sales calls into Spain, treat unsolicited commercial calling as restricted by default: you generally need prior consent or another valid GDPR legal basis, with legitimate interest interpreted narrowly. Screen campaigns against the Lista Robinson where required, suppress anyone who objects, and make the required disclosures at the start of the call. B2B is mixed: purely corporate numbers fall outside the Lista Robinson/data-protection framework, but calls to named professional contacts, sole traders, and liberal professionals still require careful GDPR analysis and objection handling.
How often do you need to scrub against the Lista Robinson?
Scrubbing requirements
National/Lista Robinson: before conducting direct-marketing communications, organizations must consult advertising-exclusion systems that may affect the campaign and exclude persons who have expressed opposition or refusal (Organic Law 3/2018, Article 23.4). It is sufficient to consult the exclusion systems appearing on the supervisory authority's published list. AEPD guidance expressly states that advertising campaigns must consult these systems and exclude enrolled individuals. Lista Robinson primarily protects an enrollee against advertising from businesses with which the person is not a customer and to which the person did not consent; enrollment does not override a valid consent or every permissible existing-customer communication. Independently of Lista Robinson, an unequivocal request during a call not to receive further calls must be treated immediately as withdrawal of consent or exercise of the right to object. No separate statutory internal do-not-call-list format or vendor-specific technical process was verified, but controllers must operationally suppress such objectors to honor that right.
Scrubbing frequency
The verified law requires consultation before undertaking direct-marketing communications/campaigns; no fixed recurring cadence (such as every 30 or 31 days) was identified in the reviewed primary sources. AEPD states that an individual's Lista Robinson enrollment becomes effective beginning in the second month after registration. Accordingly, campaign screening must account for enrollments that have become effective, but a specific periodic refresh interval could not be verified.
Do Spanish Do Not Call laws apply to B2B calls?
B2C Calls —
Yes
This clearly applies in B2C contexts because the rules are aimed at protecting individuals from unwanted marketing calls and other direct marketing. Companies contacting consumers generally need prior consent or another valid legal basis, and they must check applicable advertising-exclusion lists before running campaigns unless a clear exception applies. Consumer-facing teams should treat this as a core compliance step for phone, SMS, email, and similar outreach.
B2B Calls —
Partial
This applies only partly in B2B settings. The main exclusion list is designed for natural persons, so it generally does not function as a business-to-business do-not-call register for companies, but it can still affect outreach to sole traders, liberal professionals, and individual business contacts where personal data is involved. Businesses making B2B marketing calls should check whether they are contacting a person in a protected personal or professional capacity and be prepared to honor objections.
What requirements apply when making outbound calls in Spain?
• Before making an unsolicited commercial call, obtain prior consent or establish another GDPR legal basis; the research identifies consent and legitimate interests as the practical bases.
• Treat legitimate interest narrowly: it is generally presumed only where there was a prior contractual relationship, the contact data were lawfully obtained, and the same company is offering similar products or services.
• Do not assume a reasonable expectation of a call where there has been no current contract, request, or interaction during the previous year, and obtain prior consent for randomly generated numbers.
• Use numbers from subscriber directories for commercial calls only where there is prior specific consent for that use, generally expressed in the directory.
• For professional contacts, sole traders, and liberal professionals, rely on presumed lawful processing only within Organic Law 3/2018 Article 19 limits and when the offer concerns their professional or business activity rather than them privately.
• At the start of every commercial call, identify the business, identify the party represented when applicable, explain the commercial purpose, and state how the person can withdraw consent or object to future calls.
• Highlight the right to object no later than the first communication and honor any unequivocal refusal immediately; recording, third-party contact sourcing, profiling, segmentation, and data enrichment each require their own legal basis and GDPR compliance.
• Treat automated calls without human intervention as separately governed; also use compliant caller numbers because certain empty, invalid, unallocated, or restricted numbers may be blocked, while no generally applicable national calling-hours, abandonment, or frequency cap was verified in the research.
What are the penalties for violating Spanish Do Not Call laws?
Violations involving unlawful processing, invalid consent, failure to honor objection rights, or noncompliance with direct-marketing suppression duties are enforceable by AEPD under the GDPR and Organic Law 3/2018. GDPR Article 83 permits administrative fines, depending on the violated provision, up to EUR 10 million or 2% of worldwide annual turnover, or for the higher tier up to EUR 20 million or 4% of worldwide annual turnover, whichever is greater. AEPD also has corrective powers under GDPR Article 58, including warnings, reprimands, orders to comply or erase/restrict data, processing bans, and fines. Data subjects may seek compensation for material or non-material damage under GDPR Article 82. A Spain-specific fixed per-call statutory award or private telemarketing cause of action comparable to the U.S. TCPA was not identified. Separate penalties under Law 11/2022 or Order TDF/149/2025 for particular numbering/telecommunications violations could not be reliably quantified from the reviewed extracts.
What exemptions apply to Spanish Do Not Call laws?
In Lista Robinson, if a person has given valid GDPR-style consent to receive commercial calls from a specific sender, that sender does not need to check the exclusion list for that person. The consent must meet the GDPR standard in Article 4(11), meaning it must be freely given, specific, informed, and clear.
Source page
In Lista Robinson, a controller may generally rely on a presumed legitimate interest to make calls about its own similar products or services when there is an existing contract with the person. This does not extend to other companies in the same group. The presumption also does not apply if there is no contract in force and no interaction with the person in the last 12 months.
Source page
In Lista Robinson, only natural persons can register. Because of that, legal entities and purely corporate phone numbers are not covered by the registry, so there is no exclusion-list duty for them.
Source page
In Lista Robinson, registration does not take effect right away. According to the FAQ, it can take up to two months, and calls made during that waiting period are not treated as list breaches.
Source page
In Lista Robinson, calls that are not commercial are outside the rules in Art. 66.1.b) of the LGT and Art. 23 of the LOPDGDD. This includes informational, contractual, service, administrative, and other non-marketing calls.
Source page
In Lista Robinson, business and professional contact details are generally presumed lawful when they are the contact data of employees of legal entities, sole traders, or liberal professionals. This presumption applies within the limits set by Article 19 of the LOPDGDD and Circular 1/2023, Article 5.
Source page