Cold sales calls with a voice agent, what Spanish law allows

A cold call is a call to sell something to someone who has not given you permission for it. A number from a bought database, from a phone directory or dialled at random.

You cannot do that with a Lera voice agent, and it is not our rule. Since June 2023 Spanish law requires the prior permission of the person receiving a sales call, with very narrow exceptions, and when the call is made by an automated system there is no exception at all.

What your agent can do is call your customers about things that are not sales, such as an appointment reminder or a notice about an incident, and call back people who ask for it from your website. The details are below, with each rule named.

Spain’s General Telecommunications Act (Ley 11/2022, of 28 June) grants two rights in Article 66.1 to anyone with a phone line, whether a private person or a business.

The first, in letter a), is not to receive automated calls without human intervention for sales purposes unless they have consented beforehand.

The second, in letter b), is not to receive unwanted sales calls, unless the person has consented beforehand or the call can rely on another legal basis under Article 6.1 of the GDPR.

Letter b) has applied since 29 June 2023, one year after the law was published (sixth final provision). Before that it worked the other way round, and you could call anyone who had not objected. Now the starting point is no.

For consumers, Spain’s consumer protection code says the same in Article 96.3. Calling with an automated system without human intervention requires their express prior consent.

The Spanish Data Protection Agency (AEPD) issued Circular 1/2023, of 26 June, to explain how letter b) applies. In plain terms, these are its criteria.

Only two legal bases work. The person’s consent, given under the GDPR, or your company’s legitimate interest, which you have to weigh and be able to justify.

Legitimate interest is presumed when the person is already your customer, you obtained their number lawfully and the call offers products or services of your own company similar to the ones they bought. Without a relationship or a contact in the last year, the AEPD does not assume that person expects your call.

Randomly generated numbers cannot be called without consent. People listed in a phone directory can only be called if they gave specific consent for marketing.

Before a campaign you have to check the advertising opt-out registers, such as Spain’s Lista Robinson, except for people who gave you their consent (Article 23 of Organic Law 3/2018 on data protection).

And at the start of every call you have to say who is calling, that the call is to offer something, and how to stop receiving these calls. If the person says they want no more calls, that is honoured on the spot.

One detail matters here. The circular itself says it does not cover letter a), the automated calls. Its legitimate interest route is for calls made by a person.

A voice agent calls without a person from your company on the line. The AEPD’s example of an automated call is a pre-recorded message, and neither the law nor the authority has yet ruled on agents that hold a conversation. But an agent is a system that calls and speaks without human intervention, and the safe reading is to treat it as one.

In practice, this means that for a sales call made by an agent the legitimate interest route does not work, not even with existing customers. That person must have given you permission beforehand to receive that kind of call.

With that permission a sales call is possible, with everything above. Say at the start who is calling and why, offer a way to stop the calls and, if your company is in scope, call from a 400 number. To consumers, on top of that, only on working days and between 9 am and 9 pm, as Article 96.2 of the same consumer protection code requires.

Spain’s Customer Service Act (Ley 10/2025, of 26 December) requires in Article 16.3 that sales calls come from a dedicated numbering code, separate from customer service. A resolution of 14 April 2026 from the Secretary of State for Telecommunications (BOE-A-2026-8409) assigned that code, 400.

Since 17 October 2026, companies covered by that law can only make sales calls from a 400 number. A 400 number can only make calls, it cannot receive any or be used for customer service, and only a telecoms operator can hold one and assign it to you.

Who it applies to is the nuance much of the press skipped. Not every company, only those covered by Ley 10/2025 (Article 2). Basic services of any size, meaning water, electricity and gas, passenger transport, postal services, electronic communications and financial services. And companies that sell mainly to consumers and have 250 employees or more, turnover above 50 million euros or a balance sheet above 43 million. Small electricity, gas and phone retailers with less than 5 % of the market and below those sizes are exempt from this part (single transitional provision).

For a clinic, a field service business or a small academy, the 400 number is not mandatory. But the 400 only decides where you call from, not whether you may call. The person’s permission is still required.

If your company is in scope, ask your operator for a 400 number and connect it to Lera as your own number over SIP. A Lera inbound line cannot be used for that.

There is one more risk. The same law lets operators block numbers that show signs of making sales calls without the 400 code or without complying with Article 66.1 of the Telecommunications Act (Article 16.4). A line that makes a lot of sales calls can end up blocked, even if the company is small.

Order TDF/149/2025, of 12 February, bans the use of mobile numbers for customer service and for unsolicited sales calls (Article 9). It has applied since 7 June 2025 and covers every company, large or small.

Call your customers about something that is not a sale. An appointment reminder, a notice about an incident or a delay, confirming an order or a delivery, a satisfaction survey with no offer in it. These calls have no sales purpose, whatever the size of your company, and they can go out through your Lera inbound line.

What counts is why you call, not what you call it. A “reminder” with an offer inside is a sales call.

You also need to be entitled to use the number for that. Someone who gave you their phone when booking or ordering expects a call about that booking or that order. And at the start of the call, your agent has to say who is calling and why.

An academy, for example, can remind a student that their course starts on Monday, tell them about a room change or confirm their enrolment. What it cannot do is call a list of people who never asked for anything to sell them a course.

Then there is the “call me back” mode on your website. The visitor types their number and asks to be called, and your agent calls them. They asked for the call, and the agent should talk about what they asked for.

Lera only dials between 9 am and 8 pm, mainland Spain time, and never outside your agent’s opening hours if you have set them. It does not block weekends or public holidays on its own, so if you make consented sales calls to consumers, give your agent a Monday to Friday schedule with your holidays.

It only calls Spanish numbers, and never premium-rate numbers such as 806 or 902.

If someone asks not to be called again, you add them to your opt-out list, by asking Maite or from your own software, and Lera will not dial that number again.

The website “call me back” mode requires a check that the visitor is a person, and follows the same calling hours.

And the Customer Agreement puts it in writing. Lera cannot be used for calls or campaigns that break telephony, marketing communications or data protection rules, and opt-out lists and requests not to be called must be respected.

What Lera does not do for you is check that you have each person’s permission or look them up in the Lista Robinson. That is your job, as the company that decides who to call.

What if I call businesses rather than consumers? The Telecommunications Act protects anyone with a phone line, individuals and companies alike. For calls made by a person, data protection law presumes it lawful to use professional contact details for matters related to their work, but the rule on automated calls makes no such distinction. With an agent, count on needing their prior permission too.

Can I call an existing customer to offer them something? If a person from your company calls, the AEPD presumes legitimate interest when you offer something similar to what they already bought. If your agent calls, the safe route is to have asked them beforehand for permission to receive that kind of call.

Is a satisfaction survey a sales call? If it carries no offer, no. If at the end of the questions the agent proposes a discounted renewal, yes.

What do I do if someone says on the call that they want no more calls? Add them to your opt-out list that same day. According to the AEPD, any clear way of saying they want no more calls has to be honoured immediately.

My company is small and is not in energy or banking, do I need a 400 number? No. The 400 number applies to companies covered by Ley 10/2025. Even so, to sell by phone you need each person’s prior permission.

Is this legal advice? No. It is a practical explanation of the rules in force today. If you are going to run a sales campaign, review it with your legal adviser first.