Cold Calling Laws in Italy: RPO Register, 15-Day Scrubs, TIM Fine

November 2, 2026. In Italy a cold call can be blocked before it rings and fined after it does. Since 27 July 2022 the Registro pubblico delle opposizioni, the public opt-out register, has covered every national fixed and mobile number, listed or not, and registration cancels any marketing consent the person gave before, except to companies they hold a contract with. An operator must register with the RPO, buy an annual subscription priced by list size, from 68 euro for 10,000 numbers to 43,040 euro for 10 million (band 45 of 60-plus), and check its lists "mensilmente, e comunque precedentemente all'inizio di ogni campagna promozionale": monthly and before every campaign, with each check valid for only 15 days. Since late November 2025 the telecoms regulator AGCOM has had carriers block international calls that spoof an Italian mobile number, extending an earlier block on spoofed fixed numbers under the same 2025 resolution; in the first eight months of 2026 the filters stopped about 191 million calls, 790,000 a day. And on 31 July 2026 ANSA reported that the privacy regulator had fined TIM 9,516,000 euro over calls made for it from unregistered or spoofed numbers, often to RPO-registered lines. Below is how each piece works, from the register's own operator rules to the AGCOM figures, and what a business-to-business caller has to do differently in Italy.

The register: who must subscribe and what it costs

The RPO is run by the Fondazione Ugo Bordoni for the Ministero delle Imprese e del Made in Italy under Presidential Decree 26 of 27 January 2022. Its operator page says registration is required for "tutti gli operatori (qualunque soggetto, persona fisica o giuridica)" who, as data controllers, intend to use national fixed and mobile numbers by telephone or paper mail for "Invio di materiale pubblicitario, Vendita diretta, Comunicazione commerciale, Compimento di ricerche di mercato." That covers advertising, direct sales, commercial communication and market research. The decree's definition of a subscriber, "qualunque persona fisica o giuridica, ente o associazione," includes companies, and the operator rules cover every national number, so a B2B caller must scrub its lists too.

Registration runs through a certified email with digital signature, or email plus registered letter, followed by a first purchase of checks and access through SPID, CIE or a digital certificate. For 2026 the Ministry's decree of 22 December 2025 confirmed a subscription model that expires on 31 December 2026, priced by how many numbers the operator's telemarketing lists hold that year. A number checked once can be rechecked free all year within daily limits; subscriptions run to year end regardless of use, with no pro-rating; and operators fined for RPO violations in the previous five years pay "tariffe maggiorate del 10%."

The table on the register's site runs to more than 60 bands; the rows above are a selection. For a small outbound team the cost of compliance is therefore trivial, 68 euro a year for a 10,000-number list, and the cost of skipping it is not.

The 15-day rule and the other decree obligations

Article 8(2) of the decree is the operating rule: operators "hanno l'obbligo di consultare mensilmente, e comunque precedentemente all'inizio di ogni campagna promozionale, il registro pubblico delle opposizioni e di provvedere all'aggiornamento delle proprie liste. La consultazione del registro da parte di ciascun operatore ha efficacia pari a quindici giorni" for telephone processing "con o senza operatore," and 30 days for paper mail. A list scrubbed on the 1st is stale on the 16th. The register runs each check within 24 hours and keeps access logs for 24 months.

Article 2(2) makes the decree apply to calls "sia tramite operatore, sia ... mediante sistemi automatizzati di chiamata o chiamate senza l'intervento di un operatore," so robocalls and AI voice calls are inside it, and the home page states the consequence of registration for consent: "L'iscrizione annulla anche i consensi precedentemente rilasciati, tranne quelli che saranno autorizzati dopo l'iscrizione e quelli con i soggetti con cui si ha un contratto." Article 9 requires operators and call centres calling national numbers to "garantire la presentazione dell'identificazione della linea chiamante," caller line identification, with AGCOM policing it. Article 10 requires the caller, unasked, to tell the person where their data came from and how to register in the RPO. The register's operator page points to the GDPR: fines "fino a 20 milioni di euro o per le imprese, fino al 4% del fatturato mondiale totale annuo dell'esercizio precedente, se superiore."

The TIM fine: a code of conduct is not a shield

On 31 July 2026 ANSA reported that the Garante per la protezione dei dati personali had fined TIM "9 milioni e 516mila euro" for telemarketing and privacy violations. The case grew from complaints about unwanted promotional calls made on TIM's behalf, "circa 7.000 nel 2025," about 7,000 in a year. The calls came from "numerazioni non censite al Registro degli operatori di comunicazione (Roc) o alterate (spoofing), spesso dirette a utenze iscritte al Registro pubblico delle opposizioni (Rpo)." The Garante's reasoning, as ANSA reports it, is the part every company that outsources calling should read: "l'adesione a un codice di condotta ... non esonera il titolare del trattamento dall'obbligo di vigilare sull'operato dei propri partner e di verificare l'effettiva applicazione delle misure di protezione dei dati lungo l'intera filiera del telemarketing." Joining a code of conduct does not relieve the controller of the duty to supervise its partners along the whole telemarketing chain. The regulator also found TIM systematically failed to answer access, erasure and objection requests and ran unsubscribe procedures that were "eccessivamente complesse e, in alcuni casi, non funzionanti."

The scheme the agencies ran is worth describing because it is designed to look compliant. Spoofed calls went to RPO-registered numbers; interested people were texted a link to a partner web form that generated a "Lead"; a call centre then called back from a properly registered number "al fine di generare un flusso telefonico apparentemente lecito," producing a paper trail of a customer-initiated request. Italy has such a code: the register's news page reports that the Codice di Condotta for telemarketing and teleselling, promoted by Asseprim, AssoCall, Assocontact, Assotelecomunicazioni, Confcommercio, Confindustria, DMA Italia and O.I.C., was approved by the Garante with a monitoring body accredited on 7 March 2024, and applies to companies based in Italy, Europe or other countries that sell by phone to users in Italy. The Garante's own site could not be opened from our browser today, so the ANSA report is the source for the fine.

AGCOM's spoofing filter: 191 million calls blocked

The second enforcement arm is technical. AGCOM's press release of 12 October 2026 reports that filters required by resolution 106/25/CONS on international calls carrying an Italian number "hanno impedito la consegna ai cittadini italiani di decine di milioni di chiamate illecite, originate dall'estero con numero italiano." The figures:

1. "Nei primi otto mesi del 2026 i filtri anti-spoofing ... hanno bloccato circa 191 milioni di chiamate (7,2% del totale) provenienti dall'estero con numero chiamante (CLI) italiano contraffatto o con numero non conforme alle specifiche internazionali, in media circa 790 mila al giorno."
2. Compared with 1 to 18 November 2025, "prima dell'estensione del blocco alle numerazioni mobili italiane," calls from abroad showing an Italian mobile number fell "del 95%, da 26,8 a 1,2 milioni al giorno," and total international traffic fell by about two thirds, "da 34 a 11 milioni di chiamate giornaliere."
3. Of the blocked calls, 38 million carried an Italian fixed number, 148 million an Italian mobile number, and 4.6 million a number "non conforme alle specifiche internazionali."
4. After an initial shift to foreign numbers, that traffic fell back to pre-filter levels, which AGCOM reads as showing "la non efficacia di tale numerazione estera per attività di teleselling e telemarketing di servizi in Italia."

The same release announced fines of 700,000 euro on Retelit Digital Services S.p.A. and 122,500 euro on Tekmind S.r.l., by resolutions 229/26/CONS and 230/26/CONS of 23 September 2026, for failing to check numbers used by call centres, including spoofed ones, and to manage assigned numbering diligently. For a foreign company the consequence is plain: a call from abroad showing a spoofed Italian number is dropped by the carriers, and AGCOM finds foreign numbers ineffective for teleselling in Italy. Legitimate access means an Italian numbering resource assigned through a registered operator, or a partner inside Italy.

What this means for a team calling Italy

1. Subscribe to the RPO before the first call, in the band that matches your list, and automate a fresh check every 15 days and before each campaign. Keep the returned lists and the access logs; the register keeps access logs for 24 months.
2. Do not rely on old consents. Registration in the RPO wipes consents given before it, except for existing contract holders. A consent database older than the person's registration date is worthless for them.
3. Scrub business numbers too. The operator rules cover every national fixed and mobile number, and the decree defines subscribers to include legal persons.
4. Show a real Italian caller ID from a legitimate assignment. Spoofed Italian numbers from abroad are filtered; AGCOM finds foreign numbers ineffective; false caller ID is a GDPR and AGCOM matter.
5. Supervise every agency and lead source. The TIM decision makes the vendor's conduct the controller's problem; see TCPA vicarious liability for how the same idea works in US law.
6. Treat AI and recorded voices as inside the decree. Calls "senza l'intervento di un operatore" are expressly covered.

For the email side of Italian outreach, which runs on a different consent rule, see cold email laws in Italy, and for how Italy compares with the rest of Europe, cold calling laws by country. Related: TCPA-compliant AI calling and the best AI voice agents in 2026. This is general information, not legal advice.