October 26, 2026. Since 17 October 2026, sales calls in Spain must come from a nine-digit number starting with 400, and operators must block numbers that show signs of commercial calling without that code. The rule sits on top of the consent rule in force since 29 June 2023: a sales call needs prior consent or another legal basis under the GDPR, which the data protection authority (AEPD) reads narrowly, and an automated commercial call with no human on the line needs prior consent in every case. That second rule is the one an AI voice agent meets. A serious breach can cost up to €2 million.
Key numbers
| Item | Number |
|---|---|
| Sales calls only from 400 numbers since (six months after the 400 resolution took effect) | 17 October 2026 |
| 400 resolution in force (published in the BOE on 16 April) | 17 April 2026 |
| Consent rule for sales calls applies since (article 66.1(b), Law 11/2022) | 29 June 2023 |
| Maximum fine, serious infringement (AEPD, articles 109 and 114) | €2,000,000 |
| Maximum fine, minor infringement (AEPD, articles 109 and 114) | €100,000 |
| Law 10/2025 size test, any one of (counted at group level) | 250 staff, €50M turnover or €43M balance sheet |
| 400 numbers per block assigned to carriers (by the CNMC) | 1,000 |
| Legitimate interest lapses after (contract ended and no request or interaction) | 1 year |
| EU AI Act AI disclosure applies since (article 50(1)) | 2 August 2026 |
Statute and regulator texts read on 26 October 2026 in the BOE (Resolution of 14 April 2026, Law 10/2025, Law 11/2022, AEPD Circular 1/2023), on aepd.es and on EUR-Lex.
The 400 number rule since 17 October
- Where it comes from. A resolution of the Secretary of State for Telecommunications of 14 April 2026, in force from 17 April, gave the 400 code to commercial calls with six months to make it work; after that, commercial calls may only use the 400 range. It implements article 16.3 of Law 10/2025 on customer service.
- Outbound only. A 400 number cannot receive calls or serve customers, and operators may let their customers block the whole range; service lines use short, 800, 900 or geographic numbers (Redes&Telecom).
- Who must use it. Companies inside Law 10/2025: providers of water, gas, electricity, passenger transport, postal, electronic communications and financial services in Spain, and consumer-facing businesses with at least 250 staff, turnover above €50 million or a balance sheet above €43 million at group level, wherever established. Small electricity, gas and telephone retailers below a 5 percent market share are exempt for now.
- Who else is exposed. Article 16.4 tells operators to block any number with signs of commercial calling without the code, or without respecting the consent rules of the telecoms law, whoever holds it. A small agency's dialer is inside that filter too.
- Numbers come from your carrier. Only operators can hold 400 numbers, assigned in blocks of 1,000 by the CNMC (BOE notice).
Consent, legitimate interest and AI callers
Article 66.1 of the General Telecommunications Law (Law 11/2022) gives two rights. Under 66.1(a), automated commercial calls without human intervention need prior consent, which covers an AI agent that dials and talks alone. Under 66.1(b), other unwanted sales calls need prior consent or another basis in article 6.1 of the GDPR. The AEPD's Circular 1/2023 and guidance set the limits:
- Legitimate interest means your own customers. It is presumed only after a prior contract, for similar products from the same company; group companies need consent, and a year after the contract ends with no further contact, the calls stop.
- Generated numbers need consent, and so do numbers from phone directories unless the listing records it.
- Check the exclusion lists, such as the Lista Robinson, where article 23 of Spain's data protection act requires it.
- B2B contacts start with a presumption. Contact data of company staff, sole traders and professionals is presumed lawful on the terms of article 19 of that act.
- Every call opens the same way: who is calling and for whom, that it is commercial, and how to object. Any clear refusal is an objection, and recording the call is the suggested proof.
The AEPD fines breaches of these rights up to €2 million for a serious infringement and up to €100,000 for a minor one (articles 109 and 114 of Law 11/2022).
What it means for operators
- Get a 400 number through your carrier before any Spanish campaign.
- Point the AI agent at consent: inbound calls, requested callbacks and opted-in follow-ups. A cold AI dial needs prior consent.
- Keep people on cold B2B calls to work contacts, after a Lista Robinson check.
- Disclose the AI. Article 50(1) of the EU AI Act, applicable since 2 August 2026, requires AI systems that talk to people to say so unless it is obvious.
That is the consent-first design we build into every compliant AI calling setup, with an AI call answering agent for inbound. For email, read our Spanish cold email guide; compare Germany and Austria and the cold calling laws by country table. This is a summary of public documents, not legal advice.
Frequently Asked Questions
Yes, within limits. Since 29 June 2023, article 66.1(b) of Law 11/2022 lets a business make a sales call only with the person's prior consent or another GDPR basis such as legitimate interest, which the AEPD presumes mainly for existing customers and work contacts. Since 17 October 2026 the call must also come from a 400 number, and automated calls with no human on the line need prior consent.
The 400 range is the numbering Spain gave to commercial calls in a resolution of 14 April 2026, in force from 17 April, with six months to make it operational. Since 17 October 2026 companies covered by Law 10/2025 may make sales calls only from 400 numbers, which are outbound only and cannot be called back, and operators must block numbers that show signs of commercial calling without the code.
Only with prior consent if it calls without human intervention. Article 66.1(a) of Law 11/2022 gives people the right not to receive automated commercial calls without human intervention unless they consented first. The call must also come from a 400 number, open with the caller's identity, purpose and right to object, and disclose the AI under article 50(1) of the EU AI Act.
The AEPD enforces the call rights in article 66 of Law 11/2022 and can fine a serious infringement up to 2 million euros and a minor one up to 100,000 euros under articles 109 and 114. Operators can also block numbers that make commercial calls without the 400 code.