Spain has tightened the screws on unwanted commercial calls, and the legal framework now gives consumers clearer tools than ever. Under the General Telecommunications Law, companies generally cannot call you to sell something without your prior consent or another valid legal basis. Since October 17, 2026, commercial calls may only originate from nine-digit numbers beginning with 400. The Robinson List remains the central opt-out registry, but knowing where to complain when rules are broken is just as important.
- Consent is the default rule: Article 66 of Law 11/2022 grants users the right not to receive unwanted commercial calls unless they have given prior consent or another GDPR legal basis applies.
- The 400 prefix is now mandatory: Commercial calls must come from 400-prefixed numbers, which are one-way and cannot be returned; operators must block calls that violate the rule.
- The Robinson List is free but not instant: Registration can take up to two months to become fully effective and does not stop companies that already have your consent.
- Complaints have a clear path: Start with the company, then escalate to the AEPD, the OAUT or CNMC, or AUTOCONTROL mediation depending on the violation.
What the Law Says About Unsolicited Sales Calls
The reference statute is Law 11/2022 of June 28 on General Telecommunications, specifically Article 66, complemented by the customer service law of December 2025 and guidance from the Spanish Data Protection Agency (AEPD). In general, unsolicited commercial calls are unlawful unless the user has given prior consent or the call can rely on another legal basis under Article 6.1 of the GDPR.
That final nuance leaves the door slightly ajar. The GDPR recognizes legitimate interest among its legal bases, and the AEPD notes that a company may process your data for advertising purposes without consent in some cases, for example if you are already a customer. In practice, your electricity provider has an easier path to call you than a complete stranger does.
For automated calls without human intervention, the rule is stricter: Article 66.1.a) always requires prior consent. The law’s final provision delayed the entry into force of the general right in Article 66.1.b) by one year from publication, so it has been in force since summer 2023.
A lesser-known detail: Article 62.1 of the General Consumer Protection Law, as amended by the customer service law, presumes there is no intention to contract—and that the contract is void—when it is signed by phone in breach of unsolicited call rules. It also considers that no consent exists for that call if consent was not obtained or renewed expressly in the previous two years. If a rate change was slipped past you on an unauthorized call, that is your strongest argument.
The 400 Prefix: What Changes for Consumers
Since October 17, 2026, according to the Ministry for Digital Transformation’s Q&A document, commercial calls may only be made from nine-digit numbers starting with 400. These are one-way numbers that cannot be called back. Customer service remains available through specific short numbers, the free 800 and 900 ranges, or geographic numbering.
The legal basis is Article 16 of Law 10/2025 on customer service. Its section 4 requires operators to block calls from numbers suspected of making commercial calls without the specific code or without complying with Article 66.1 of the telecommunications law. The practical consequence is simple: if a commercial call reaches you from a normal mobile or landline number, the company is already in breach.
The Robinson List: How It Works and What It Cannot Do
The Robinson List is a free service managed by the Spanish Association of the Digital Economy (Adigital). You register, verify your email, and choose the channels through which you do not want to receive advertising: phone, postal mail, email, or SMS/MMS. Anyone over 14 can register, and an adult can register a minor under 14 in their care.
According to the service itself, companies that want to send you personalized advertising without your express consent have a legal obligation to consult the list. Two limits are worth keeping in mind:
- It takes time to take effect. Registration can take up to two months to become fully effective because campaigns may already be running with your data. The AEPD gives the same estimate: effective from the second month.
- It does not stop companies that already have your permission. If you are a customer or have given consent, the list will not stop that company. You must withdraw consent directly with that business.
The AEPD also links to another exclusion list, Stop Publicidad. Signing up does not work miracles in the first week.
Where to Complain If the Calls Continue
It depends on what the call violates, and it is worth following an order. First, contact the company. The AEPD explains that you can withdraw consent at any time through a simple means, or exercise your right to object by indicating the phone number you do not want used for commercial purposes. If you do not know whom to contact, the AEPD suggests asking the company itself or checking the data protection information on its website.
If the company ignores you, these are the channels:
- AEPD. Article 114 of Law 11/2022 gives it sanctioning power when the privacy rights in Article 66 are violated. Serious infringements carry fines of up to 2 million euros, and minor ones up to 100,000 euros (Article 109). On its telecommunications complaints page, updated September 14, 2026, the Agency stresses that processing is faster the more evidence you provide: the calling line number, the date and time of the call, and a copy of your requests to the company.
- Telecommunications User Service Office (OAUT) or CNMC. This is the route the ministry points to if you continue receiving commercial calls from unauthorized numbering, meaning without the 400 prefix. If the problem is with your own operator, the Ministry of Consumer Affairs indicates that you must first complain to the operator within one month of learning of the problem; the operator has another month to respond, and if it does not or the response is unsatisfactory, you have three months to go to the OAUT.
- AUTOCONTROL mediation. It is free, has operated since January 2018, and the main operators (Movistar, Orange, Vodafone, the MásMóvil group and its brands) are adhered to it, according to the AEPD.
If the call is not selling anything but trying to deceive you, it is fraud: the anti-scam plan under Order TDF/149/2025 has blocked more than 400 million calls since March 2025, according to the ministry. And when you see missed calls from foreign numbers, the rule is not to call back wangiri scam numbers.
The Spanish legal framework is no longer the weak point; the challenge is that complaining requires persistence. The customer service law, which obliges large companies to respond within specific deadlines, and the 400 prefix change the incentive structure: a commercial call from a normal number is now an obvious infringement, not a gray area of doubtful consent. The phone will not stop ringing just because you join a list. The combination that works is dull but effective: the Robinson List for strangers, withdrawal of consent for companies you already deal with, and a screenshot of your call log every time someone breaks the rules. The law provides the fines; you have to provide the evidence.