Data privacy and unwanted marketing

It is for anyone thinking about, planning or carrying out a move to Spain.

Start with "Cookies and online tracking: what Spanish websites must ask you". It is the quickest way to take back some control, because you meet cookie choices on almost every site you visit.

After that, pick the article that matches your problem:

• Calls from sales teams: "Stopping telemarketing calls in Spain with the Lista Robinson".
• Marketing emails: "Stopping unwanted marketing emails under Spanish law (LSSI)".
• A company holding your data: "Your data protection rights in Spain and what you can demand".
• A company that ignores your request: "Filing a data-protection complaint with the AEPD".
• A company that has exposed your data: "Data breach notices: what a company must tell you".

Scams, fraud, cold-call selling and general consumer complaints are covered in other Topics.

Key rules

• Response deadline: A company must answer a data rights request within one month, and can extend this by two further months only if it tells you why within the first month.
• Cookie choice renewal: A cookie choice should not be asked again more often than every 24 months, unless the cookies or purposes change.
• Robinson list delay: Lista Robinson registration takes effect with advertisers within about three months, so some advertising may continue until then.
• Breach reporting: A company must report a breach that risks people to the data-protection agency within 72 hours, and tell affected people without undue delay when the risk is high.
• Cost: Registering on the Lista Robinson is free.
• Consent: Marketing emails need your prior request or clear agreement, apart from a narrow exception for existing customers.

Data privacy and unwanted marketing: the whole process, step by step

From first step to last

• Register on the Lista Robinson for calls, email, SMS and post (Stopping telemarketing calls in Spain with the Lista Robinson): First, as soon as you want fewer ads; it takes effect with advertisers within about three months, so some advertising may continue until then

• Unsubscribe from emails and withdraw cookie consent directly with each sender or site (Stopping unwanted marketing emails under Spanish law (LSSI); Cookies and online tracking: what Spanish websites must ask you): Right away, in parallel with registering; senders must act without undue delay, and a cookie choice should not be asked again more often than every 24 months

• Send a data rights request to the company (Your data protection rights in Spain and what you can demand): If the ads or data use continue; the company must answer within one month, and can extend this by two further months only if it tells you why within the first month

• Expect the company to ask for proof of identity if it has reasonable doubts: Within the first month; the one-month clock generally runs from when the company has enough information to confirm who you are

• If the company refuses, it must tell you the reasons and your right to complain: Without delay and at the latest within one month

• File a complaint with the AEPD, the data-protection agency (Filing a data-protection complaint with the AEPD): For a rights request, after the company denies it or stays silent past the deadline; for unwanted marketing or unlawful use of data, you can file at any time, ideally as soon as possible

• Wait for the AEPD to decide whether to admit your complaint: Within three months of receipt; rights claims have a maximum of six months and sanction procedures generally nine months

• If the AEPD rejects or closes your claim, file an optional appeal to the AEPD itself (recurso de reposición): Within 1 month of the day after you are notified

• Take the case to the Audiencia Nacional court (contencioso-administrativo appeal), with a lawyer and court representative: Within 2 months of notification, or of the rejection of the reposición if you filed one

Documents you may need

Identity and residence

• A copy of your ID — Stopping telemarketing calls in Spain with the Lista Robinson, Filing a data-protection complaint with the AEPD
• A copy of your ID document — Your data protection rights in Spain and what you can demand

Other documents

• Evidence of the violation — Filing a data-protection complaint with the AEPD
• A digital certificate or Cl@ve — Stopping telemarketing calls in Spain with the Lista Robinson
• Proof of any unsubscribe request you made — Stopping unwanted marketing emails under Spanish law (LSSI)
• Proof that you may act for the other person — Filing a data-protection complaint with the AEPD
• Records of suspicious charges or messages — Data breach notices: what a company must tell you

Data privacy and unwanted marketing: questions that cross several articles

Does Lista Robinson stop all marketing from companies I already deal with?

No, Lista Robinson does not stop companies you have a contract with or have given consent to. You must withdraw that consent with the company itself, for example through its unsubscribe link. Read Stopping telemarketing calls in Spain with the Lista Robinson and Stopping unwanted marketing emails under Spanish law (LSSI).

Which channels can I protect, and does that stop spam emails?

You can protect phone calls, email, SMS and post, and each channel is chosen separately when you register. The list only stops companies that check it, so it does not stop fraudulent or illegal spam. For scam or unlawful messages, see Stopping unwanted marketing emails under Spanish law (LSSI) and Filing a data-protection complaint with the AEPD.

Can companies call me for marketing without my consent?

No, a company needs your prior consent for commercial calls, and calls to people on exclusion lists such as Lista Robinson are barred. Callers must also use numbers you can identify and call back. Read Stopping telemarketing calls in Spain with the Lista Robinson for the registration steps.

Where do I complain about unwanted calls or emails?

You complain to the AEPD, the Spanish data-protection agency, online with a digital certificate or Cl@ve, or on paper at a registry. Include the date, number or sender and any evidence. Prior contact with the company is not required for unwanted marketing; see Filing a data-protection complaint with the AEPD and Stopping unwanted marketing emails under Spanish law (LSSI).

Can I email-unsubscribe and also use a rights request to stop marketing?

Yes, you can do both, because objecting to direct marketing under data-protection law must be honoured immediately and free of charge. Use the unsubscribe link first, then a formal request if emails continue. See Stopping unwanted marketing emails under Spanish law (LSSI) and Your data protection rights in Spain and what you can demand.