24 September 2026

How to prove consent for marketing calls

Learn what consent for marketing calls requires, which evidence to keep, and how to record and block objections before launching your campaign.

A calling campaign can breach the rules even when the team has a checkbox marked “consented”. Consent for marketing calls should be tied to a specific legal basis, demonstrable, and linked to clear information about who is calling and why.

Not every call is based on consent. In some cases, another legal basis may apply, such as a prior contractual relationship, provided that it is appropriate and its limits are respected. The company must distinguish this situation from marketing calls made without consent and from customer service or contract management calls.

The recipient’s objection requires an operational response, not a note buried in the CRM. The company must record the request, block the number in active campaigns, and prevent it from entering again through other providers or lists. Article 66.1.b of the General Telecommunications Law recognises the right not to receive unwanted marketing calls. A well-connected autodialer helps apply this control before the call is placed.

A box marked “consented” does not, on its own, prove that a campaign can make calls. First, you must identify the campaign’s legal basis. Then, you must retain evidence showing why that number was added to the list and which communications its owner agreed to receive.

Consent is permission for a specific processing activity. A generic statement such as “I agree to receive communications from partner companies through any channel” should not be treated as valid without further analysis. It is difficult to show that consent was specific and informed —as required by Article 4(11) of the GDPR— if there is no record of who will make contact, for what purpose and through which channel. The law does not list those three fields; they are the practical way to meet the requirements it does set out. The process must also allow the person to withdraw their permission and record when and how consent was obtained.

This is not a matter of style: Article 4(11) of the GDPR defines consent as a freely given, specific, informed and unambiguous indication of the data subject’s wishes. Article 7 adds two obligations that companies often overlook: the company must be able to demonstrate that consent was given, and withdrawing it must be as easy as giving it.

Legitimate interest is a different legal basis. It is not implied consent or a way to avoid carrying out an assessment. The company must show that a genuine interest exists, that the call is necessary for that purpose and that the interests or expectations of the person contacted do not prevail. A previous relationship with a customer may be relevant, but it does not make every future offer an authorised call.

Article 6(1)(f) of the GDPR requires a balancing test: the company’s interest must be legitimate, the call must be necessary to pursue it, and the interests or fundamental rights and freedoms of the data subject must not override it. You must carry out that assessment and be able to produce it. Simply invoking legitimate interest is not enough.

In addition, individuals retain the right not to receive unwanted commercial calls under the terms set out in the General Telecommunications Law. A subsequent objection must take precedence over the commercial benefit of continuing to call.

The practical rule is simple: keep consent, legitimate interest and contractual communications separate. Record the legal basis chosen for each campaign. If you cannot explain why you are calling that number, marking it as “consented” will not fix the problem.

Consent is not the only possible legal basis. Law 11/2022 recognises the right not to receive unwanted commercial calls, unless the person has previously consented or the call can rely on another legal basis under Article 6(1) of the GDPR, as set out in Article 66.1.b of the General Telecommunications Law. This does not make every call lawful. The company must justify why that legal basis applies to the campaign and the recipient.

A previous relationship is not a general permission

Having bought a product or subscribed to a service may be relevant when assessing a subsequent call. It does not give the company permission to call that person with any offer, for any length of time or about any product. The company must assess the context, the purpose of the relationship and the customer’s reasonable expectations. If the call aims to sell something unrelated to that relationship, the justification becomes more difficult.

Nor should a commercial call be confused with a service call. Confirming an appointment, resolving an issue, providing information about an order or fulfilling a contractual term serves a different purpose from selling. The script, campaign and call records must reflect that difference. If the agent uses a support call to introduce an offer, that part has a commercial purpose and requires its own justification.

Before activating the dialler, document three decisions:

the purpose of the campaign;
the legal basis you rely on to call without prior consent;
why that legal basis fits each segment and the content of the offer.

If you cannot answer these questions in writing, do not launch the campaign. An outbound campaign dialler can organise contacts and apply exclusions, but it cannot decide whether the call is permitted. That responsibility remains with the company.

What the agent must do at the start of the call

The first objective is not to sell. It is to make sure the person understands who is calling and why.

We recommend that the agent identifies:

The company name.
The agent’s name or identifier.
The commercial reason for the call.
The product or service being presented.
How to contact the company if the recipient needs more information.

Avoid vague phrases such as “we are calling about an administrative matter” when the call is actually a sales offer. Hiding the commercial purpose damages the conversation and makes it harder to show that the script was followed correctly.

The agent should also explain, in one sentence, that the data is used to manage the call and the commercial communication. If the recipient asks where their number came from or how their data will be processed, the agent must have a prepared answer that matches the information recorded in the CRM. The explanation should not vary from one call to the next.

The conversation must include a simple way to object. For example: “If you do not want to receive any more commercial calls, I can record your request now.” A person has the right not to receive unsolicited commercial calls unless they have previously given consent or another applicable legal basis exists, in accordance with Article 66.1.b of Law 11/2022.

If the recipient objects, the agent must not argue or try to close the sale. The agent must record the objection together with the number used, the date, the campaign and the outcome of the call. The block must then be applied to all active lists and to any provider involved in the campaign.

An approved script helps, but it does not replace oversight. The company should review available recordings or transcripts, check that the agent identifies itself and track the reasons for abandoned calls, objections and complaints. A system for AI call analysis can support this work.

How to handle an objection and never call again

When someone says, “do not call me again”, the agent must end the conversation and record the objection immediately. Adding a free-text note to the contact record is not enough. The company must turn that response into a blocking rule.

Law 11/2022 recognises the right not to receive unwanted calls for commercial purposes, except in the cases permitted by applicable law (BOE). An objection must therefore stop future commercial calls while the company reviews any legal basis it intends to rely on.

A record that actually blocks calls

The record should include:

The number concerned and, where applicable, other numbers associated with the same contact.
The date and time of the request.
The channel and campaign from which the call was made.
The wording or category of the objection: “do not call again”, “do not call about this campaign” or “do not receive commercial communications”.
The user, agent or system that recorded the request.
The blocking status and the date it was synchronised with each tool.

The block must then propagate to the CRM, the dialler, upload sheets and any external provider that makes calls on the company’s behalf. If a campaign has already been prepared, remove the number before the next run. If the provider keeps a copy of the database, send the update and ask for confirmation that it has been applied.

The exclusion list needs its own controls: restricted access, a change history and an automatic check before every call. Do not delete it to “clean up” the database. Keep it as an operational reference to prevent further calls.

Finally, test the process with a control number. The question is not whether the agent recorded the refusal. It is whether the number is blocked at every point from which the company can make a call.

The Robinson List and other do-not-call lists: what to check before dialing

A do-not-call list does not replace consent or prove that a call is lawful. It serves a different purpose: identifying people who do not want to receive commercial communications through a specific channel.

Checking it is not simply good practice. It is an obligation. Article 23 of the LOPDGDD requires anyone carrying out direct marketing to check the advertising exclusion systems that may apply to them in advance and exclude from processing anyone listed in them. The article itself makes an exception for people who have given their express consent to that specific company.

If a number does not appear on the list, that does not authorise the call. It only means that this particular restriction does not apply. A lawful basis is still required. In addition, Law 11/2022 of 28 June on General Telecommunications recognises the right not to receive unwanted commercial calls.

Before dialing, a company should check at least the following:

Whether the number appears on the do-not-call list applicable to the telephone channel.
Whether the person has directly objected to the company during a call, by email, through a form or via any other channel.
Whether the objection covers all commercial communications or only a specific brand, product or campaign.
Whether there is a prior contractual relationship and whether the call is related to it, without assuming that the relationship permits any type of offer.
Whether the number comes from an identifiable source and whether the company can justify why it was added to the campaign.
Whether the exclusion has been applied across the CRM, the dialler and the lists provided to external agencies or suppliers.

The Robinson List and the internal do-not-call list must work together. A person may not appear on the first list and may still have asked your company not to call again. That request must take priority in sales operations and block new campaigns, in line with the right to object under the applicable regulations.

This check must be carried out before every campaign, not only when purchasing or importing a database. The right question is not “can I dial this number?” but “what evidence do I have to dial it, and which exclusions must I respect?”.

What evidence must the company retain

A checked box is not enough. If someone challenges a call, the company must be able to reconstruct what happened to that number and why it was included in the campaign.

Create a record for each contact with, at a minimum, these fields:

Legal basis used: consent, an existing relationship or another legal basis that the company has documented for the campaign.
Source of the number: web form, contract, event, purchase, data transfer or external provider. Add the date it was obtained and the person responsible for uploading it.
Consent: date, channel, wording shown and scope. Keep the associated evidence, not just a “yes” value in the CRM. In practice, a record that stands up to review states whether the person authorised calls, which products they covered and from when.
Objection: date, channel, exact request and the person who recorded it. The right not to receive unwanted commercial calls is recognised in the General Telecommunications Law 11/2022. A later request must take precedence in operational lists.
Campaign activity: number dialled, date, time, outcome, agent or autodialler used and reason for the call.
Current script: version used for each contact. If the identification, offer or information about personal data changes, retain both versions.
Exclusion checks: date of the latest cleansing, lists checked, matches detected and the system that blocked the number.

Do not spread this evidence across spreadsheets, inboxes and isolated tools. Centralise the record and synchronise exclusions between the CRM, autodialler and any external provider. That way, an objection does not remain in one agent’s record while another campaign continues dialling. The call log in the CRM should also show the exclusion status and the date it was last updated.

Frequently asked questions

Does a prior contractual relationship allow any commercial call?

No. A prior relationship may be relevant when determining the legal basis, but it does not authorise every campaign or offer. The company must justify the reason for the call, its scope and the use of the number in each case, in accordance with Article 66.1.b of Law 11/2022.

Is it legal to call a mobile phone to offer a product?

The fact that it is a mobile number is not enough to justify the call. You must check that consent or another applicable legal basis exists and that the person has not exercised their right not to receive unsolicited commercial calls.

Do not assume that it does. Consent must clearly cover commercial calls and the intended use of the data. Authorisation for another channel or purpose does not show that the person agreed to receive calls.

Can an autodialler call again if the person objects during the conversation?

No. The objection must be recorded immediately and the number must be blocked from any lists and campaigns that could use it. This control must also extend to the CRM, the autodialler and any external provider involved in the campaign.

What must a company check before using a purchased database?

It must be able to prove the origin of the number, the applicable legal basis and the scope of any consent. If it cannot reconstruct this information or verify the exclusions currently in force, it should not add the number to a commercial calling campaign.

Design outbound campaigns with control over every call, do-not-call list and team productivity.

What consent means in a commercial call

When a company can call without prior consent