Is It Legal to Call Webinar Registrants? EU and UK Rules

A webinar registrant is someone who has handed a business their contact details in order to attend an online event. Whether that business may then telephone them is decided not by one rule but by four, stacked on top of each other: the ePrivacy consent rule for the channel, the GDPR rules on lawful basis and purpose, national numbering and caller-identification law, and the EU AI Act disclosure duty where the caller is an AI system. A registration form, drafted properly, can answer the first. It never answers the third.

Two things follow from that framing and they run through the whole page. First, consent is genuinely powerful: in the countries where cold automated calling is effectively closed, the registration form is the one place a lawful route can be opened at all. Second, consent is not a master key. It does nothing to the rules about which telephone number a call may come from, it does not survive an Italian opposition-register entry made afterwards, and it does not cover a purpose the form never mentioned.

Which four rules decide whether you may call a webinar registrant?

Treating "is it legal" as one question is the mistake that produces most of the confident, wrong answers on this topic. It is four questions, and a campaign can pass three of them and still be unlawful on the fourth.

Layer 1 is set by Article 13(1) of the ePrivacy Directive, which reads: "The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent" (Directive 2002/58/EC, Art. 13(1)). Two elements have to be true together for it to bite: the communication is for direct marketing, and there is no prior consent. That is why it is a consent rule and not a cold-versus-warm rule, and it is exactly why a registration form can satisfy it directly.

Article 13(5) then explains why the six countries below diverge so sharply on business calls: "Paragraphs 1 and 3 shall apply to subscribers who are natural persons. Member States shall also ensure… that the legitimate interests of subscribers other than natural persons with regard to unsolicited communications are sufficiently protected." Member states were free to extend the consent rule to companies, and several did.

Does registering for a webinar count as consent to be called?

Not by itself. Handing over a phone number in order to receive a joining link is an act of getting the thing you asked for. It is not, on its own, an agreement to receive marketing calls. GDPR Article 7(2) is explicit about what a valid consent request looks like when it travels alongside something else: "If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language" (GDPR Art. 7(2)). Article 7(1) puts the burden of proving it on the controller.

There is one genuinely open question underneath all of this, and it deserves to be flagged rather than resolved. Article 13(1) only bites on communications "for the purposes of direct marketing." A pure attendance confirmation for an event the person actively asked to attend is arguably a service message rather than marketing. We have not found national guidance either way on that line, and there is a strong argument against relying on it: the moment the reminder also pitches, it is mixed-purpose, and Italy expressly pulls market research inside its regime by covering "il compimento di ricerche di mercato". Treat the confirmation leg as lower-risk but still running on the registrant's consent. Do not treat it as exempt.

Is calling a no-show to book a sales call the same purpose they registered for?

This is the sharpest point on the page and the one most often skipped. Confirming attendance is the purpose the person registered for. Calling a no-show afterwards to book a sales call is a new purpose. "I signed up for a webinar" is not "please sell to me."

Consent has to be specific. Article 4(11) defines it as a specific indication of the person's wishes, and Article 5(1)(b) requires purposes to be specified and explicit at the point of collection (GDPR Art. 4(11)). A consent given to receive webinar information is therefore not a consent to a sales follow-up call.

Article 6(4)'s compatibility test is written about whether the further processing has its own consent or Member State law footing - and Recital 50 goes further, allowing further processing "irrespective of the compatibility of the purposes" where the data subject has consented (GDPR Recital 50). Which is exactly why the consent has to name the purpose in the first place: the escape route runs through the consent, and a consent that never mentioned the follow-up cannot carry it. If the form did not name it, you ask again. Combine that with the demonstrability burden in Article 7(1), and only one design survives contact with the statute: the registration form has to name the follow-up purpose and the channels up front.

How do the rules apply country by country?

The table below covers the six EU markets our compliance research reaches. The United Kingdom is dealt with separately further down, because it sits outside the EU instruments entirely and rests on its own regulations. Every entry is an application of the cited statute to the consented-registrant case, not a regulator ruling on that case.

Read the third column first. It is the one that decides whether a campaign can actually run, and it is the column that no amount of consent work will change. The two national texts the table paraphrases most tightly are the Spanish Ley 11/2022 General de Telecomunicaciones, article 66.1.a) and the Polish Prawo komunikacji elektronicznej, article 398 (Dz.U. 2024 poz. 1221); both are linked so you can read the wording rather than take ours for it. The one row we cannot link is Lithuania, where the consolidated national text defeated every automated fetch we tried - that gap is real and stays marked unconfirmed.

Why can an Italian opposition-register entry cancel a consent you already hold?

Italy is the sharpest interaction between consent and a national register anywhere in the six markets, and it runs in the opposite direction to the intuition most people bring to it. Article 1, comma 5 of legge 11 gennaio 2018, n. 5 says that registering with the Registro Pubblico delle Opposizioni means "si intendono revocati tutti i consensi precedentemente espressi, con qualsiasi forma o mezzo e a qualsiasi soggetto" - all previously expressed consents, in any form or by any means and to any party, are revoked. The only carve-out in the same comma is for consents given within "specifici rapporti contrattuali in essere, ovvero cessati da non piu' di trenta giorni", that is, live contractual relationships for the supply of goods or services, or ones ended no more than thirty days ago.

Comma 6 supplies the other half: "E' valido il consenso al trattamento dei dati personali prestato dall'interessato, ai titolari da questo indicati, successivamente all'iscrizione nel registro" - a consent given after the register entry remains valid (legge 5/2018, Gazzetta Ufficiale text).

One honest limitation. Commi 2 and 5 are both worded on processing carried out "mediante operatore con l'impiego del telefono", that is, by an operator using the telephone. Whether the revocation formally reaches automated, no-operator calls is not addressed by the statute and we have found no guidance either way. We adopt the stricter reading and treat the revocation as applying, and we are telling you that this is a choice rather than a settled answer. Our wider write-up on voice agents and the Italian regulator covers the rest of that market.

What does Germany require, and why is recording a criminal question there?

Germany is the least forgiving of the six on form wording and the only one of them where getting the recording question wrong is a criminal matter rather than a regulatory one. § 7 Abs. 2 Nr. 2 UWG treats as an unreasonable nuisance any advertising "unter Verwendung einer automatischen Anrufmaschine, eines Faxgerätes oder elektronischer Post, ohne dass eine vorherige ausdrückliche Einwilligung des Adressaten vorliegt" (UWG § 7). The provision is written on "the addressee" and does not distinguish consumers from businesses on its face.

The existing-customer exception in § 7 Abs. 3 is often produced as an answer to this, and it is not one. That paragraph is expressly an exception for advertising using electronic mail, conditioned on the address having been obtained in connection with a sale. It never reaches an Anrufmaschine. A webinar registration is not a sale, and a phone call is not electronic mail, so the exception fails twice over.

On recording, § 201 Abs. 1 StGB is unusually blunt: "Mit Freiheitsstrafe bis zu drei Jahren oder mit Geldstrafe wird bestraft, wer unbefugt das nichtöffentlich gesprochene Wort eines anderen auf einen Tonträger aufnimmt" - recording another person's non-publicly spoken word without authority carries up to three years' imprisonment or a fine (StGB § 201). A sales call is non-public spoken word. This is a criminal prohibition, so no data-protection balancing argument cures it. In Germany, calls are recorded only with the participants' agreement, or not at all.

§ 7a UWG adds the paperwork: consent to telephone advertising given by a consumer must be documented in appropriate form at the time it is given, and the documentation retained "ab Erteilung der Einwilligung sowie nach jeder Verwendung der Einwilligung fünf Jahre", five years from the grant and after each use, and produced to the authority on request (UWG § 7a).

Which rules does consent not fix at all?

Layer 3 is where confident vendors get caught. These obligations attach to the call and to the number it comes from. Nothing the recipient agreed to changes them, and no consent record satisfies them.

France: the automated-mode numbering rule

ARCEP décision n° 2022-1583 du 1er septembre 2022, in force since 1 January 2023, states that territorialised numbers, subject to specific derogations, "ne peuvent être utilisés comme identifiant de l'appelant présenté à l'appelé pour des appels ou des messages émis par des systèmes automatisés d'appels et d'envois de messages". The derogation is granted to numéros polyvalents vérifiés, whose metropolitan roots the decision lists as 0162, 0163, 0270, 0271, 0377, 0378, 0424, 0425, 0568, 0569 and 0948 to 0949, with 09475 to 09479 in the overseas territories (ARCEP décision 2022-1583, PDF).

The trigger is automated mode, not consent. A consented registrant called by an automated system still needs the right number underneath the call. The decision carries only narrow small-volume carve-outs: five or fewer distinct destination numbers over thirty days, or outbound calls at or below twenty per cent of calls received over thirty days. Those describe a demo, not a campaign, and no one should be sold a programme on them. The operator side matters too, because the decision requires the operator running a verified number to be able to confirm that its holder gave explicit prior agreement for it to appear as the caller identity on each call.

Spain: the 400 range

The Resolución de la Secretaría de Estado de Telecomunicaciones de 14 de abril de 2026 sets aside the NXY = 400 range so that those numbers "se destinarán exclusivamente como origen de llamadas comerciales salientes", exclusively as the origin of outbound commercial calls, and cannot receive incoming calls. Operators are given six months from entry into force, which followed publication in April 2026, to make the range fully operational, putting the practical deadline around mid-October 2026 (BOE-A-2026-8409).

Germany: the number you present

§ 120 TKG requires providers enabling outgoing connections to ensure that "als Rufnummer des Anrufers eine vollständige national signifikante Rufnummer des deutschen Nummernraums übermittelt und als solche gekennzeichnet wird". It also addresses the case that matters most to anyone dialling Germany from elsewhere: where a connection displaying a German national number is handed over from a foreign telephone network, providers must ensure the caller-ID display is suppressed (TKG § 120). Owning a German number is not the same as being able to present it from a foreign route.

What do the UK rules say about calling webinar registrants?

The United Kingdom is outside the EU instruments discussed above, and the analysis here rests on one source only: the text of the Privacy and Electronic Communications (EC Directive) Regulations 2003 as published by legislation.gov.uk. We have not surveyed UK regulator guidance or case law for this article, so read the section as the statutory starting point rather than the complete UK picture.

Reg. 21(A1) is the UK equivalent of a layer-3 rule and it is easy to miss, because it is one of the few provisions that expressly reaches solicited calls: the caller identity obligation applies to direct marketing calls whether solicited or unsolicited (PECR reg. 21).

There is also an unresolved classification question in the UK text, and it is worth stating plainly rather than resolving. Reg. 19(1) is worded on "communications comprising recorded matter", while the definition in reg. 19(4) turns on transmitting "sounds which are not live speech" (PECR reg. 19). Whether an interactive, generative AI voice agent is caught by that wording is not something the regulation answers. We assume it is, which is the reading that requires more of us rather than less.

One more scope point. The EU AI Act is EU law and does not apply of its own force to a purely domestic UK call. We do not identify an equivalent disclosure duty in PECR, but we have not examined UK law beyond these regulations, so treat that as an open point rather than a conclusion. AInora is established in the EU, so our own obligations as a provider may attach regardless of where the call lands - which is another reason the disclosure runs everywhere. In practice the disclosure is built into the agent and delivered on every call.

When does the EU AI Act require the caller to say it is an AI?

From 2 August 2026. Article 50(1) of Regulation (EU) 2024/1689 requires that AI systems intended to interact directly with natural persons are designed so that "the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect" (AI Act Art. 50). Article 50(5) fixes the timing: the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure."

The date is not negotiable and it is not 2025 or 2027. Article 113 sets general application at 2 August 2026, with earlier carve-outs for Chapters I and II (2 February 2025) and for Chapter III Section 4, Chapter V, Chapter VII, Chapter XII and Article 78 (2 August 2025), and a later one for Article 6(1) (2 August 2027). Chapter IV, where Article 50 sits, is in none of them (AI Act Art. 113).

What has to happen the moment someone says stop?

GDPR Article 21(3) is one of the few provisions in this whole area with no balancing test attached: "Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes". Article 21(4) requires that right to be brought to the person's attention explicitly, presented clearly and separately from other information, at the latest at the time of the first communication (GDPR Art. 21). Article 7(3) adds that withdrawing consent must be as easy as giving it.

The product consequence is the part worth designing for, and it is not a legal nicety. An objection made on the phone has to stop the SMS and the email too, which means one shared, cross-channel suppression list rather than three per-channel unsubscribe flows that do not talk to each other. Every call, message and email also has to say on whose behalf it is being made and carry a working way out, and where a market operates an advertising exclusion system, such as the Spanish Lista Robinson, we consult it and honour the exclusions before any commercial contact.

Roles matter here as well. Where a supplier runs the outreach on a client's registrant list, the client is the controller and owns the lawful basis, the form wording, the privacy notice and the answer to "what did the form actually say?". The supplier acts as a processor on documented instructions under a written data-processing agreement, with sub-processors disclosed. That division is also the commercial protection for both sides, and it is worked through in more detail in our GDPR guide for voice agents.

What does the registration form actually have to say?

Everything above collapses into a single practical artefact. If the form is right, most of the analysis becomes routine. If the form is wrong, no amount of downstream care repairs it.

What has nobody actually ruled on yet?

A page like this is more useful for what it refuses to assert than for what it asserts. These are the points where we looked for an answer and there was not one. None of them is rhetorical hedging: each is a place where a confident sentence would be an invented one.

Which claims about calling registrants are simply wrong?

If you are evaluating a supplier, these are the sentences that should end the conversation. Each one is contradicted by a statute quoted above.

• "They registered, so they consented." GDPR Art. 7(2) requires the consent request to be clearly distinguishable from the rest of the form, and Art. 7(1) requires you to be able to demonstrate it.
• "Warm leads don't need consent." ePrivacy Art. 13(1) is a consent rule. It does not have a warm-lead exception.
• "Our soft opt-in covers the calls." Every soft opt-in quoted on this page is limited to electronic mail and keyed to a sale. A free registration is not a sale.
• "Legitimate interest covers our automated calls." A lawful basis under the GDPR does not displace a consent requirement in ePrivacy or its national transpositions.
• "Registrants are exempt from the Italian opposition register." Legge 5/2018 art. 1 c. 5 says the opposite: entry revokes prior telephone consents.
• "Because they consented, we don't need a French verified number." ARCEP 2022-1583 is triggered by automated mode, not by consent.
• "The Spanish 400 rule only applies to cold calls." The numbering rule is about the originating number, not the recipient's state of mind.
• "It is obvious it's an AI, so no disclosure is needed." AI Act Art. 50(1) sets the test by reference to a reasonably well-informed, observant and circumspect person.
• "We disclose at the end of the call." Art. 50(5) requires it at the latest at the time of the first interaction.
• "Company contact data is not personal data" or "B2B is outside the GDPR." An employee's name and work contact details identify a person, and several of the national rules above are written on subscribers and end users rather than on consumers.
• "100% legal", "fully compliant across the EU", "zero legal risk". Nobody can offer that, including us. The compliance question in this area is not settled enough for anyone to guarantee it.

Frequently Asked Questions