---
title: "AI Voice Agents in Spain: AEPD & LOPDGDD Compliance Guide 2026"
description: "Deploy AI voice agents in Spain under AEPD, LOPDGDD, Lista Robinson, GDPR and the EU AI Act. Lawful basis, consent, fines, and a vendor checklist for 2026."
url: "https://ainora.lt/blog/ai-voice-agent-spain-aepd-compliance-2026"
---

# AI Voice Agents in Spain: AEPD & LOPDGDD Compliance Guide 2026

**Important Disclaimer:** This article provides general guidance on Spanish compliance considerations. It is not legal advice. Consult a Spanish data protection specialist (DPO or abogado especializado en protección de datos) before deploying any AI calling system in Spain.

AI voice agents deployed in Spain must comply with three overlapping regimes: **GDPR** (Regulation (EU) 2016/679), the Spanish **LOPDGDD** (Ley Orgánica 3/2018), and the **EU AI Act** (Regulation (EU) 2024/1689) - supervised by the **Agencia Española de Protección de Datos (AEPD)**. For outbound commercial calling, the **Lista Robinson** exclusion register applies under the LGT. Violations can reach EUR 20M or 4% of global turnover for GDPR breaches and up to EUR 35M or 7% for prohibited AI practices under the AI Act.

## Key Spanish compliance terms

- **AEPD** - Agencia Española de Protección de Datos.
- **LOPDGDD** - Ley Orgánica 3/2018 implementing GDPR + digital rights.
- **Lista Robinson** - Spanish opt-out register operated by ADigital.
- **LGT** - Ley General de Telecomunicaciones 11/2022.
- **EU AI Act** - Regulation 2024/1689; Art. 50 requires AI disclosure.

## What Is the Spanish Compliance Framework for AI Voice?

Four layers:
1. GDPR baseline (lawful basis, rights, breach).
2. LOPDGDD national overlay (digital rights, layered notice).
3. Sector telecom rules (LGT + Lista Robinson).
4. EU AI Act transparency from 2 August 2026.

## Who Is the AEPD and What Does It Regulate?

Spanish supervisory authority under GDPR Art. 51. Investigates, sanctions, publishes guidance, represents Spain on EDPB. Key AEPD publications:
- Guía sobre adecuación al RGPD de tratamientos que incorporan IA (18 obligations).
- Audit Requirements for Personal Data Processing Activities Involving AI.

Example sanction: EUR 1.2M against Telefónica Móviles (PS/00037/2021) for calls to Lista Robinson subscribers.

## How Does LOPDGDD Differ from GDPR?

Key LOPDGDD additions:
- **Art. 22** - right to digital education on AI.
- **Art. 7** - minors must be 14+ for valid consent.
- **Art. 11** - layered transparency notices.
- **Art. 32** - data blocking (not just retention).
- **Art. 91** - call recording must be pre-disclosed to staff.

Practical: layered notice with short first layer + URL/callback for full second layer.

## What Lawful Basis Applies to AI Voice Calls in Spain?

| Call type | Primary lawful basis | Additional Spanish rule |
| --- | --- | --- |
| Inbound customer service | Art. 6(1)(b) contract | Layered transparency (Art. 11 LOPDGDD) |
| Inbound appointment booking | Art. 6(1)(b) contract | Disclose AI nature (EU AI Act Art. 50) |
| Outbound B2C commercial | Art. 6(1)(a) consent OR (f) LI | Screen Lista Robinson + LGT Art. 66 |
| Outbound B2B commercial | Art. 6(1)(f) legitimate interest | Screen if personal number |
| Outbound debt collection | Art. 6(1)(b) or (f) | AEPD morosos guide + BdE conduct |
| Call recording for QA | Art. 6(1)(f) LI | Document LIA, offer opt-out |
| Sensitive data | Art. 9(2)(a) explicit consent | Heightened Art. 32 security |

AEPD has consistently held that legitimate interest is overridden when no prior relationship exists. Vodafone España EUR 3.94M sanction (PS/00040/2022) reinforced this.

## How Does Lista Robinson Affect AI Outbound Calls?

Operated by ADigital. Art. 23 LOPDGDD + Art. 66 LGT 11/2022 require screening exclusion lists. Practical:
- Screen call list against Lista Robinson before campaign.
- Update screen every 30 days minimum.
- Keep records (timestamps, batch IDs) for 3+ years.

## What Are Spanish Call Recording and Consent Rules?

- Disclose recording at start of call.
- Article 91 LOPDGDD: pre-disclose to staff.
- Document retention period (typically 12-24 months).
- Sensitive content (health) requires explicit consent.

## How Does the EU AI Act Apply to Voice Agents in Spain?

Art. 50: must disclose user is interacting with AI. Transparency obligations apply from 2 August 2026. AEPD will likely co-supervise AI Act with national AI authority.

## What Has the AEPD Decided About Automated Calling?

Notable decisions: Telefónica Móviles (EUR 1.2M, PS/00037/2021), Vodafone España (EUR 3.94M, PS/00040/2022) - both for unsolicited commercial calling.

## AEPD-Aligned Vendor Checklist

- DPA signed with vendor (GDPR Art. 28).
- Layered transparency notice (Art. 11 LOPDGDD).
- AI disclosure script (EU AI Act Art. 50) at call start.
- Lista Robinson screening for outbound commercial.
- Call recording disclosure at start.
- 72-hour AEPD breach notification process.
- DPIA documented for high-risk processing.
- Right to human review process (Art. 22 GDPR + LOPDGDD).

## Sources

- GDPR (Regulation (EU) 2016/679) - EUR-Lex
- LOPDGDD (Ley Orgánica 3/2018) - BOE
- EU AI Act (Regulation (EU) 2024/1689)
- AEPD guidance + sanction resolutions
- Lista Robinson (listarobinson.es)
- LGT 11/2022 (Ley General de Telecomunicaciones)