BBVA Fined €5.5 Million: What You Risk by Ignoring Opt-Outs

One customer who couldn't turn off a bank's promotional notifications. Seven months of waiting, ten unwanted messages, and in the end a €5.5 million fine.

Should you really worry about this case, or is it only about big banks?

The BBVA case concerns anyone who does direct marketing: email, SMS, push notifications, phone calls. The logic behind the fine applies to any company that collects data and sends marketing communications.

The €5,508,000 fine against the BBVA banking group isn't a story about banks. It's a story about systems that don't talk to each other. And that problem exists in any company that uses a CRM (the software that manages contacts and customer communications) separate from the channels where customers make their requests.

The Italian data protection authority found a simple violation: a customer had asked to stop receiving promotional messages, but for seven months the messages kept coming. The cause? A technical misalignment between the bank's internal systems. The consequence? A penalty of over five million euros.

This pattern, an opt-out that is recorded but not carried out, is far more common than you might think, even among SMEs and mid-sized companies.

What exactly happened with BBVA?

A customer exercised the right to object to marketing through the app and then through customer service. For seven months they kept receiving promotional notifications because of a technical failure in the bank's systems.

The customer had used the BBVA app settings to block marketing communications. They then contacted customer service again to repeat the request. The bank had recorded the choice, but a technical problem prevented synchronization between the internal systems and the CRM responsible for sending the messages.

From October 2025 to May 2026, the customer received at least ten unsolicited marketing notifications. The Garante also found another irregularity: customer service had told the customer that push notifications in the app couldn't be disabled. That wasn't true, as the bank itself later showed they could be stopped.

BBVA's defense rested on one argument: the customer should have used the email addresses listed in the privacy policy. The Garante rejected this argument without hesitation. Those who handle data must make it easy to exercise rights, not get in the way by requiring specific channels.

The Garante also ordered BBVA to adopt appropriate technical and organizational measures and to report the actions taken within 30 days. Paying the fine isn't enough: you have to prove you've fixed the problem.

What exactly does the law say about the right to object to marketing?

Article 21 of the GDPR states that anyone who receives a request to object to direct marketing must stop sending communications immediately, with no exceptions and no balancing of interests.

The GDPR, the European data protection regulation, provides for two types of right to object. For most processing, the controller can continue if it shows overriding legitimate grounds. For direct marketing, there is no such option: the objection is absolute.

This means that as soon as a customer says "I don't want to receive marketing messages anymore," processing must stop. Not after a week, not after checking which channel was used, not after consulting a lawyer. Immediately.

The penalty for breaching this obligation falls in the highest tier under the GDPR: up to €20 million or 4% of annual worldwide turnover, whichever is higher. In the BBVA case, the fine took into account that the violation affected just one person, but it lasted seven months and there was already a prior offense.

Is this an isolated case, or is the Garante really stepping up enforcement?

The numbers show a clear trend: fines issued by the Italian Data Protection Authority grew by 54.5% in 2025 compared with 2024, and in 2026 the pace is even faster.

The BBVA case is not an isolated incident. Last year the Authority fined Verisure Italia €400,000 in an almost identical case: a former customer kept receiving promotional text messages after exercising the right to object. In July 2026 it was Altroconsumo Edizioni's turn, fined €280,000 for violations related to email marketing and delays in responding to user requests.

The pattern is the same: opt-outs ignored or handled late, systems out of sync, incorrect information given to customers. And the fines keep growing.

In 2025 the Authority issued 229 administrative fines and 506 corrective measures overall, with 130 inspections: 78 carried out directly and 52 delegated to the Guardia di Finanza. The data is published in the 2025 Annual Report of the Italian Data Protection Authority.

In 2026 the pace is even higher: according to tracking updated to October 2026, the Authority has already imposed 166 fines totaling €83.7 million, with a single maximum fine of €31.8 million. The most affected area is privacy notices (50 cases), but direct marketing is among the most closely monitored areas.

"Insufficient technical and organizational measures", exactly BBVA's problem, is the third most penalized category in Europe, with 418 proceedings. The average fine for this category is €2 million, according to the CMS Law GDPR Enforcement Tracker Report.

What changes in practice: who does what when an opt-out request arrives?

Handling an opt-out correctly requires three different business functions (IT, customer service and marketing) to be aligned, with a written process and clear responsibilities.

The critical point is step three: propagation to all systems. BBVA had recorded the customer's choice, but the data never reached the CRM. That is the failure behind the €5.5 million fine. In companies with multiple marketing tools, and today almost all have at least three or four, this risk is structural unless it is carefully managed.

Three real-world scenarios: what happens in an e-commerce store, a professional firm and a manufacturing company?

The risk changes with the number of channels used and the complexity of the systems, but the principle is the same: every system that sends commercial communications must receive and respect the opt-out.

Illustrative examples: the numbers and situations are meant to show the reasoning, they are not real customer data.

What similar cases has the Italian Garante already penalized?

The Authority has already fined several companies for unwanted marketing after an opt-out: the Verisure and Altroconsumo cases show that the tolerance threshold is very low.

The difference between BBVA's fine and those of the other two companies depends on several factors: company size, the presence of a prior offense, the length of the violation. But the principle is identical. As we saw in our analysis of the €825 million Uber fine for automated decision-making, European authorities are enforcing the rules with growing rigor, including against companies of every size.

What tools and approaches exist to manage opt-outs safely?

There are different technical solutions, from the simplest to the most structured: the right choice depends on the number of channels you use and the complexity of your CRM.

Why it's in the news now: has the European landscape really changed?

European data protection authorities issued €1.145 billion in GDPR fines in 2025, bringing the cumulative total since 2018 to more than €7 billion. The pace of enforcement isn't slowing down.

The BBVA case comes at a time when GDPR enforcement, meaning the actual application of penalties, has reached record levels. According to the EDPB 2025 annual report (the European Data Protection Board), national authorities imposed €1.145 billion in fines in 2025 alone. Since 2018, the total exceeds €7.1 billion across more than 2,800 proceedings.

This isn't a trend that will stop. Authorities have more resources, more experience and more precedents to draw on. If you handle marketing data without a verified opt-out system, you face a real risk, not a theoretical one. The issue also overlaps with the new AI rules: as we discussed in our article on AI and compliance in ad campaigns, the default settings of automated systems are coming under ever closer scrutiny from the authorities.

How to get started: the steps to secure your opt-out system

The starting point is a flow audit: map where opt-out requests arrive and verify that they actually reach every system that sends commercial communications.

You don't need to start from scratch. You need to find where the gaps are. Here's a six-step path, suitable even if you don't have a dedicated IT team.

What are the most common mistakes that lead to fines like this?

BBVA's technical failure is only one of the ways companies end up facing penalties: organizational and process errors are just as common.

A related topic worth keeping an eye on is the EU regulation on AI in content: there too, technical responsibility falls on the data controller, not on the tool provider.

How can you tell if your opt-out system is really working?

There are concrete indicators that let you check how well the system works before a complaint or an inspection arrives.

So, is it worth investing in an opt-out system audit now?

Worth it if you do direct marketing across multiple channels (email, SMS, push, phone) and have never verified that opting out on one channel also blocks the others. The risk is real, and the cost of an audit is a fraction of any fine.

Somewhere in between: you use a single marketing channel with an integrated system, but you've never tested the flow end to end. A quick test and a written procedure are enough to let you sleep easy.

Not yet if you don't do direct marketing to contact databases and don't send unsolicited commercial communications. Art. 21 GDPR doesn't apply to your specific case, but it's worth checking with your DPO.

How we see it at SHM

For us, the BBVA fine says something we often see: digital systems grow by accumulation. You add a CRM, then an email platform, then an app, then an automation tool. Nobody checks that they talk to each other when it really matters, which is when a customer wants to stop everything.

We believe technology should serve people, not create obstacles. An opt-out system that doesn't work isn't just a legal problem: it's a sign that the company's digital architecture needs attention. And that's true for marketing as for any other automated process.

If you want to understand where the gaps are in your consent and commercial communications management, we can help with a structured audit. We work on the strategic integration of digital systems, on data flow mapping and on training teams in automation and business processes. You can find more insights on digital regulation and technology in the Project management and technology section.

The topic of digital compliance also ties in with the EU fine on Meta under the DSA and with European digital sovereignty: they're all signs of the same regulatory direction.

Frequently Asked Questions

The fine didn't happen because BBVA wanted to ignore its customers. It happened because nobody had ever tested whether its systems actually talked to each other.