BBVA fine of 5.5 million: what awaits those who ignore opt-out

Just one customer who cannot turn off a bank's promotional notifications. Seven months of waiting, ten unwanted messages, and eventually a 5.5 million euro fine.

Is it really worth worrying about this case, or does it only concern big banks?

The BBVA case concerns anyone doing direct marketing: emails, SMS, push notifications, phone calls. The logic of the sanction applies to any company that collects data and sends commercial communications.

The €5,508,000 fine for the BBVA banking group is not a story about banks. It's a story about systems that don't talk to each other. And this problem exists in any company that uses a CRM (the software that manages customer contacts and communications) separate from the channels where customers make their requests.

The Italian Personal Data Protection Authority has ascertained a simple violation: a customer had asked to no longer receive promotional messages, but for seven months the messages continued anyway. The cause? A technical misalignment between the bank's internal systems. The consequence? A fine exceeding five million euros.

This pattern — opt-out recorded but not executed — is much more common than you might think, even among SMEs and mid-sized companies.

What exactly happened with BBVA?

A customer exercised their right to object to marketing via the app and then through customer service. For seven months they continued to receive promotional notifications due to a technical glitch in the bank's systems.

The customer had used the BBVA app settings to block commercial communications. Then they had re-contacted customer service to reiterate the request. The bank had recorded the choice, but a technical problem prevented synchronization between internal systems and the CRM responsible for sending messages.

From October 2025 to May 2026, the customer received at least ten unsolicited commercial notifications. The Authority also found another irregularity: customer service had told the customer that push notifications in the app could not be disabled. This was not true — the bank itself later demonstrated that they could be stopped.

BBVA's defense focused on one argument: the customer should have used the email addresses indicated in the privacy policy. The Guarantor rejected this argument without hesitation. Those who manage data must facilitate the exercise of rights, not hinder them by requiring specific channels.

The Garante also ordered BBVA to adopt appropriate technical and organizational measures and to report the actions taken within 30 days. Paying the fine isn't enough: you have to prove you've fixed the problem.

What does the law actually say about the right to object to marketing?

Article 21 of the GDPR states that anyone who receives an objection to direct marketing must stop sending communications immediately, without exceptions and without balancing interests.

The GDPR — the European data protection regulation — provides for two types of right to object. For most processing activities, the controller can continue if they demonstrate compelling legitimate grounds. For direct marketing, however, this possibility does not exist: the objection is absolute.

This means that as soon as the customer says «I no longer want to receive commercial messages», the processing must stop. Not after a week, not after checking the channel used, not after consulting the legal department. Immediately.

The penalty for those who violate this obligation falls under the highest tier set by the GDPR: up to 20 million euros or 4% of annual global turnover, whichever is higher. In the BBVA case, the fine was determined considering that the violation involved a single individual, but lasted for seven months and there was already a previous record.

Is this an isolated case or is the Data Protection Authority really stepping up checks?

The numbers show a clear trend: fines by the Italian DPA grew by 54.5% in 2025 compared to 2024, and in 2026 the pace is even faster.

The BBVA case is not an isolated incident. Last year, the Guarantor fined Verisure Italia €400,000 for an almost identical case: a former customer continued to receive promotional SMS messages after exercising their right to object. In July 2026, it was Altroconsumo Edizioni's turn, fined €280,000 for violations related to email marketing and delays in responding to user requests.

The pattern is the same: opt-out ignored or handled late, out-of-sync systems, incorrect information given to customers. And the fines are growing.

In 2025, the Italian Data Protection Authority (Garante) adopted 229 administrative fines and a total of 506 corrective measures, with 130 inspections—78 conducted directly and 52 delegated to the Financial Police. The data is published in the Privacy Guarantor Annual Report 2025 .

In 2026 the pace is even faster: according to tracking updated to October 2026 , the DPA has already imposed 166 sanctions totaling €83.7 million, with a single maximum fine of €31.8 million. The most affected sector is information (50 cases), but direct marketing is among the most monitored areas.

«Insufficient technical and organizational measures» — exactly BBVA's problem — are the third most penalized category in Europe, with 418 proceedings. The average fine for this category is 2 million euros, according to the GDPR Enforcement Tracker Report by CMS Law .

What changes in practice: who does what when an opt-out request arrives?

Properly managing an opt-out requires three different business functions — IT, customer service, and marketing — to be aligned and for a written process with clear responsibilities to be in place.

The critical point is the third step: propagation to all systems. BBVA had recorded the customer's choice, but the data had not reached the CRM. This is the failure that generated the €5.5 million fine. In companies with multiple marketing tools — and today almost all have at least three or four — this risk is structural if not managed carefully.

Three concrete scenarios: what happens in an e-commerce business, a professional studio, and a manufacturing company?

The risk changes based on the number of channels used and the complexity of the systems, but the principle is the same: every system that sends commercial communications must receive and respect opt-outs.

Illustrative examples: the numbers and situations are meant to show the reasoning, they are not real customer data.

What other similar cases has the Italian Authority already penalized?

The Data Protection Authority has already fined several companies for unwanted marketing after opt-out: the Verisure and Altroconsumo cases show that the tolerance threshold is very low.

The difference between the fine given to BBVA and those given to the other two companies depends on several factors: the size of the company, the presence of a prior offense, and the duration of the violation. But the principle is identical. As we saw in the analysis of the Uber €825 million fine for automated decisions , European authorities are enforcing the rules with increasing strictness even towards companies of all sizes.

What tools and approaches are out there to handle opt-out safely?

There are different technical solutions, from the simplest to the most structured: the choice depends on the number of channels used and the complexity of the CRM.

Why we're talking about it now: has the European landscape really changed?

European data protection authorities have imposed €1.145 billion in GDPR fines in 2025, with a cumulative total since 2018 exceeding €7 billion. The pace of enforcement is not slowing down.

The BBVA case arrives at a time when GDPR enforcement—meaning the concrete application of fines—has reached record levels. According to the 2025 EDPB annual report (the European Data Protection Board), national authorities issued 1.145 billion euros in fines in 2025 alone. From 2018 to date, the total exceeds 7.1 billion across more than 2,800 proceedings.

It's not a trend that will stop. Authorities have more resources, more experience, and more precedents to rely on. Anyone managing marketing data without a verified opt-out system is exposed to a real, not theoretical, risk. The topic also intertwines with the new AI rules: as we analyzed in the article on AI and compliance in ad campaigns , the default settings of automated systems are increasingly under the authorities' magnifying glass.

How to get started in practice: the steps to secure your opt-out system?

The starting point is a workflow audit: mapping where opt-out requests arrive and verifying that they actually reach all systems that send commercial communications.

You don't need to start from scratch. You need to figure out where the gaps are. Here is a six-step path, also suitable for those without a dedicated IT team.

What are the most common mistakes that lead to fines like this?

BBVA's technical glitch is just one of the ways companies end up fined: there are organizational and process errors that are just as common.

A related topic worth keeping an eye on concerns EU regulation on AI in content : even there, the technical responsibility falls on the data controller, not on the tool provider.

How to tell if your opt-out system is actually working?

There are concrete indicators that allow you to verify the system's effectiveness before a complaint or inspection arrives.

So, is it worth investing in an opt-out system audit right now?

It is worth it if you do direct marketing across multiple channels (email, SMS, push, phone) and you've never checked if an opt-out on one channel also blocks the others. The risk is real and the cost of an audit is a fraction of any penalty.

A middle ground you use a single marketing channel with an integrated system, but you've never tested the end-to-end flow. A quick test and a written procedure are enough to sleep easy.

Not yet if you do not do direct marketing to contact databases and you do not send unsolicited commercial communications. Article 21 GDPR does not apply to your specific case, but it is worth checking with your DPO.

How we see it at SHM

For us, the fine for BBVA tells a story we often see: digital systems grow by accumulation. A CRM is added, then an email platform, then an app, then an automation tool. No one checks that they talk to each other when it really matters - that is, when a customer wants to stop everything.

We believe technology should serve people, not create obstacles. An opt-out system that does not work is not just a legal problem: it is a sign that the company's digital architecture needs attention. And this applies to marketing just like any other automated process.

If you want to figure out where the gaps are in your consent management and marketing communications system, we can help you with a structured audit. We work on Strategic integration of digital systems , on the data flow mapping and on team training regarding automation and business processes . You can find more insights on digital regulations and technology in the area Project management and technology .

The issue of digital compliance is also intertwined with EU fine against Meta for DSA and with the European digital sovereignty : they are all signs pointing in the same regulatory direction.

Frequently Asked Questions

The fine didn't happen because BBVA wanted to ignore the customer: it happened because nobody had ever tested whether the systems actually talked to each other.