- Does this case also affect my company, or only the big phone carriers?
- What exactly happened with Wind Tre, and which rules were violated?
- Is the Garante really stepping up telemarketing checks, or is this an isolated case?
- Who is really responsible when an agent or external call center gets it wrong?
- What does this look like in practice for a manufacturer, an e-commerce store and a professional firm?
- What similar cases has the Garante already penalized in recent months?
- What tools can you use to manage consent and opt-outs safely?
- How do you run a consent audit? The practical steps to start right away
- What are the most common mistakes that lead to fines like this?
- How can you tell if your consent management is really working?
- So, is it worth running an audit now, or can it wait?
- How we see it at SHM
- Frequently Asked Questions
- Italy's data protection authority fined Wind Tre €16.7 million for telemarketing without valid consent and failure to handle opt-outs.
- The problem wasn't just Wind Tre: responsibility extends to the entire sales network, including agents and partners.
- An immediate consent audit, opt-out traceability and oversight of commercial partners are the three priority actions for any company that does telemarketing.
A €16.7 million fine for continuing to call people who had already said no. If your company uses agent networks or call centers to win customers, this case affects you directly.
Does this case also affect my company, or only the big phone carriers?
It affects anyone who does telemarketing, including through agents or outside partners. The Garante made it clear that responsibility can't be delegated to the sales network.
Wind Tre is a phone carrier with millions of customers, but the principle behind the fine applies to any company: if you use the phone to win customers, you're responsible for how their data is handled, even when the caller is an external agent or an outsourced call center.
Italy's data protection authority (the Garante Privacy) fined Wind Tre €16.7 million for violations of the GDPR (the European data protection regulation, in force since 2018). The violations involve unlawful telemarketing, failure to handle opt-out requests (requests not to be contacted anymore) and contracts activated without users' knowledge.
If your company runs customer acquisition campaigns by phone, email or SMS, even through agencies or sales networks, this case affects you.
| Your situation | Current risk | why |
|---|---|---|
| You do direct telemarketing with an in-house list | High | You must prove valid consent for every contact |
| You use agents or outsourced call centers | Very high | You're also responsible for their actions |
| You have a list bought from third parties | Very high | Consent must be specific to your use |
| You have an opt-out system but don't verify it | High | If you call someone who said no, the fine is automatic |
| You don't do telemarketing but collect data for marketing | Medium | Consent rules also apply to email and SMS |
| You have a documented, verified system | Low | Documentation is your first line of defense in an inspection |
What exactly happened with Wind Tre, and which rules were violated?
The Garante found people receiving promotional calls after exercising their right to object, and contracts activated without their knowledge. Internal systems were unable to prevent these situations.
The Garante's investigation into Wind Tre started from numerous complaints from people who kept receiving sales calls even though they had already asked not to be contacted. Some even found contracts activated in their name without having requested them.
The problem wasn't just the bad faith of a few agents: Wind Tre's systems and procedures weren't built to prevent these situations. The sales network operated without effective controls, and user requests weren't processed in a timely manner.
| GDPR article violated | What it involves | What Wind Tre lacked |
|---|---|---|
| Art. 5 – Core principles | Data must be processed lawfully and transparently | Contacts made without a valid legal basis |
| Art. 6 – Lawfulness of processing | You need consent or another legal basis | Invalid or missing consent |
| Art. 12 and 15 – Data subjects' rights | User requests must be handled | Late or missing responses |
| Art. 21 – Right to object | Anyone who says no must not be contacted again | Opt-outs not respected |
| Art. 24 and 25 – Accountability and privacy by design | The controller must prevent violations | Systems not designed to block unlawful use |
| Art. 32 – Security of processing | Appropriate technical and organizational measures | Insufficient oversight of the sales network |
The Garante didn't stop at the fine: it also banned Wind Tre from continuing to use data obtained without consent and ordered it to adopt concrete measures to respect users' rights, in particular the right to object to direct marketing. A similar case, with the same penalty logic, had already hit BBVA with a €5.5 million fine for ignoring a customer's opt-out.
Is the Garante really stepping up telemarketing checks, or is this an isolated case?
This is not an isolated case. In 2024, aggressive telemarketing generated €6 million in fines in Italy alone, and the Garante's inspection activity keeps growing.
According to the 2024 annual report of the Garante Privacy, the authority adopted 835 measures in total, 468 of them corrective or sanctioning, and handled over 4,000 complaints. It carried out 130 inspections, some of them together with the Guardia di Finanza.
Telemarketing is one of the hardest-hit sectors. In that same year, 2024, the Garante approved the first national Code of Conduct for telemarketing and teleselling, with an independent monitoring body. Since January 2026, the SegnalaODM platform has been live, allowing users to report violations by operators that have signed up to the Code, as reported by Federprivacy.
The highest fine ever imposed by the Italian Garante is still the one against Enel Energia: €79.1 million for unlawful telemarketing, upheld by the Court of Rome in September 2025, as reported by klarproof.com. Wind Tre is part of a series of rising fines hitting energy providers, telecoms and banks. The European picture is even broader: according to scrut.io, from 2018 to August 2025 European authorities issued over 2,800 GDPR fines totaling more than €6.2 billion, with over 60% of that coming since January 2023.
Who is really responsible when an agent or external call center gets it wrong?
The data controller, meaning your company, is always responsible, even when an external partner makes the call. Delegating the work doesn't mean delegating the responsibility.
This is the point many companies underestimate. The Garante has explicitly stressed that anyone using complex sales networks remains responsible for ensuring personal data is processed in line with the GDPR. Signing a contract with the call center isn't enough: you need to check that the procedures really work.
The same principle applies if you use marketing agencies, business partners or resellers who collect data on your company's behalf. If that agent calls someone who had already said no, the fine goes to the client company, not just the agent.
- 1 · Client companySets the rulesDecides which lists to use, which consents are valid and how to handle opt-outs. It must do this in writing, with verifiable procedures.
- 2 · Partner / call centerRuns the campaignsCalls, or sends emails or SMS, following the instructions it receives. It must be appointed as a "data processor" with a specific contract (DPA).
- 3 · Client companyMonitors and documentsRegularly checks that the partner follows the rules. Without documented checks, responsibility falls entirely on the company in the event of an inspection.
- 4 · End userExercises their rightsThey can ask not to be contacted anymore (opt-out), access their data or have it deleted. The request must be handled within 30 days.
- 5 · Client companyUpdates the listsEvery opt-out must be applied across all systems, including those of your partners. An ignored opt-out is the easiest violation to prove during an inspection.
What does this mean in practice for a manufacturing company, an e-commerce store and a professional firm?
The rules are the same for everyone, but the real risks vary depending on how you collect and use prospect data.
Illustrative examples: the numbers and situations below are meant to show the reasoning, not real client data.
| Company type | Typical situation | Main risk | Priority action |
|---|---|---|---|
| B2B manufacturing company | Prospect list collected at a trade show and handed to an agent for phone follow-up | Undocumented consent, no opt-out system | Collect explicit consent at the show, create an opt-out register |
| E-commerce | Newsletters and promotional SMS to past buyers | Marketing consent not separated from contractual consent | Separate the consents in the sign-up form, update the privacy policy |
| Professional studio | Former customers' contacts used to promote new services | Use of data collected for a purpose different from the original one | Check whether the consent also covers marketing, otherwise ask for new consent |
Separate consent is crucial for e-commerce: consent to data processing for a purchase is often confused with consent to marketing. They are two different things. Someone who buys from you hasn't automatically said yes to your promotional emails. This is one of the most common mistakes and one of the easiest to challenge during an inspection, as we also saw in the case of default settings in AI-powered ad campaigns.
What similar cases has the Garante already penalized in recent months?
The Garante has fined energy providers, banks and telecom companies with rising amounts. Unlawful telemarketing is the most affected category.
| Company | Fine | Main reason | Year |
|---|---|---|---|
| Enel Energia | €79.1M | Unlawful telemarketing, database security shortcomings | 2024 |
| Wind Tre | €16.7M | Telemarketing without consent, opt-outs not respected | 2026 |
| BBVA | €5.5M | Ignored opt-out, unlawful direct marketing | 2025 |
| Acea Energia | €3.0M | Unlawful telemarketing, agencies involved | 2025 |
| E.ON Energia | €0.89M | Telemarketing without a valid legal basis | 2025 |
The fine against Acea Energia is particularly significant because it also hit the agencies involved in the campaign, with an additional €850,000. This confirms that the risk is spread along the entire chain: client, agency, call center.
This isn't a passing focus. The Garante has declared aggressive telemarketing an enforcement priority, and the new Code of Conduct, in force since March 2024, gives inspectors one more tool. Anyone who doesn't sign up to the Code or doesn't follow its rules faces faster penalties.
What tools can you use to manage consent and opt-outs safely?
There are technical and procedural solutions for companies of every size. The right choice depends on your contact volume and the complexity of your sales network.
| Tool / approach | Suitable for | What it solves | Main limitation |
|---|---|---|---|
| CRM with built-in consent management | SMEs and mid-market | Tracks consent and opt-out for every contact | Requires setup and maintenance |
| Consent Management Platform (CMP) | E-commerce, sites with many users | Manages web consents, cookies, newsletters | Doesn't cover phone contacts |
| Manual register in an Excel spreadsheet | Micro-businesses with few contacts | Affordable and immediate | Doesn't scale, hard to audit |
| CRM + call center integration | Companies with an external sales network | Syncs opt-outs across systems in real time | Higher integration cost |
| Automatic check against the RPO | Anyone doing telemarketing to landline and mobile numbers | Automatically excludes anyone listed in the Registro Opposizioni (Do Not Call Registry) | Requires the list to be updated regularly |
The Registro Pubblico delle Opposizioni (RPO, Italy's public Do Not Call Registry) is mandatory for anyone doing telemarketing to Italian phone numbers. As of October 9, 2024, 30 million numbers were registered in the telephone registry, with over 150,000 violation reports in the same year, according to the official RPO data reported by robertapegoraro.it. Calling a number listed in the RPO without explicit consent is an immediate, documented violation.
The right tool depends on your situation. An e-commerce store with 50,000 newsletter subscribers has different needs than a manufacturer with 200 prospects handled by three agents. What matters is that the system you choose produces verifiable documentation: in an inspection, proof of consent and opt-out must be retrievable in minutes.
How do you run a consent audit? The practical steps to start right away
A consent audit doesn't take months: in one week you can have a clear picture of where you stand and a priority plan.
- 1 · Marketing manager / DPOMap all your contact listsWhere is your data? CRM, Excel sheets, call center systems, website databases. Every list must have a documented source.
- 2 · Marketing manager / legalCheck the legal basis for each listFor each group of contacts: is there explicit consent? Is it documented? Does it cover marketing, or only the contract?
- 3 · IT / CRM managerCheck your opt-out systemIs anyone who asks not to be contacted again blocked across all systems, including your partners'? How quickly? Test the process.
- 4 · Sales manager / partner managerReview your partner contractsDoes every call center or agency have a contract naming them as data processors (DPA)? Are their procedures aligned with yours?
- 5 · DPO / legalUpdate your record of processing activitiesThe record must reflect the real situation, not the ideal one. If data is missing, now is the time to add it.
- 6 · The whole teamSet your priorities for actionNot everything gets fixed in a day. Rank risks by urgency and impact, and assign clear responsibilities with deadlines.
One point that's often overlooked: an audit is not a one-off event. The Garante (Italy's data protection authority) looks favorably on companies with periodic review procedures, not just those that ran an audit once. Putting a six-month review on the calendar is one of the simplest ways to demonstrate accountability (that is, the active responsibility of those who handle data).
If you run marketing automation processes, meaning automated flows of emails, SMS or calls, the topic overlaps with handling data access requests, another area where the Garante is stepping up checks.
What are the most common mistakes that lead to fines like this?
The most common mistakes aren't deliberate: they come from missing procedures, disconnected systems and controls never tested in the field.
Analyzing the cases sanctioned by the Garante reveals a recurring pattern. The mistakes are almost never intentional: they come from processes built without compliance in mind, or from systems that don't talk to each other.
| Common mistake | Why it is risky | How to fix it |
|---|---|---|
| Generic consent in the sign-up form | Doesn't cover direct marketing, can be challenged | Separate consent to the contract from consent to marketing |
| Opt-out recorded only in the main CRM | The external call center keeps calling | Sync the opt-out across all systems within 24 hours |
| List bought from third parties and used without verification | The original consent doesn't cover your specific use | Verify the chain of consent or don't use the list |
| No DPA contract with the call center | In case of a violation, the liability is entirely yours | Sign a Data Processing Agreement with every partner |
| Consent audit never done | You don't know what's in your lists | Schedule an audit within 30 days, then every 6 months |
| Outdated privacy policy | It doesn't reflect actual processing, which is a violation in itself | Update the policy and communicate it to users |
How can you tell if your consent management is really working?
There are concrete indicators you can track without sophisticated tools. The clearest signal is how fast an opt-out is applied across all systems.
| Indicator | Target value | Risk signal |
|---|---|---|
| Time to apply an opt-out across all systems | < 24 hours | More than 48 hours or not verified |
| Percentage of contacts with documented consent | 100% | Any list without a documented source |
| DPA contracts signed with all partners | 100% of active partners | Even a single partner without a DPA |
| Date of the last consent audit | < 6 months ago | No audit, or audit > 12 months ago |
| List checked against the RPO before every campaign | Yes, documented | Not done or not documented |
A practical test: pick a random contact from your list and try to work out, in under five minutes, when they gave consent, for what purpose, and whether they ever asked not to be contacted again. If you can't answer, you have a traceability problem. This is exactly the kind of check the Garante runs during an inspection.
Traceability applies to digital campaigns too: default settings in AI-powered ad campaigns can lead to unauthorized data processing without the company even noticing.
So, is it worth running an audit now, or can it wait?
Worth it if you do telemarketing, even just by email or SMS, and have never verified the validity of the consents in your lists. The risk is real, and an audit takes just a few days.
Somewhere in between: you already have a consent management system but don't check it regularly and don't have DPA contracts with all your partners. A partial, focused audit is enough.
Not yet if you don't do any direct marketing and don't collect contact data for promotional purposes. In that case, the telemarketing rules don't apply.
How we see it at SHM
For us, AI and marketing process automation should be built in to free companies from routine, not to get around the rules. A well-built consent management system isn't an obstacle to campaigns: it's what makes them sustainable over time, without the risk of having your lists blocked or getting a fine that wipes out months of work.
We work with companies that use marketing automation and multichannel digital campaigns. When we take on a project for the strategic integration of AI into business processes, consent traceability is one of the first things we check: not because it's mandatory, but because a system that can't tell who said yes from who said no isn't a reliable system.
Picture a company running lead generation campaigns with a CRM and an external call center: often the two systems don't talk in real time, and an opt-out recorded in the CRM doesn't reach the call center before the next call. It's a technical problem, not bad faith, but the legal consequences are the same. Integrating systems to sync opt-outs automatically is one of the most concrete use cases of data processing and business intelligence applied to compliance.
If you want to know where to start, our team is available for an initial assessment. You can find us at shm.studio/contatti. You'll find more insights on digital regulation and processes in the Project management and technology cluster.
Frequently Asked Questions
Yes. The GDPR's telemarketing rules apply to any company that contacts people for promotional purposes, whatever the industry. If you use email, SMS or phone calls to win customers, the same rules apply to you.
It depends on how it was collected and for what purpose. Generic consent, consent that isn't specific to marketing, or consent collected without a proper privacy notice is not valid. You need to check case by case and, where necessary, collect new consent.
Yes, always. Under the GDPR, the data controller (your company) is also responsible for the actions of partners who process data on its behalf. You need a specific contract (a Data Processing Agreement) and must verify that their procedures are compliant.
The Registro Pubblico delle Opposizioni (RPO) is Italy's public do-not-call register: a list of phone numbers whose owners have asked not to be contacted for telemarketing. Anyone running phone campaigns must check their lists against the register before every campaign. As of 2024, it had 30 million registrations.
The GDPR doesn't set a specific deadline for marketing opt-outs, but it requires data subjects' requests to be handled without undue delay. In practice, the Garante considers it acceptable to apply an opt-out within 24-48 hours across all systems involved.
GDPR fines can reach up to 4% of global annual turnover or €20 million, whichever is higher. The authority can also ban data processing, which means blocking your marketing campaigns until the situation is resolved.
The fine doesn't come because you did telemarketing: it comes because you can't prove you did it by the rules.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
