- Does this case apply to my company too, or just to large telephone operators?
- What exactly happened with Wind Tre and which rules were broken?
- Is the Authority really increasing telemarketing checks, or is this an isolated case?
- Who is really responsible when an agent or an external call center makes a mistake?
- What actually happens in a manufacturing company, an e-commerce business, and a professional firm?
- What other similar cases has the Data Protection Authority sanctioned in recent months?
- What tools exist to manage consents and opt-outs securely?
- How do you conduct a consent audit: the concrete steps to get started right away?
- What are the most frequent mistakes that lead to sanctions like this one?
- How do you know if your consent management is actually working?
- So, is it worth doing an audit now or can it wait?
- How we see it at SHM
- Frequently Asked Questions
- The Italian Data Protection Authority fined Wind Tre 16.7 million euros for telemarketing without valid consent and failure to manage opt-outs.
- The problem wasn't just Wind Tre: the responsibility extends to the entire sales network, including agents and partners.
- Immediate consent audits, opt-out traceability, and monitoring business partners are the three priority actions for any company doing telemarketing.
A 16.7 million euro fine for continuing to call people who had already said no. If your company uses agent networks or call centers to acquire customers, this case directly concerns you.
Does this case apply to my company too, or just to large telephone operators?
It concerns anyone doing telemarketing, even through agents or external partners. The Data Protection Authority has clarified that responsibility cannot be delegated to the sales network.
Wind Tre is a phone operator with millions of customers, but the principle that led to the fine applies to any company: if you use the phone to acquire customers, you are responsible for how their data is handled, even when the calls are made by an external agent or an outsourced call center.
The Italian Data Protection Authority fined Wind Tre 16.7 million euros for violations of the GDPR (the European General Data Protection Regulation, in force since 2018). The violations concern illicit telemarketing, failure to manage opt-out requests (i.e., the request to no longer be contacted), and the activation of contracts without the users' knowledge.
If your company runs customer acquisition campaigns via phone, email, or SMS — even through agencies or sales networks — this case concerns you.
| Your situation | Current risk | why |
|---|---|---|
| Do direct telemarketing with an internal list | High | You must prove valid consent for every contact |
| Do you use outsourced agents or call centers | Very high | You are also responsible for their actions |
| You have a list purchased from third parties | Very high | Consent must be specific to your use |
| You have an opt-out system but you don't verify it | High | If you call someone who said no, the fine is automatic |
| You don't do telemarketing but you collect data for marketing | Medium | Consent rules also apply to emails and SMS |
| You have a documented and verified system | Low | Documentation is the first line of defense in case of an inspection |
What exactly happened with Wind Tre and which rules were broken?
The Data Protection Authority found people who were receiving promotional calls after having exercised their right to object, and contracts activated without their knowledge. Internal systems were unable to block these situations.
The investigation by the Italian Data Protection Authority into Wind Tre started from numerous complaints from people who kept receiving sales calls despite having already asked not to be contacted anymore. Some had even found contracts activated in their name without having requested them.
The problem wasn't just the bad intentions of a few agents: Wind Tre's systems and procedures were not structured to prevent these situations. The sales network operated without effective controls, and user requests were not addressed in a timely manner.
| GDPR article violated | What it includes | What was missing at Wind Tre |
|---|---|---|
| Art. 5 – Basic principles | Data must be processed lawfully and transparently | Contacts without a valid legal basis |
| Art. 6 – Lawfulness of processing | Consent or other legal basis required | Invalid or missing consents |
| Art. 12 and 15 – Data subject rights | User requests must be handled | Late or missing responses |
| Art. 21 – Right to object | Anyone who says no must not be contacted again | Opt-outs not respected |
| Art. 24 and 25 – Accountability and privacy by design | The controller must prevent violations | Systems not designed to block illicit uses |
| Art. 32 – Security of processing | Appropriate technical and organizational measures | Insufficient controls on the sales network |
The Data Protection Authority didn't stop at the fine: it also banned Wind Tre from continuing to use data acquired without consent and ordered them to adopt concrete measures to respect user rights, particularly the right to object to direct marketing. A similar case, with the same sanctioning logic, had already affected BBVA for 5.5 million euros for ignoring a customer's opt-out .
Is the Authority really increasing telemarketing checks, or is this an isolated case?
It's not an isolated case. In 2024, aggressive telemarketing generated 6 million euros in fines in Italy alone, and the Data Protection Authority's inspection activity is constantly growing.
According to data from 2024 annual report of the Italian Data Protection Authority , the authority adopted 835 total measures, of which 468 were corrective or sanctioning, and handled over 4,000 complaints. Inspections — also conducted with the Financial Police — totaled 130.
Telemarketing is one of the most affected sectors. In 2024, the Data Protection Authority approved the first national Code of Conduct for telemarketing and teleselling, with an independent monitoring body. The platform has been active since January 2026. SegnalaODM , which allows users to report violations by operators adhering to the Code, as reported by Federprivacy .
The highest penalty ever issued by the Italian Data Protection Authority remains the one against Enel Energia: 79.1 million euros for illicit telemarketing, confirmed by the Court of Rome in September 2025, as reported by klarproof.com. Wind Tre is part of a series of increasing sanctions involving energy operators, telecommunications, and banks. The European landscape is even broader: according to scrut.io , from 2018 to August 2025, European authorities issued over 2,800 GDPR fines for a total exceeding 6.2 billion euros, with more than 60% concentrated from January 2023 onwards.
Who is really responsible when an agent or an external call center makes a mistake?
The data controller — that is, your company — is always responsible, even if an external partner is the one making the calls. Delegating execution does not mean delegating responsibility.
This is the point that many companies underestimate. The Authority explicitly emphasized that those who use complex sales networks remain responsible for ensuring that personal data is processed in compliance with the GDPR. It's not enough to sign a contract with a call center: you have to verify that the procedures actually work.
The same principle applies to those who use marketing agencies, business partners, or resellers that collect data on behalf of the company. If that agent calls someone who had already said no, the fine goes to the commissioning company, not just the agent.
- 1 · Client company Defines the rules It establishes which lists to use, which consents are valid, and how to handle opt-outs. It must be done in writing, with verifiable procedures.
- 2 · Partner / call center Executes the campaigns Call, send emails, or SMS following the instructions received. They must be appointed as a 'data processor' with a specific contract (DPA).
- 3 · Client company Check and document Periodically verify that your partner follows the rules. Without documented checks, in the event of an inspection, the responsibility falls entirely on the company.
- 4 · End user Exercises their rights You can ask to no longer be contacted (opt-out), access your data, or delete it. The request must be handled within 30 days.
- 5 · Client company Update the lists Every opt-out must be implemented across all systems, including those of your partners. An ignored opt-out is the easiest violation to prove during an inspection.
What actually happens in a manufacturing company, an e-commerce business, and a professional firm?
The rules are the same for everyone, but the concrete risks change based on how you collect and use potential customers' data.
Illustrative examples: the numbers and situations below serve to show the reasoning, they are not real customer data.
| Company type | Typical situation | Main risk | Priority action |
|---|---|---|---|
| B2B manufacturing company | List of prospects collected at a trade fair, passed to an agent for telephone follow-up | Undocumented consent, no opt-out system | Collect explicit consent at the trade fair, create an opt-out register |
| E-commerce | Newsletters and promotional SMS to those who have purchased in the past | Marketing consent not separated from contractual consent | Separate consents in the registration form, update the privacy policy |
| Professional studio | Contacts of former customers used to promote new services | Use of data collected for a purpose other than the original one | Check if the consent also covers marketing, otherwise ask for new consent |
The topic of separate consent is crucial for e-commerce: often consent for data processing for a purchase is confused with consent for marketing. They are two distinct things. Someone who buys from you hasn't automatically said yes to your promotional emails. This error is among the most common and easiest to challenge during an inspection, as we have also seen in the case of default settings in AI ad campaigns .
What other similar cases has the Data Protection Authority sanctioned in recent months?
The Data Protection Authority has fined energy providers, banks, and telecommunications companies with increasing amounts. Illegal telemarketing is the most affected category.
| Company | Fine | Main reason | Year |
|---|---|---|---|
| Enel Energia | 79.1 mln € | Illegal telemarketing, database security flaws | 2024 |
| Wind Tre | 16.7 mln € | Telemarketing without consent, opt-outs not respected | 2026 |
| BBVA | 5.5 mln € | Opt-out ignored, illicit direct marketing | 2025 |
| Acea Energia | 3.0 mln € | Illicit telemarketing, agencies involved | 2025 |
| E.ON Energia | 0.89 mln € | Telemarketing without a proper legal basis | 2025 |
The fine for Acea Energia is particularly relevant because it also affected the agencies involved in the campaign, with an additional 850,000 euros. This confirms that the risk is spread throughout the entire chain: client, agency, call center.
This isn't just temporary attention. The Authority has declared aggressive telemarketing an enforcement priority, and the new Code of Conduct — operational since March 2024 — provides an extra tool for inspections. Those who don't adhere to the Code or don't follow its rules are exposed to faster sanctions.
What tools exist to manage consents and opt-outs securely?
There are technical and procedural solutions for every company size. The choice depends on the volume of contacts and the complexity of the sales network.
| Tool / approach | Suitable for | What it solves | Main limitation |
|---|---|---|---|
| CRM with integrated consent management | SMEs and mid-market | Track consent and opt-out for every contact | Requires setup and maintenance |
| Consent Management Platform (CMP) | E-commerce, sites with many users | Manages web consents, cookies, newsletters | Does not cover phone contacts |
| Manual register on an Excel sheet | Micro-enterprises with few contacts | Affordable and immediate | Not scalable, hard to audit |
| CRM + call center integration | Companies with an external sales network | Sync opt-outs in real-time across systems | Higher integration cost |
| Automatic verification against RPO | Who does telemarketing on landlines and mobile numbers | Automatically excludes those registered in the Register of Oppositions | Requires periodic list updates |
The Public Register of Oppositions (RPO) is a mandatory tool for anyone doing telemarketing to Italian phone numbers. As of October 9, 2024, there were 30 million registrations in the telephone registry, with over 150,000 reports of violations that same year, according to the official RPO data reported by robertapegoraro.it . Calling a number registered with the RPO without explicit consent is an immediate and documented violation.
Choosing the right tool depends on your situation. An e-commerce site with 50,000 newsletter subscribers has different needs than a manufacturing company with 200 prospects managed by three agents. The important thing is that the chosen system produces verifiable documentation: in the event of an inspection, proof of consent and opt-out must be retrievable in a few minutes.
How do you conduct a consent audit: the concrete steps to get started right away?
A consent audit doesn't take months: in one week you can have a clear snapshot of your situation and a priority plan.
- 1 · Marketing manager / DPO Map all contact lists Where is the data? CRM, Excel sheets, call center systems, website databases. Every list must have a documented source.
- 2 · Marketing manager / legal Verify the legal basis for every list For every group of contacts: is there explicit consent? Is it documented? Does it cover marketing as well, or just the contract?
- 3 · IT / CRM manager Check the opt-out system Is someone who asks to no longer be contacted blocked in all systems, including those of partners? How quickly? Test the process.
- 4 · Sales manager / partner manager Check contracts with partners Does every call center or agency have a contract naming them 'data processors' (DPA)? Are their procedures aligned with yours?
- 5 · DPO / legal Update the record of processing activities The register must reflect the real situation, not the ideal one. If data is missing, now is the time to add it.
- 6 · The whole team Define intervention priorities Not everything can be solved in a day. Rank risks by urgency and impact, and assign clear responsibilities with deadlines.
A point often overlooked: an audit is not a one-time event. The Data Protection Authority views companies that have periodic verification procedures more favorably, not just those that have done an audit once. Adding a semi-annual review to your calendar is one of the simplest measures to demonstrate accountability (i.e., the active responsibility of those who manage data).
For those managing marketing automation processes — automatic email, SMS, or call flows — the topic intertwines with the managing data access requests , another front where the Data Protection Authority is increasing checks.
What are the most frequent mistakes that lead to sanctions like this one?
The most common errors aren't malicious acts: they're missing procedures, non-integrated systems, and controls that were never verified in the field.
From the analysis of the cases sanctioned by the Data Protection Authority, a recurring pattern emerges. The errors are almost never intentional: they stem from processes built without thinking about compliance, or from systems that do not communicate with each other.
| Common mistake | Why it's risky | How to fix it |
|---|---|---|
| Generic consent in the registration form | Does not cover direct marketing, it is contestable | Separate contract consent from marketing consent |
| Opt-out recorded only in the main CRM | The external call center keeps calling | Synchronize opt-out across all systems within 24 hours |
| List purchased from third parties used without verification | The original consent does not cover your specific use | Verify the consent chain or do not use the list |
| No DPA contract with the call center | In case of a breach, the responsibility is all yours | Sign a Data Processing Agreement with every partner |
| Consent audit never performed | You don't know what's in your lists | Schedule an audit within 30 days and then every 6 months |
| Outdated privacy policy | It doesn't reflect actual processing, which is a violation in itself | Update the policy and communicate it to users |
How do you know if your consent management is actually working?
There are concrete indicators you can monitor without sophisticated tools. The clearest signal is the speed with which an opt-out is processed across all systems.
| Indicator | Target value | Risk signal |
|---|---|---|
| Time to implement opt-out across all systems | < 24 hours | More than 48 hours or unverified |
| Percentage of contacts with documented consent | 100% | Any list without a documented source |
| DPA contracts signed with all partners | 100% of active partners | Even one partner without a DPA |
| Date of the last consent audit | < 6 months ago | No audit or audit > 12 months ago |
| Check list against RPO before every campaign | Yes, documented | Not performed or not documented |
A practical test: take a random contact from your list and try to reconstruct, in less than five minutes, when they gave consent, for what purpose, and if they ever asked not to be contacted again. If you can't answer, you have a traceability problem. This is exactly the type of check the Data Protection Authority performs during an inspection.
The topic of traceability also applies to digital campaigns: the default settings in AI ad campaigns can lead to unauthorized data processing without the company noticing.
So, is it worth doing an audit now or can it wait?
It is worth it if you do telemarketing — even just via email or SMS — and you have never verified the validity of the consents in your lists. The risk is real and the audit can be done in a few days.
A middle ground you already have a consent management system but you don't check it periodically and you don't have DPA contracts with all your partners. A partial and focused audit is sufficient.
Not yet if You don't do any direct marketing and don't collect contact data for promotional purposes. In this case, telemarketing rules don't apply.
How we see it at SHM
For us, AI and marketing process automation should be integrated to free companies from routine — not to bypass the rules. A well-built consent management system isn't an obstacle to campaigns: it's what makes them sustainable over time, without the risk of having your lists blocked or receiving a fine that wipes out months of work.
We work with companies that use marketing automation and digital campaigns across multiple channels. When we tackle a project of Strategic integration of AI into business processes , the traceability of consents is one of the first points we verify: not because it is mandatory, but because a system that cannot distinguish who said yes from who said no is not a reliable system.
Think about a company that manages lead generation campaigns with a CRM and an external call center: often the two systems don't communicate in real time, and an opt-out recorded in the CRM doesn't reach the call center before the next call. It's a technical problem, not bad faith, but the legal consequences are the same. Integrating systems to synchronize opt-outs automatically is one of the most concrete use cases for Data processing and business intelligence applied to compliance.
If you want to understand where to start, our team is available for an initial assessment. You can find us on shm.studio/contatti . You can find more insights on digital regulations and processes in the cluster Project management and technology .
Frequently Asked Questions
Yes. GDPR rules on telemarketing apply to any company that contacts people for promotional purposes, regardless of the sector. If you use email, SMS, or phone calls to acquire customers, you are subject to the same regulations.
It depends on how it was collected and for what purpose. Generic consent, not specific to marketing, or collected without an adequate privacy notice, is not valid. You need to check on a case-by-case basis and, if necessary, collect new consent.
Yes, always. The GDPR states that the data controller—that is, your company—is also responsible for the actions of partners who process data on its behalf. You must have a specific contract (Data Processing Agreement) and verify that their procedures are compliant.
The Public Register of Oppositions (RPO) is a list of phone numbers whose owners have requested not to be contacted for telemarketing. Anyone running telephone campaigns is required to check their lists against the register before every campaign. As of 2024, there were 30 million registrations.
The GDPR does not set a specific deadline for marketing opt-outs, but it requires that requests from data subjects be handled without undue delay. In practice, the Data Protection Authority considers implementation within 24-48 hours across all involved systems to be acceptable.
GDPR fines can reach up to 4% of total annual global turnover or 20 million euros, whichever is higher. The Data Protection Authority can also ban data processing, which means blocking marketing campaigns until the situation is resolved.
The fine doesn't arrive because you did telemarketing: it arrives because you can't prove that you did it in compliance with the rules.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
