Spam Call Recording Leads to First €10,000 Fine in Spain 2026

The first fine based on a recorded spam call has been issued in Spain, with the Spanish Data Protection Agency (AEPD) penalizing solar panel company Más Sol Energía €10,000 for two violations of data protection law. This landmark case validates the AEPD's 2023 recommendation that consumers record unsolicited commercial calls to report them.

The fine, announced this week, marks a significant victory for consumers tired of relentless telemarketing. It also sets a precedent for how audio evidence can be used to hold companies accountable under the General Data Protection Regulation (GDPR).

What Happened: The First Spam Call Recording Fine

The AEPD fined Más Sol Energía €10,000 for two infractions: making a commercial call without valid consent and failing to specify the source of the personal data used. The case was triggered by a consumer who recorded a 46-second call from the company.

In the recording, the caller offered to install solar panels. When the consumer asked where his data had been obtained and noted he was on an advertising exclusion list, the salesperson replied: "I don't have to check any of that, sir, I work with a database." That statement became key evidence.

Why This Case Matters for Consumers

This is the first time a spam call recording has been used as decisive evidence in an AEPD sanction. It proves that individuals can effectively fight back against unwanted calls using simple tools.

The ruling reinforces that companies must obtain explicit consent before calling and must be transparent about data sources. The AEPD's resolution stated that the audio content was "unequivocal proof" of the violations.

Key Takeaways from the Ruling

• Recording spam calls can serve as valid evidence in data protection complaints.
• Companies must verify consent and data sources before making commercial calls.
• The AEPD can impose fines based solely on audio recordings.
• Consumers on exclusion lists have strong grounds for reporting violations.
• This precedent may encourage more people to report unsolicited calls.

How to Record and Report Spam Calls

To follow the AEPD's advice, start by documenting the call. Use your smartphone's built-in recording feature or a third-party app, but ensure you comply with local laws—in Spain, you can record calls you participate in for evidence.

Next, note the date, time, and phone number. If the caller mentions a company name, write it down. Then, file a complaint with the AEPD through its website, attaching the audio file and a detailed description.

What Evidence Is Needed?

The AEPD requires clear proof of the call's content and the caller's identity. The recording should capture the commercial nature of the call and any statements about data sources or consent.

In this case, the 46-second clip was enough because it included the salesperson's admission that he hadn't checked the exclusion list. Such admissions are powerful evidence.

Comparing Spam Call Regulations in Europe

Spain's approach is part of a broader European effort to curb unwanted telemarketing. The GDPR provides a framework, but enforcement varies by country.

While fines differ, the trend is clear: regulators are increasingly willing to act on consumer complaints, especially when backed by solid evidence. The background to this story is set out in Movistar's Network-Level Spam Call Blocker Cuts Fraud. A related thread runs through Funeral Law Reform After Robert Bush Crimes: UK Regulation. Earlier coverage in First AI Agent Cyberattack in Spain: AEPD Confirms Breach shows how the argument developed.

What This Means for Companies

Businesses that rely on telemarketing must review their data practices. They need to ensure they have valid consent and can document where contact details came from. A closer look at the same subject appears in Data protection law: what it is and how it affects you. Anyone following the wider picture can start with England Wildfire Record 2026: July Worst Month Ever Recorded. The same theme surfaces in UK AI Security: Ukraine Battlefield Data to Protect Sites, which takes a different angle.

The Más Sol Energía case shows that ignoring exclusion lists and failing to verify data sources can lead to fines. Companies should also train staff to handle data source inquiries professionally, as careless remarks can become evidence. Context on how this played out before sits in Protect NHS Patient Data: Secure Records with Open Standards. A companion piece, Protect NHS Patient Data: 5 Steps for Secure Records, approaches the same subject from another angle.

FAQ

As telemarketing continues to evolve, this case highlights the power of consumer evidence. With regulators increasingly open to audio proof, recording spam calls could become a standard practice.