When a company installs an AI phone agent, the technical question is usually settled before the legal one. The voice works, it picks up, it books appointments. But the AEPD (Agencia Española de Protección de Datos, Spain’s data protection authority) has been scrutinising this subject closely since 2023, and the AI Act coming into force adds specific obligations. This guide summarises which rules apply, which practices are safe and where the line is that you should not cross.
This page is for information only. It does not constitute legal advice. The legal scope of your specific case should be validated by a legal adviser or the client’s DPO. Technical and legal detail in IA y protección de datos.
TL;DR
- Inbound (a call you receive): permitted with an AI notice and a clear legal basis.
- Outbound (a call your system initiates): requires prior consent or a documented LIA from the client.
- Recording: only with a notice at the start and limited retention (30-90 days by default).
- Sensitive data: DPIA + DPO + human review are mandatory.
- The AEPD has already fined commercial AI voice practices carried out without consent.
Applicable regulatory framework
An AI phone agent sits at the intersection of several frameworks:
- RGPD (EU Regulation 2016/679): the Spanish name for the GDPR, covering the processing of personal data (the user’s voice, number, conversation content, transcript).
- LOPDGDD (Organic Law 3/2018): national implementation of the RGPD in Spain.
- LSSI-CE (Law 34/2002): electronic commercial communications, including AI voice in commercial outbound calls.
- AI Act (EU Regulation 2024/1689): requires transparency towards the user when interacting with an AI system.
- Real Decreto 12/2024: Spanish rules on automated voice processing, a partial transposition.
And depending on the sector:
- Healthcare: Law 41/2002 + regional regulations.
- Financial: Law 10/2014 + Banco de España circulars.
- Telecommunications: General Telecommunications Act.
You do not need to be a lawyer to use AI voice, but you do need to understand that ultimate responsibility lies with the data controller (your company), even if the voice is operated by a technical provider.
Inbound vs outbound: where the legal side breaks down
Inbound (incoming call)
When the customer calls your number and the AI agent answers, the legal basis is usually clear:
- Performance of a contract or pre-contractual measures (art. 6.1.b RGPD) if there is already a relationship or the customer wants to start one.
- Legitimate interest if the customer is looking for public information.
Requirements:
- A notice at the start: “you are speaking to a virtual assistant”. This is mandatory (AI Act).
- If you record: an additional notice (“the call may be recorded for quality purposes”).
- A privacy policy that is accessible and linked (website, ticket, etc.).
Well-done inbound is one of the safest uses of AI voice in Spain. Most of the AI agents deployed by clinics, estate agencies and B2B services with STAKKER work in this mode.
Outbound (a call the system initiates)
This is where the fines are. Initiating an AI call to a human recipient without a prior legal basis is unsolicited commercial communication (LSSI art. 21) and processing without a legal basis (RGPD art. 6).
The AEPD has published criteria since 2023 limiting these uses. In 2024 there were fines on companies that carried out telephone marketing with AI voice against non-opt-in lists.
If you want outbound AI voice, the lawful options are:
- Prior express consent from the recipient (a clear, documented opt-in).
- Legitimate interest with a documented LIA: an assessment that justifies the call and allows prior objection.
- An existing, active contractual relationship (a current customer, not old forgotten leads).
At STAKKER we do not activate outbound AI voice until the client provides one of these three documents. Even then, we monitor opt-outs and complaint rates.
Call recording: what you can and cannot do
Recording a call is additional processing. The Audiencia Nacional has confirmed in several rulings that, even if the call is lawful, the recording needs its own legal basis.
Good practices we apply:
- A notice at the start of the call. No notice, no recording.
- A documented legal basis: performance of a contract (active customers), contractual evidence (businesses where a spoken agreement is binding), or explicit consent.
- Limited retention: 30-90 days by default. Longer storage needs justification.
- Restricted access: only people who need it. RBAC + audit log.
- Encryption at rest of the audio.
- A genuine ability to delete if the user asks and there is no legal obligation to keep it.
If your system fails to meet any of these points, do not record. A text transcript kept for a few days is worth more than an audio file you cannot justify.
Sensitive data and AI voice: when NOT to use it
Sectors where the conversation may touch on art. 9 RGPD data (health, sensitive data) have special rules:
- Clinics (dental, aesthetics, physio, veterinary, psychology): the AI can handle appointment booking, reminders and administrative FAQs. It must NOT answer clinical questions, give opinions on symptoms or handle test results.
- Law firms: administrative triage is fine. Case details and sensitive client communications: a human.
- HR and recruitment: initial screening is fine. Hiring decisions: a human (art. 22 RGPD).
- Financial services: general information is fine. Financial advice and credit scoring: a human + DPIA.
In all these cases:
- A DPO is mandatory.
- A DPIA before going live.
- Human review of critical decisions.
- Strengthened encryption and traceability.
More on how this applies to clinics in Sistemas IA para clínicas.
The AI Act and phone agents
EU Regulation 2024/1689 (the AI Act) is being phased in until 2027. What has applied since 2025 and directly affects AI voice:
- Transparency obligation (art. 50): the recipient must know they are interacting with an AI. A notice at the start of the call, not in the privacy policy.
- Prohibition of unacceptable practices: subliminal manipulation, exploitation of vulnerabilities, social scoring. Any campaign that uses AI voice to put emotional pressure on people enters dangerous territory.
- High-risk systems: if the bot makes decisions that affect access to employment, essential services, justice or democratic processes, there are stricter obligations (registration, auditing, human oversight).
For a typical SME with an inbound reception agent, the AI Act basically means: give notice at the start. For advanced cases, there is more paperwork.
How STAKKER approaches the legality of AI voice
Before any AI phone agent goes into production, we require:
- An AI notice configured at the start of every call.
- A privacy policy published and linked from the client’s website.
- A signed DPA with art. 28 RGPD clauses.
- A list of sub-processors: Hetzner (EU), ElevenLabs / Vapi / Retell (US, with SCCs), Twilio (US, SCCs), LLM models (Anthropic / OpenAI with SCCs).
- An agreed and documented retention policy.
- Human handoff available at any time.
- Outbound switched off by default until the client provides a documented legal basis.
If the case falls into a regulated sector (clinics, financial, legal), we also require an accredited DPO on the client’s side and a DPIA before deployment.
Typical mistakes we see
A. “We record everything just in case.” No: minimisation + limited retention.
B. “We’ll put the notice in the privacy policy.” No: the notice is at the start of the call, and audible.
C. “We’ll upload the list of old leads to outbound.” High risk: without opt-in, without a LIA, without an active relationship, it is punishable.
D. “The voice provider takes care of legality.” No: your company is the data controller. The provider is the processor.
E. “We keep it for a year for security.” If you cannot justify the period, it is not kept.
F. “The bot decides who gets an appointment and who doesn’t.” Automated decisions with a significant effect: art. 22 RGPD, human review.
Practical summary
What you can do today with AI voice in Spain without nasty surprises:
- 24/7 inbound reception with an AI notice and integrated diary.
- Pre-qualification of leads who call your public number.
- Administrative FAQs (opening hours, location, indicative public prices).
- Appointment reminders with confirmation.
- Human handover when the case requires it.
What requires legal documentation first:
- Outbound to leads who have not given consent.
- Call recording with long retention.
- Processing of sensitive data (healthcare, legal, financial).
- Automated decisions that affect the user.
Frequently asked questions
Do I need a DPO to have an AI phone agent?
Not always. If the processing does not include sensitive data and is not large-scale, having a data controller is enough. For clinics, mass HR and financial services, it is essential.
Can I use AI voice to call customers who are already in my CRM?
If the purpose fits the legal basis on which they are in your CRM (performance of a contract, after-sales service with their consent), yes. For marketing, you need separate, specific consent.
How long can I keep a call recording?
30-90 days by default. Beyond that: documented justification (contractual evidence, sector-specific regulatory requirement, active dispute). Without justification, it is deleted.
Has the AEPD fined anyone for AI voice?
Yes. There have been public rulings since 2023 against companies running outbound AI voice without opt-in. RGPD fines can reach 4% of global turnover or €20M.
What if the model provider (Anthropic, OpenAI) is in the US?
It needs international transfer safeguards: SCCs or the Data Privacy Framework. The main providers have them. Your DPA with your technical provider must list them.
Can I avoid saying it’s an AI if the voice sounds human?
No. The AI Act prohibits it. And the AEPD has already treated the notice as a transparency obligation.
Next step
If you have an AI phone agent project and want to know what applies to you before spending a euro, we can review it for free. We will tell you which requirements your case has, what paperwork is needed, and whether AI voice suits it or another solution is better.
Auditar mi caso · Ver agente telefónico IA · Ver enfoque legal completo
If you work in the property sector, here is the case applied to estate agencies. For clinics, here.