Spain cold calling rules in 2026: the 400 prefix and B2B calls

Spain’s cold calling rules changed in two steps. Since 7 Jun 2025, no one may make unsolicited sales calls from a Spanish mobile number. Since mid-October 2026, large consumer brands and basic-service companies must call from numbers starting with 400. For most B2B teams the 400 rule does not apply, but the caller ID rules and the AEPD’s call script do.

In October, Spanish news was full of “prefijo 400”, most of it written for consumers. Here is what it means for a sales team calling companies in Madrid, Barcelona or Valencia.

Three rules, three dates

Since	Rule	Who it binds	Source
29 Jun 2023	A right not to receive unwanted sales calls, unless there is consent or another GDPR legal basis	Anyone calling Spanish numbers	Circular 1/2023
7 Jun 2025	No Spanish mobile numbers for unsolicited sales calls; calls from abroad showing a Spanish number are blocked	Anyone making unsolicited sales calls	Orden TDF/149/2025, articles 5 and 9
About 17 Oct 2026	Sales calls only from 400 numbers	Companies covered by Ley 10/2025	Resolución of 14 Apr 2026

The first rule is about who you may call. The other two are about which number shows on their screen.

The 400 prefix: who it binds

Ley 10/2025, in force since 28 Dec 2025, says in article 16.3 that a company’s customer service line and its sales calls must each use their own specific numbering code. The resolution of 14 Apr 2026 gave sales calls the 400 range: 9-digit numbers that start with 400.

The details matter:

• Outgoing only. A 400 number cannot receive calls, and calls to a 400 number are blocked. A prospect who calls back gets nothing, so give them another way to reach you.
• Sales only. A 400 number cannot be used for customer service or anything else.
• No other range. The resolution gave operators 6 months from 17 Apr 2026 to make the range fully operational. After that, covered companies may make sales calls only from 400 numbers.
• Consumers can opt out. Operators may offer their customers a way to disconnect all calls from the 400 range.

Who is covered is set by article 2 of Ley 10/2025:

1. Companies that deliver basic services in Spain: water, gas and electricity, passenger transport, postal services, electronic communications and financial services.
2. Companies and groups that sell goods or services in Spain mainly to consumers, and that in the previous year had at least 250 employees, more than €50 million in turnover or more than €43 million on the balance sheet.

The law applies whether the company is established in Spain or elsewhere. A software company that sells to businesses usually falls outside both groups. A large ecommerce brand or a bank calling Spanish consumers falls inside. If your company sells to both, ask your counsel which side you fall on.

The mobile ban and blocked calls from abroad

Orden TDF/149/2025 applies to everyone who makes unsolicited sales calls, not only large companies. Two articles change how B2B teams dial Spain:

• Article 9: numbers from the mobile ranges may not be used for customer service or unsolicited sales calls. A rep calling from their Spanish mobile, or a dialer showing one, breaks this rule.
• Article 5: operators must block voice calls received from abroad that show a Spanish number, unless the call is international roaming.

Article 5 catches a common setup. A team in London or New York buys a Spanish geographic number and shows it while the call travels over an international route. In Spain that call now looks like spoofing, and it is blocked before it rings. Local caller ID for Spain only works if the call reaches Spanish operators the way a domestic call would.

The order also enables the free 800 and 900 ranges to make sales calls, so a prospect can call back for free.

What the AEPD expects on every call

The data protection rules sit on top of the numbering rules. The AEPD’s Circular 1/2023 sets how it enforces the right not to receive unwanted sales calls:

• B2B contact data is presumed lawful. Article 5 points to article 19 of Spain’s data protection act: using the work contact details of people who work at a company is presumed lawful when it is limited to what is needed to reach them at work and the only purpose is to deal with their company.
• Random numbers need consent. Calls to randomly generated numbers are not allowed without the person’s prior consent.
• Legitimate interest needs a written balancing test done before you start, and you must be able to show it to the AEPD. Without a contract, a request or an interaction in the last year, the AEPD will not presume that the person expected your call.
• Exclusion lists. You must check advertising exclusion systems where article 23 of the data protection act requires it.

The circular covers calls made by a person. Automated calls with no person on the line need prior consent under a separate rule.

A call opening to copy

Article 6 of the circular lists what to say at the start of each call. In practice:

“Hola, soy Ana, de Northwind Software. Le llamo por un tema comercial: ayudamos a equipos de finanzas a cerrar el mes más rápido. Si prefiere que no le llamemos más, dígamelo y no volveremos a hacerlo.”

That covers the company, the commercial purpose and the right to object. If you call on behalf of a client, name the client too. If the person says anything that clearly means “don’t call me”, treat it as an objection, log it and stop calling that number today. The circular also names call recording as a way to show you followed the rules. Recording has its own legal basis, so check it with your counsel first.

Before your next Spain call block

1. Decide whether Ley 10/2025 covers your company. If it does, get 400 numbers and a separate number prospects can call back.
2. Remove any Spanish mobile number from your caller ID pool.
3. Confirm that calls showing a Spanish number are delivered over a Spanish route, not an international one.
4. Keep your balancing test for legitimate interest on file.
5. Load the opening above into your script and your rep training.
6. Add every objection to your do-not-call list the same day.

As of October 2026, check the BOE for updates. For the rest of Europe, see GDPR and B2B cold calling and France’s 2026 consent rule.

How DialSavvy handles this

DialSavvy runs the numbers and caller ID as the carrier. Before every call it checks calling hours in the contact’s time zone and your do-not-call list, using a rule pack for the country. See the planned dialing modes by country and how the compliance checks work. Numbers, registrations and local caller ID are run by DialSavvy too, so you don’t manage a carrier yourself.

Book a demo and bring your Spain list: we’ll show you which caller IDs and checks apply to it.