GDPR and sales calls to leads in education (Spain)

A summary of the Spanish and EU rules that apply when an AI voice agent calls or messages your leads: consent, minors, WhatsApp, transparency and how to reflect it all in Reshape.

What you'll achieve

  • Know which rules apply when you call or message a lead
  • A form and a campaign with consent properly collected
  • An agent that identifies itself as AI and honors opt-outs on every channel

When you can call a lead

The short rule: with an AI voice agent, have prior, specific and provable consent to receive sales calls. It's the only basis that safely fits art. 66 of the Telecommunications Act.

Art. 66.1, Law 11/2022 (our translation; the Spanish text prevails)
a) not to receive automated calls without human intervention or faxes for
   commercial purposes without having given prior consent;

b) not to receive unwanted calls for commercial purposes, unless the user has
   given prior consent to receive this type of commercial communication or the
   communication can rely on another legal basis under Article 6.1 of
   Regulation (EU) 2016/679 […].
Type of call
Automated, without human intervention, for commercial purposes
Rule
Art. 66.1.a
Possible basis
Prior consent only
Type of call
Sales call with a human
Rule
Art. 66.1.b
Possible basis
Prior consent or another GDPR art. 6.1 basis (e.g. legitimate interest, with a documented balancing test)
Provable
The school "shall be able to demonstrate" that the lead consented (GDPR art. 7). Keep the date, time, form, accepted wording and IP or source.
Separate
From other matters, in clear language. Hiding it in the terms and conditions doesn't count.
Revocable
"It shall be as easy to withdraw as to give consent."
Specific
An unticked checkbox that explicitly mentions sales calls, plus separate ones for WhatsApp or email if you'll use them.

Robinson List (LOPDGDD art. 23): before direct marketing you must check the advertising opt-out registries and exclude anyone who has opted out. You don't need to check it if the lead gave consent to the caller.

Minors

In education the lead is often a minor, for example a high school student asking about a degree. LOPDGDD art. 7 sets the line at 14: from that age, minors can consent themselves; below it, consent must come from the parent or legal guardian.

Lead's age
14 or older
Who consents
The lead
In practice
Ask for date of birth or an "I'm 14 or older" checkbox on the form
Lead's age
Under 14
Who consents
Parent or guardian
In practice
A form for families: the phone number and consent belong to the guardian, and the call goes to the guardian
  • Legitimate interest carries less weight "in particular where the data subject is a child" (GDPR art. 6.1.f). One more reason to rely on consent only.
  • Adapt the agent's script: simple language, no sales pressure, and offer to speak with the family.
  • Parents or guardians can exercise access, rectification and other rights for children under 14 (LOPDGDD art. 12.6).

WhatsApp, SMS and email

Commercial messages over electronic channels fall under LSSI art. 21, which bans sending them unless they were requested or authorized beforehand.

Consent per channel
The form must collect calls, WhatsApp and email separately.
Existing-customer exception (art. 21.2)
Only with a prior contractual relationship and for similar products or services. A lead who has only asked for information isn't a customer yet. A former student you offer a master's to might be.
Opt-out in every message (arts. 21.2 and 22.1)
A simple, free procedure. In email, a valid unsubscribe address is mandatory. On WhatsApp, add "Reply STOP to stop receiving messages".
Service vs. commercial
A reminder about an interview the candidate booked isn't promotional. Offering them another program is.

AI voice agents: transparency, recording and objection

1. Say it's an AI
AI Act art. 50.1 (applicable from August 2, 2026, under art. 113) requires telling people they're talking to an AI system, unless it's obvious. On a phone call it isn't, so the agent says so up front: "Hi, I'm LidIA, a virtual assistant from [school]…".
2. AI doesn't decide admissions
Annex III.3.a classes as high-risk any system intended to "determine access or admission" to educational institutions. Informing, confirming interviews or booking appointments isn't deciding admission. Filtering or scoring candidates for admission puts you under a much stricter regime: keep that decision in human hands.
3. Inform at the start
GDPR art. 13 and LOPDGDD art. 11 (layered information): who is calling, why, and where to find the rest of the information and exercise rights. If the call is recorded and transcribed, say that too.
4. Right to object
For direct marketing, the lead can object "at any time" (GDPR art. 21), and must be told "at the latest at the time of the first communication". If they say "don't call me again", the agent accepts it without pushing, and the opt-out applies across every channel and campaign.
Example opening line for the agent
I'm calling from [school] about your request for information on [program]. I'm a virtual assistant and this call is recorded to handle your request. You can find more privacy information at [website/privacy].
1

Step 1 of 4

Before the call: the school's form

Add separate, unticked checkboxes, one per channel:

  • "I agree that [school] may call me, including through a virtual assistant, to tell me about [programs]."
  • "I agree to receive information by WhatsApp."
  • "I agree to receive information by email."
  • Age: date of birth or an "I'm 14 or older" checkbox. If not, a flow for guardians.
  • First layer of information (controller, purpose and rights) with a link to the privacy policy.
  • Keep the proof: accepted wording, date and time, and source. Send it to Reshape as metadata so it's attached to the conversation.
Example metadata when starting the conversation
"metadata": {
  "consentimiento_llamada": true,
  "fecha_consentimiento": "2026-10-06T10:42:00+02:00",
  "origen_consentimiento": "Web form · Business degree"
}
2

Step 2 of 4

In the campaign

  • Launch only leads with consent for calls. Filter in your CRM before sending them via API or uploading the list.
  • Turn on Enable scheduling in Schedule settings, with reasonable time slots and Respect the lead's time zone.
  • Limit retries and set a Maximum retry window (days): pushing too hard is also an "unwanted call".
  • Use WhatsApp as a retry only if there's consent for WhatsApp.
3

Step 3 of 4

In the agent

In Voice agents → Configure settings:

Prompt
In the first sentence, introduce itself as a virtual assistant, name the school and the reason for the call. Mention the recording. Immediately accept any "don't call me".
Data Collection
An oposicion_comercial field (yes/no) and an es_menor field if the agent detects it's talking to a child under 14 without a guardian.
Transfer Call
To a person at the school if the lead wants to exercise their rights or asks legal questions.
4

Step 4 of 4

After the call

Automation
In Integrations → Automations, a Conversation completed event with the Opt-out requested reason → webhook to the CRM to flag the lead as "do not contact".
stop_campaign_leads
Stop that lead's retries in the running campaign via the API.
Retention
Decide how long you keep recordings and transcripts, and delete or anonymize them when that period ends.
Data processing agreement
Reshape processes data on the school's behalf: sign the processor agreement (GDPR art. 28) and add it to your record of processing activities.

Compliance checklist

  • Prior, specific, unticked consent for calls (including calls by a virtual assistant), separate from WhatsApp and email
  • Proof of consent stored: wording, date and time, source
  • Age check: 14 or older, or guardian consent
  • First layer of information on the form and a linked privacy policy
  • Robinson List checked if doing direct marketing without consent
  • Agent that identifies itself as AI, names the school, explains the reason and mentions the recording
  • AI doesn't decide admissions: it only informs, confirms or books
  • Immediate opt-out on every channel (agent, automation, CRM and stop_campaign_leads)
  • Opt-out in every WhatsApp message and email
  • Reasonable calling hours and limited retries
  • Processor agreement with Reshape and a defined retention period for recordings
  • Review by your DPO or legal advisor, including AEPD Circular 1/2023

Official sources consulted

  • Regulation (EU) 2016/679 (GDPR), EUR-Lex: arts. 6, 7, 13, 21 and recital 47. OJ L 119, 4.5.2016.
  • Organic Law 3/2018 (LOPDGDD), BOE consolidated text: arts. 7, 11, 12.6 and 23. Last amended: 27/12/2025.
  • Law 11/2022, General Telecommunications Act, BOE consolidated text: art. 66. Last amended: 27/12/2025.
  • Law 34/2002 (LSSI), BOE consolidated text: arts. 21 and 22. Last amended: 23/01/2025.
  • Regulation (EU) 2024/1689 (AI Act), EUR-Lex: art. 50, art. 113 and Annex III.3. OJ L, 12.7.2024.
  • AEPD Circular of June 26, 2023 (BOE-A-2023-15071), cited in the consolidated text of art. 66. Its content was not reviewed for this guide.
  • Spanish Data Protection Agency (AEPD): guides and decisions on sales calls.

Want us to review it with you?

We'll show you how to set up the agent, the campaign and opt-outs in Reshape so your legal team can sign off.

Book a demoGo to ReshapeOS
Try an agent