Once the deadline expires on 17 October 2026, the 400 prefix will be the only number range from which many companies can make sales calls in Spain. A resolution published in the Spanish Official Gazette (BOE) in April sets this rule. In addition, Law 10/2025 requires operators to block sales calls showing signs of not using that code, and the Government has announced they will do so from October. However, most news stories stop at the number. In this article we explain what changes and who is affected. Above all, we explain what your company needs to review in data protection, because the 400 prefix identifies the call, but it does not make it lawful.
In this article we will discuss...
What the 400 prefix is and where it comes from
The Resolution of 14 April 2026 of the Spanish Secretary of State for Telecommunications assigns the 400 code to commercial calls. It was published on 16 April and came into force the next day. It also gives six months for the range to be fully operational. Therefore, the deadline expires on 17 October 2026. From then on, sales calls by companies in scope may only come from 400 numbers.
Specifically, the resolution implements article 16 of Law 10/2025 of 26 December on customer service. In other words, that law requires companies to clearly separate two things that used to be mixed: the customer service line and the line used to sell.
How 400 numbers work
- First, they are nine-digit numbers that start with 400.
- They can only make calls: they cannot receive them. As a result, nobody can call them back.
- They cannot be used for customer service either, which must use a different number range.
- The Spanish competition and markets authority (CNMC) assigns the numbers to operators in blocks of one thousand. Therefore, a company gets them through its telephone operator.
- Finally, operators may offer their customers, on request, the option to disconnect sales calls from the 400 range. It is an option, not an obligation for the operator.
Which companies must use the 400 prefix?
This is the first nuance that almost nobody mentions. The resolution does not say that every company in Spain must call from a 400 number. It says that companies within the scope of Law 10/2025 cannot use any other range for sales calls. Under article 2 of that law, there are two groups:
- Basic services of general interest, whatever their size: water, gas and electricity; passenger transport by air, rail, sea or bus; postal services; electronic communications and financial services.
- Companies or corporate groups selling mainly to consumers that, in the previous financial year, individually or as a group, reached at least one of these thresholds: 250 employees, more than 50 million euros in turnover or more than 43 million euros in total assets. Therefore, a small subsidiary of a large group may be in scope.
There is also a relevant exception. Section 4 of the single transitional provision does not apply article 14.2 or sections 2 to 4 of article 16, including the separate code for sales calls, to certain retailers. These are electricity, gas and telephone retailers while neither they nor their group reach 5% of the national market and they are not a large company under article 2.2. For electricity and gas, the CNMC publishes market shares every year before March.
What if my company is outside the scope of the law?
In principle, a small business that does not provide basic services and does not exceed the article 2.2 thresholds is not required to use the 400 range. Note, however, that a small company providing a basic service (financial, telecoms, transport…) is in scope whatever its size. However, Law 10/2025 also orders operators to block certain sales calls. These are calls showing signs of not using the specific code or of breaching article 66.1 of the General Telecommunications Law. The detection systems require prior authorisation from the Secretary of State. In addition, the Spanish Government has announced that, from October, operators will block sales calls that do not come from the assigned range. For this reason, our practical advice is clear: if your company does telephone prospecting at some volume, ask your operator now how it will apply the filters.
The most common mistake: thinking the 400 prefix makes the call lawful
The 400 prefix solves an identification problem: people know, before they answer, that someone wants to sell them something. However, it says nothing about whether the company may call that number at all. In fact, another rule answers that question, and it has been in force since 29 June 2023.
Article 66.1.b) of Law 11/2022, the General Telecommunications Law, gives users the right not to receive unwanted sales calls. Therefore, there are only two ways out. The first is the user’s prior consent. The second is another legal basis under article 6.1 GDPR, which in practice means legitimate interest. We covered this change in Is this the end of spam calls?
In other words, calling someone from a 400 number without their consent is still an infringement if there is no proper legitimate interest assessment. In fact, the only thing that changes is that the recipient will know from the start that it is a sales call. As a result, it will be easier for them to complain.
What the Spanish DPA requires from companies making sales calls
The AEPD Circular 1/2023 set out how the Spanish data protection authority applies article 66.1.b). Below are its key points for a company:
- Consent before the call, not during it. In addition, calling randomly generated numbers always requires prior consent.
- Legitimate interest only with a prior, documented assessment for each category of people. Moreover, the Circular presumes, unless proven otherwise, that the call is lawful when there is a prior contractual relationship, the data were lawfully obtained and the offer concerns the company’s own products or services similar to those contracted. However, the AEPD will not presume that the person reasonably expects the call if there is no current contract, request or interaction in the last year.
- Group companies: sharing phone numbers between group companies for marketing requires specific prior consent.
- On every call: identify the company and, where relevant, who it calls for, state the commercial purpose and explain how to object or withdraw consent.
- Any clear “stop calling me” counts as an objection and must be honoured immediately.
- Exclusion lists: companies must check advertising exclusion systems, such as the Robinson List (article 23 of the Spanish Data Protection Act, LOPDGDD).
- Recording: the Circular lists it among the additional safeguards, as a way to prove compliance. In addition, people must be informed under the GDPR, and recordings must not be used for other purposes, such as profiling, without their own legal basis.
What your company should review before 17 October
For a company that sells by phone, the switch to the 400 prefix is a good time to review everything. That is, the whole process, not just the number. This is the checklist we use with our clients:
- Confirm whether you fall within Law 10/2025. Check last year’s thresholds and your sector. If you are in scope, the 400 range is mandatory for sales calls.
- Talk to your operator. Request 400 numbers and ask which blocking criteria it will apply to your lines.
- Separate customer service and sales. The support number cannot be used to sell. In addition, if a customer calls about an outage in a basic service, the law forbids using that call to sell. The exception is when the customer asks for it, or when the offer is related to resolving the incident and improves their conditions or price.
- Review the legal basis of every calling database. Do you have prior consent and can you prove it? Or do you rely on legitimate interest? In that case, you need the assessment in writing.
- Review the call script. It must include identification, the commercial purpose and how to object.
- Organise objections. A “no” on a call must reach the system and block that number for future campaigns.
- Review your call centre contract. If an agency calls on your behalf, it normally acts as a data processor. However, if it brings its own database or decides the purposes, it may be a controller. Therefore, the article 28 GDPR contract must include these instructions. We also understand that the 400 obligation follows the company on whose behalf the calls are made (an interpretation worth confirming with your operator).
- Review the recording notice. If you record, say so at the start of the call and set a retention period.
Penalties: two fronts at once
First, a note on timing. Law 10/2025 came into force on 28 December 2025 and gives twelve months to adapt customer service. The 400 prefix, however, arrives earlier, six months after the Resolution. How both deadlines fit together for penalty purposes is debatable, so the prudent approach is to be ready by October.
This is the second important nuance. A single badly made call can open two separate proceedings. On the one hand, article 23 of Law 10/2025 refers customer service infringements to the consumer protection penalty regime and to regional rules. On the other hand, the same article makes clear that data protection infringements are penalised under the GDPR and the LOPDGDD. In practice, that means proceedings before the AEPD.
For this reason, adapting is not just a technical step with your operator. If the number changes but the database still lacks consent, the risk of a penalty remains. It may even grow, because the user will recognise the sales call sooner.
FAQ about the 400 prefix
When does the 400 prefix become mandatory?
The resolution gave six months from its entry into force on 17 April 2026 for the range to work. Therefore, the deadline expires on 17 October 2026 and, from then on, companies in scope may only make sales calls from 400 numbers.
Can I call a 400 number back?
No. Indeed, they are outgoing-only numbers and cannot receive calls. This also reduces the risk of fraud from calling back unknown numbers.
Can I block all calls starting with 400?
Yes, if your operator offers it. Specifically, the resolution allows operators to let customers, on request, disconnect sales calls from the 400 range.
Does a small company have to use the 400 prefix?
It depends. If it provides a basic service (for example, financial or telecoms services), yes. If not, and it does not exceed the Law 10/2025 thresholds, the resolution does not require it. Even so, it must comply with article 66.1.b) of the General Telecommunications Law and AEPD Circular 1/2023. In addition, it is worth checking with the operator how it will apply the blocks.
Does the 400 prefix replace consent?
No. The 400 prefix only identifies the call as commercial. To call, you still need prior consent or a properly assessed and documented legitimate interest.
How we can help
At Auratech Legal we review our clients’ telephone campaigns end to end: databases, scripts, call centre contracts and legitimate interest assessments. If your company sells by phone and wants to reach 17 October with everything in order, we can help. To do so, see our data protection advisory service or, if you need ongoing support, our outsourced data protection officer service. And if your calls are made by a bot or an AI system, we also review that through our artificial intelligence lawyers.
Sources: Resolution of 14 April 2026 of the Secretary of State for Telecommunications (BOE-A-2026-8409); Law 10/2025 of 26 December (BOE-A-2025-26698), arts. 2, 16, 23 and single transitional provision; Law 11/2022, General Telecommunications Law, art. 66.1.b); AEPD Circular 1/2023 (BOE-A-2023-15071); CNMC note of 27 April 2026 on the assignment of 400 numbers.
This article provides general information and is not a substitute for legal advice on a specific case.
