Marketing, newsletters and the Lista Robinson: how to do it legally

Direct answer: to send advertising by email, SMS or WhatsApp to someone you need their prior, express permission (art. 21 of the Ley de Servicios de la Sociedad de la Información, LSSI-CE, Spain's information society services act); having them on your customer list is not enough. On top of that, before a campaign you have to check whether that person is signed up to an advertising exclusion system such as the Lista Robinson, Spain's advertising opt-out register (art. 23.4 of the LOPDGDD, Spain's data protection act): if they have told you they do not want advertising, you cannot write to them even if at some point they had given you their email. This article, reviewed on 16 July 2026, explains how to ask for permission properly and what happens if you don't, with a real case from the AEPD (Spain's data protection authority).

Contents

1. Do you need permission to send a newsletter or a commercial email?
2. What is the Lista Robinson and what does it have to do with your business?
3. Do you have to check it before every send?
4. What happens if you send advertising without permission?
5. How do you ask for permission properly?
6. Can you write to a former customer without asking permission again?
7. What does every commercial email or SMS have to carry?
8. What about WhatsApp and other channels?
9. Checklist: get it in order in 15 minutes
10. Frequently asked questions
11. Official sources

---

Do you need permission to send a newsletter or a commercial email?

Yes, almost always. Article 21 of the LSSI-CE says it plainly: it is prohibited to send advertising by email, SMS or an equivalent medium that the recipient has not requested or authorised beforehand. This applies equally to a newsletter with offers, to a one-off campaign email or to an SMS saying "sale this week". The size of your business makes no difference, and nor does whether the send is manual or automatic: the law does not distinguish.

There is an important difference worth being clear about from the start:

• Sending an administrative email to a customer (an invoice, an appointment reminder, an order confirmation) does not need this permission: it is not advertising.
• Sending anything that promotes your business —a newsletter with news, a discount, an invitation to a commercial event— does need it, even if the message also includes useful information.

If you are unsure whether a particular send is advertising or not, the question you have to ask yourself is simple: is this message trying, even indirectly, to get the person to buy, sign up or get to know better what you sell? If the answer is yes, you need their permission.

What is the Lista Robinson and what does it have to do with your business?

The Lista Robinson is a free service where anyone can sign up to stop receiving advertising by telephone, postal mail, email or SMS/MMS. It is run by Adigital, la Asociación Española de la Economía Digital, and it is today the reference advertising exclusion system in Spain. Signing up costs the citizen nothing, and the person chooses which specific channel they do not want to be written to on.

The law (art. 23.4 LOPDGDD) requires anyone who is going to do direct marketing to check these exclusion systems beforehand and to exclude from the send anyone who has signed up. It is a separate layer of protection, additional to consent: even if someone has never explicitly said no to you, if they are on the Lista Robinson for the channel you are going to use, the law requires you to respect it just the same.

Do you have to check it before every send?

You have to check it before every direct marketing campaign, not just the first time. A person can sign up to the Lista Robinson at any moment, even after having given you their email. Bear in mind too that, according to the service itself, a new registration can take up to two months to be fully effective across all the databases that consult it, because the contacts may already be loaded into campaigns that are under way.

In practice, for a small business this comes down to two habits, not to a complex task:

1. Before launching a contact capture campaign to new contacts (bought, transferred or collected outside your own relationship with the customer), cross-check the list against the exclusion file.
2. If you use a well-known email marketing tool (Mailchimp, Brevo, Sendinblue and the like), ask whether it already integrates the check against advertising exclusion systems: several offer it as a feature, which saves you the manual step.

If you only write to your own customers, who gave you their email directly and ticked the permission box, the risk that they are on the Lista Robinson without your knowing is low, but the obligation to check still exists in law when you do direct marketing.

What happens if you send advertising without permission?

This is not a hypothesis: the AEPD penalises this kind of case fairly regularly, and the amount is usually moderate, not the million-euro figures sometimes associated with the RGPD (the EU General Data Protection Regulation). A real example, public on the AEPD's website:

In case file PS/00362/2020, a company (beiNNova) sent several commercial newsletters to a person who had never subscribed. The person asked to unsubscribe three times through the link in the emails themselves and, getting no response, wrote directly asking them to delete their address; the company carried on sending newsletters anyway. The AEPD treated this as an infringement of article 21 of the LSSI —sending commercial communications without consent— and imposed a penalty of 2,000 euros, aggravated by the intent of carrying on writing despite the unsubscribe requests.

This type of infringement is classified as minor in art. 38.4.d) of the LSSI when there are no more serious circumstances, with a fine of up to 30,000 euros under art. 39.1.c) of the same law; the final amount depends on whether there is intent, repeat offending, or on the size of the business. If there is also a broader data protection breach —for example, having no legal basis at all for processing the contact, or systematically ignoring the right to object under art. 21 of the RGPD—, the AEPD can also apply the RGPD's general penalty regime, which sets its maximums at 10 or 20 million euros (or 2% and 4% of worldwide turnover, whichever of the two is higher, depending on the infringement, art. 83 RGPD). In practice those maximums are the legal ceiling, not the norm: what really makes the difference, as in the case cited, is answering unsubscribe requests the first time they are made.

How do you ask for permission properly?

Consent has to be a clear affirmative action by the person: a box that they tick, empty by default, never pre-ticked by you (arts. 4.11 and 7 of the RGPD). Some rules that are often broken, and worth reviewing in your own form:

• One box per channel. "I want to receive offers by email" and "I want to receive offers by WhatsApp" are two different permissions. Do not group them into a single "I accept commercial communications".
• Never pre-ticked. If the box comes already ticked, that consent is worthless in law: it is not an affirmative action by the person.
• Do not mix it with accepting the privacy policy. Accepting that you process their data to handle the purchase is one thing; wanting to receive advertising is another. They are two different consents with two different purposes.
• Do not make anything conditional on it. Not ticking the marketing box cannot prevent the person from buying, registering or using your service.
• Keep the evidence. Date, time and channel of every "yes". If one day you are asked for it, you have to be able to show that the person ticked it themselves.

The legal basis for this permission is consent (art. 6.1.a RGPD): the person remains your customer whether they say yes or no. There is no need —and it is not valid— to justify sending advertising on the business's legitimate interest: for advertising by email, SMS or WhatsApp, the law expressly requires that explicit "yes" (art. 21 LSSI).

Can you write to a former customer without asking permission again?

In one specific case, yes, without needing a new express "yes": it is the exception in article 21.2 of the LSSI. It applies when all of these conditions are met at the same time:

1. A prior contractual relationship with that person already exists or existed (they bought something from you, took on a service).
2. You obtained their email or telephone number lawfully, within the framework of that relationship, not bought or transferred by a third party.
3. What you are sending them are your own similar products or services to the ones they already took on, not anything else you happen to sell.
4. You offer them, from the very first send, a simple and free way to object, both when you collect the data and in every subsequent communication.

This exception has a common name in the industry, "similar customer" or soft opt-in, but it is not a free pass: if you sold them plumbing work and you write to them with offers for an unrelated product, or if you never gave them the option to object from the start, the exception does not apply and you need their express consent like any new contact.

What does every commercial email or SMS have to carry?

As well as having permission, every commercial communication has to include, by law:

• Who is sending it, clearly: the name of your business, not just a generic address like no-reply@.
• A valid contact address where the person can exercise their right to object —art. 21 LSSI itself expressly prohibits sending communications that do not include this route—.
• A link or a simple, free procedure to unsubscribe, one that genuinely works first time. The AEPD case cited above is exactly an example of what not to do: the person asked to unsubscribe three times and carried on receiving emails.
• Clear identification that it is advertising, without disguising it as another type of communication.

When someone unsubscribes, the unsubscribe has to take effect immediately, not in the next campaign "because it was already scheduled". Keep a record of the date they unsubscribed: it is your evidence that you respected their decision if you are ever asked.

What about WhatsApp and other channels?

The same rules as for email apply to WhatsApp Business, SMS and automated calls: they are "equivalent electronic communication media" for the purposes of art. 21 LSSI, so they need the same prior permission, specific to each channel, and the same ease of unsubscribing (replying «BAJA», the Spanish word for unsubscribe, for example).

Sales calls with a human operator follow a somewhat different regime: the Lista Robinson also covers this channel, and the AEPD devotes its own frequently asked questions section to unsolicited sales calls —worth reviewing if your business does active telemarketing—.

Postal mail is the channel where the requirement of prior consent is most relaxed, but the Lista Robinson applies there too: if someone signs up not to receive advertising mail on paper, you have to respect it just as in the electronic channels.

Checklist: get it in order in 15 minutes

1. Review your contact capture form. Does it have an empty box per channel, not pre-ticked, separate from acceptance of the privacy policy?
2. Check that you keep the evidence of every "yes": date, time and channel.
3. Before your next campaign to new contacts, check the Lista Robinson or confirm that your sending tool already does it for you.
4. Review the footer of your commercial emails and SMS: business name, contact address and unsubscribe link visible and genuinely working.
5. Test the unsubscribe process yourself on your own newsletter: unsubscribe as if you were a customer and check that it stops arriving straight away.
6. If you use the "similar customer" exception, confirm that you meet the four conditions in art. 21.2 LSSI, not just some of them.

None of this requires complex technical development: it is reviewing a form, an email footer and one habit before each campaign.

Frequently asked questions

Can I send a newsletter to the emails I collected at a trade fair or event? Only if those people gave you their email specifically to receive advertising from you, with a clear action on their part (for example, ticking a box on a card or form). Collecting business cards to "have the contact" is not the same as permission to send advertising.

Is it acceptable to put "by registering you accept receiving our news" in the small print? No. Consent has to be an affirmative and specific action —a box that the person ticks themselves for that particular purpose—, not a condition hidden in a text nobody reads.

Do I have to check the Lista Robinson even if I only have 50 contacts? The obligation in art. 23.4 LOPDGDD does not set a minimum threshold of contacts: it applies to anyone doing direct marketing, whether the send is large or small.

Can I carry on writing to someone who unsubscribed if I have their consent signed on paper? No. Unsubscribing withdraws the consent, whatever the medium in which you gave it. From the unsubscribe onwards, you cannot write to them again unless they say yes once more.

Is the fine for spam always thousands of euros? There is no fixed figure: it depends on whether there is intent, repeat offending, and on the size of the business. The case cited in this article (2,000 €) is a real example, not an average nor a figure that can be generalised to any situation.

---

Where to go from here

Asking for permission properly, channel by channel and with the evidence kept, is one specific document: the marketing consent form. At Tranquilia we generate it with the right boxes already separated by channel, ready for your website or your counter.

👉 Generate your marketing permission form — free for up to 2 companies, no card and no time limit.

---

Report produced with Tranquilia — it does not constitute an official certification or a legal opinion. Always check specific cases with your gestoría (a firm that handles other businesses' administrative and tax paperwork) or with a legal professional.

Official sources

• Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico (LSSI-CE), art. 21 (prohibition of commercial communications without consent) and arts. 38.4.d) and 39.1.c) (penalty regime) — BOE
• Ley Orgánica 3/2018, de 5 de diciembre (LOPDGDD), art. 23.4 (advertising exclusion systems) — BOE
• Reglamento (UE) 2016/679 (RGPD), arts. 4.11 and 7 (consent), art. 6.1.a (legal basis) and art. 21 (right to object to direct marketing) — EUR-Lex
• AEPD — Penalty file PS/00362/2020 (sending newsletters without consent, infringement of art. 21 LSSI, penalty of 2,000 €)
• AEPD — «Publicidad no deseada», official frequently asked questions
• Lista Robinson, advertising exclusion system run by Adigital (Asociación Española de la Economía Digital)