---
title: "Marketing, newsletters and the Lista Robinson: how to do it legally"
description: "When you can send a newsletter or a commercial email, what the Lista Robinson is and how to ask your customers for permission without risking a spam penalty, with the official sources (LSSI, LOPDGDD, RGPD, AEPD)."
published: "2026-07-16"
updated: "2026-07-16"
author: "Tranquilia by GRAC SA"
canonical: "https://tranquilia.es/en/blog/marketing-newsletters-y-lista-robinson"
note: "General information about the law. It’s no substitute for a lawyer’s advice or a look at your specific case."
---


<!--
  Honesty notice (spanish-legal-copy §4.6, §5 and §7): every legal citation in
  this article was verified against a primary source before being written
  (literal BOE text for LSSI art. 21 and LOPDGDD art. 23.4, EUR-Lex text for
  the RGPD, and the AEPD's own penalty file for the case cited). File
  PS/00362/2020 is real: the official PDF from aepd.es was downloaded and read
  before citing it. No penalty, figure or statistic is asserted that does not
  come from one of these sources. One point is flagged as uncertain further
  down (⚠ REVIEW) and also in 'unverified_claims' in the return value of this
  task: the exact date of the final decision in the file cited (the start date
  of the proceedings and the final amount are known with certainty, but not a
  third date stamp for the decision itself).
-->

# Marketing, newsletters and the Lista Robinson: how to do it legally

**Direct answer:** to send advertising by email, SMS or WhatsApp to someone you need their prior, express permission (art. 21 of the Ley de Servicios de la Sociedad de la Información, LSSI-CE, Spain's information society services act); having them on your customer list is not enough. On top of that, before a campaign you have to check whether that person is signed up to an advertising exclusion system such as the Lista Robinson, Spain's advertising opt-out register (art. 23.4 of the LOPDGDD, Spain's data protection act): if they have told you they do not want advertising, you cannot write to them even if at some point they had given you their email. This article, reviewed on 16 July 2026, explains how to ask for permission properly and what happens if you don't, with a real case from the AEPD (Spain's data protection authority).

## Contents

1. [Do you need permission to send a newsletter or a commercial email?](#necesitas-permiso)
2. [What is the Lista Robinson and what does it have to do with your business?](#lista-robinson)
3. [Do you have to check it before every send?](#consultar-antes-de-cada-envio)
4. [What happens if you send advertising without permission?](#que-pasa-si-no-cumples)
5. [How do you ask for permission properly?](#como-pedir-permiso)
6. [Can you write to a former customer without asking permission again?](#cliente-antiguo)
7. [What does every commercial email or SMS have to carry?](#que-debe-llevar-cada-envio)
8. [What about WhatsApp and other channels?](#whatsapp-otros-canales)
9. [Checklist: get it in order in 15 minutes](#checklist)
10. [Frequently asked questions](#preguntas-frecuentes)
11. [Official sources](#fuentes)

---

## Do you need permission to send a newsletter or a commercial email? {#necesitas-permiso}

Yes, almost always. Article 21 of the LSSI-CE says it plainly: **it is prohibited to send advertising by email, SMS or an equivalent medium that the recipient has not requested or authorised beforehand**. This applies equally to a newsletter with offers, to a one-off campaign email or to an SMS saying "sale this week". The size of your business makes no difference, and nor does whether the send is manual or automatic: the law does not distinguish.

There is an important difference worth being clear about from the start:

- Sending an **administrative email** to a customer (an invoice, an appointment reminder, an order confirmation) does not need this permission: it is not advertising.
- Sending **anything that promotes your business** —a newsletter with news, a discount, an invitation to a commercial event— does need it, even if the message also includes useful information.

If you are unsure whether a particular send is advertising or not, the question you have to ask yourself is simple: is this message trying, even indirectly, to get the person to buy, sign up or get to know better what you sell? If the answer is yes, you need their permission.

## What is the Lista Robinson and what does it have to do with your business? {#lista-robinson}

The **Lista Robinson** is a free service where anyone can sign up to stop receiving advertising by telephone, postal mail, email or SMS/MMS. It is run by [Adigital, la Asociación Española de la Economía Digital](https://www.listarobinson.es), and it is today the reference advertising exclusion system in Spain. Signing up costs the citizen nothing, and the person chooses which specific channel they do not want to be written to on.

The law (art. 23.4 LOPDGDD) requires **anyone who is going to do direct marketing** to check these exclusion systems beforehand and to exclude from the send anyone who has signed up. It is a separate layer of protection, additional to consent: even if someone has never explicitly said no to you, if they are on the Lista Robinson for the channel you are going to use, the law requires you to respect it just the same.

## Do you have to check it before every send? {#consultar-antes-de-cada-envio}

You have to check it **before every direct marketing campaign**, not just the first time. A person can sign up to the Lista Robinson at any moment, even after having given you their email. Bear in mind too that, according to the service itself, a new registration can take **up to two months to be fully effective** across all the databases that consult it, because the contacts may already be loaded into campaigns that are under way.

In practice, for a small business this comes down to two habits, not to a complex task:

1. Before launching a contact capture campaign to new contacts (bought, transferred or collected outside your own relationship with the customer), cross-check the list against the exclusion file.
2. If you use a well-known email marketing tool (Mailchimp, Brevo, Sendinblue and the like), ask whether it already integrates the check against advertising exclusion systems: several offer it as a feature, which saves you the manual step.

If you only write to your own customers, who gave you their email directly and ticked the permission box, the risk that they are on the Lista Robinson without your knowing is low, but the obligation to check still exists in law when you do direct marketing.

## What happens if you send advertising without permission? {#que-pasa-si-no-cumples}

This is not a hypothesis: the AEPD penalises this kind of case fairly regularly, and the amount is usually moderate, not the million-euro figures sometimes associated with the RGPD (the EU General Data Protection Regulation). A real example, public on the AEPD's website:

In case file **[PS/00362/2020](https://www.aepd.es/documento/ps-00362-2020.pdf)**, a company (beiNNova) sent several commercial newsletters to a person who had never subscribed. The person asked to unsubscribe **three times** through the link in the emails themselves and, getting no response, wrote directly asking them to delete their address; the company carried on sending newsletters anyway. The AEPD treated this as an infringement of **article 21 of the LSSI** —sending commercial communications without consent— and imposed a **penalty of 2,000 euros**, aggravated by the intent of carrying on writing despite the unsubscribe requests.

This type of infringement is classified as **minor** in art. 38.4.d) of the LSSI when there are no more serious circumstances, with a fine of **up to 30,000 euros** under art. 39.1.c) of the same law; the final amount depends on whether there is intent, repeat offending, or on the size of the business. If there is also a broader data protection breach —for example, having no legal basis at all for processing the contact, or systematically ignoring the right to object under art. 21 of the RGPD—, the AEPD can also apply the RGPD's general penalty regime, which sets its maximums at 10 or 20 million euros (or 2% and 4% of worldwide turnover, whichever of the two is higher, depending on the infringement, art. 83 RGPD). In practice those maximums are the legal ceiling, not the norm: what really makes the difference, as in the case cited, is answering unsubscribe requests the first time they are made.

## How do you ask for permission properly? {#como-pedir-permiso}

Consent has to be a **clear affirmative action** by the person: a box that they tick, empty by default, never pre-ticked by you (arts. 4.11 and 7 of the RGPD). Some rules that are often broken, and worth reviewing in your own form:

- **One box per channel.** "I want to receive offers by email" and "I want to receive offers by WhatsApp" are two different permissions. Do not group them into a single "I accept commercial communications".
- **Never pre-ticked.** If the box comes already ticked, that consent is worthless in law: it is not an affirmative action by the person.
- **Do not mix it with accepting the privacy policy.** Accepting that you process their data to handle the purchase is one thing; wanting to receive advertising is another. They are two different consents with two different purposes.
- **Do not make anything conditional on it.** Not ticking the marketing box cannot prevent the person from buying, registering or using your service.
- **Keep the evidence.** Date, time and channel of every "yes". If one day you are asked for it, you have to be able to show that the person ticked it themselves.

The legal basis for this permission is consent (art. 6.1.a RGPD): the person remains your customer whether they say yes or no. There is no need —and it is not valid— to justify sending advertising on the business's legitimate interest: for advertising by email, SMS or WhatsApp, the law expressly requires that explicit "yes" (art. 21 LSSI).

## Can you write to a former customer without asking permission again? {#cliente-antiguo}

In one specific case, yes, without needing a new express "yes": it is the exception in **article 21.2 of the LSSI**. It applies when **all** of these conditions are met at the same time:

1. A **prior contractual relationship** with that person already exists or existed (they bought something from you, took on a service).
2. You obtained their email or telephone number **lawfully**, within the framework of that relationship, not bought or transferred by a third party.
3. What you are sending them are **your own similar products or services** to the ones they already took on, not anything else you happen to sell.
4. You offer them, from the very first send, a **simple and free** way to object, both when you collect the data and in every subsequent communication.

This exception has a common name in the industry, "similar customer" or *soft opt-in*, but it is not a free pass: if you sold them plumbing work and you write to them with offers for an unrelated product, or if you never gave them the option to object from the start, the exception does not apply and you need their express consent like any new contact.

## What does every commercial email or SMS have to carry? {#que-debe-llevar-cada-envio}

As well as having permission, every commercial communication has to include, by law:

- **Who is sending it**, clearly: the name of your business, not just a generic address like `no-reply@`.
- **A valid contact address** where the person can exercise their right to object —art. 21 LSSI itself expressly prohibits sending communications that do not include this route—.
- **A link or a simple, free procedure to unsubscribe**, one that genuinely works first time. The AEPD case cited above is exactly an example of what not to do: the person asked to unsubscribe three times and carried on receiving emails.
- **Clear identification that it is advertising**, without disguising it as another type of communication.

When someone unsubscribes, the unsubscribe has to take effect immediately, not in the next campaign "because it was already scheduled". Keep a record of the date they unsubscribed: it is your evidence that you respected their decision if you are ever asked.

## What about WhatsApp and other channels? {#whatsapp-otros-canales}

The same rules as for email apply to WhatsApp Business, SMS and automated calls: they are "equivalent electronic communication media" for the purposes of art. 21 LSSI, so they need the same prior permission, specific to each channel, and the same ease of unsubscribing (replying «BAJA», the Spanish word for unsubscribe, for example).

**Sales calls with a human operator** follow a somewhat different regime: the Lista Robinson also covers this channel, and the AEPD devotes its own frequently asked questions section to unsolicited sales calls —worth reviewing if your business does active telemarketing—.

Postal mail is the channel where the requirement of prior consent is most relaxed, but **the Lista Robinson applies there too**: if someone signs up not to receive advertising mail on paper, you have to respect it just as in the electronic channels.

## Checklist: get it in order in 15 minutes {#checklist}

1. **Review your contact capture form.** Does it have an empty box per channel, not pre-ticked, separate from acceptance of the privacy policy?
2. **Check that you keep the evidence of every "yes"**: date, time and channel.
3. **Before your next campaign to new contacts**, check the Lista Robinson or confirm that your sending tool already does it for you.
4. **Review the footer of your commercial emails and SMS**: business name, contact address and unsubscribe link visible and genuinely working.
5. **Test the unsubscribe process yourself** on your own newsletter: unsubscribe as if you were a customer and check that it stops arriving straight away.
6. **If you use the "similar customer" exception**, confirm that you meet the four conditions in art. 21.2 LSSI, not just some of them.

None of this requires complex technical development: it is reviewing a form, an email footer and one habit before each campaign.

## Frequently asked questions {#preguntas-frecuentes}

**Can I send a newsletter to the emails I collected at a trade fair or event?**
Only if those people gave you their email specifically to receive advertising from you, with a clear action on their part (for example, ticking a box on a card or form). Collecting business cards to "have the contact" is not the same as permission to send advertising.

**Is it acceptable to put "by registering you accept receiving our news" in the small print?**
No. Consent has to be an affirmative and specific action —a box that the person ticks themselves for that particular purpose—, not a condition hidden in a text nobody reads.

**Do I have to check the Lista Robinson even if I only have 50 contacts?**
The obligation in art. 23.4 LOPDGDD does not set a minimum threshold of contacts: it applies to anyone doing direct marketing, whether the send is large or small.

**Can I carry on writing to someone who unsubscribed if I have their consent signed on paper?**
No. Unsubscribing withdraws the consent, whatever the medium in which you gave it. From the unsubscribe onwards, you cannot write to them again unless they say yes once more.

**Is the fine for spam always thousands of euros?**
There is no fixed figure: it depends on whether there is intent, repeat offending, and on the size of the business. The case cited in this article (2,000 €) is a real example, not an average nor a figure that can be generalised to any situation.

---

## Where to go from here

Asking for permission properly, channel by channel and with the evidence kept, is one specific document: the marketing consent form. At Tranquilia we generate it with the right boxes already separated by channel, ready for your website or your counter.

<!-- Contextual CTA, domain as a placeholder — never hard-coded (packages/brand/brand.ts, §23). -->
👉 [Generate your marketing permission form](tranquilia.es) — free for up to 2 companies, no card and no time limit.

---

<!-- ⚠ REVIEW: the AEPD's file PS/00362/2020 confirms with certainty the start
     date of the proceedings (04/12/2020) and the final amount (2,000 €, with
     no submissions filed), but the fragment of the document with the exact
     date of the final decision ("TERCERO") could not be extracted from the
     PDF. The file is cited by its number and year, without asserting a
     specific decision date that could not be verified. -->

*Report produced with Tranquilia — it does not constitute an official
certification or a legal opinion. Always check specific cases with your
gestoría (a firm that handles other businesses' administrative and tax
paperwork) or with a legal professional.*

## Official sources {#fuentes}

- Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico (LSSI-CE), art. 21 (prohibition of commercial communications without consent) and arts. 38.4.d) and 39.1.c) (penalty regime) — [BOE](https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758)
- Ley Orgánica 3/2018, de 5 de diciembre (LOPDGDD), art. 23.4 (advertising exclusion systems) — [BOE](https://www.boe.es/eli/es/lo/2018/12/05/3)
- Reglamento (UE) 2016/679 (RGPD), arts. 4.11 and 7 (consent), art. 6.1.a (legal basis) and art. 21 (right to object to direct marketing) — [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- AEPD — [Penalty file PS/00362/2020](https://www.aepd.es/documento/ps-00362-2020.pdf) (sending newsletters without consent, infringement of art. 21 LSSI, penalty of 2,000 €)
- AEPD — [«Publicidad no deseada»](https://www.aepd.es/preguntas-frecuentes/5-publicidad-no-deseada), official frequently asked questions
- [Lista Robinson](https://www.listarobinson.es), advertising exclusion system run by Adigital (Asociación Española de la Economía Digital)